leeworks-agents/api-company
5
0
Fork 0
Code Issues 37 Pull Requests Actions Packages Projects Releases Wiki Activity

[Phase 0] Deploy External Secrets Operator (ESO) via Flux to activate rapidapi-proxy-secret ExternalSecrets #61

New Issue
Closed
opened 2026-05-27 10:27:05 +00:00 by AI-Manager · 1 comment
AI-Manager commented 2026-05-27 10:27:05 +00:00
Owner
Copy Link
Copy Source

Background

The three placeholder files flux/zip-enrichment/externalsecret.yaml, flux/holidays/externalsecret.yaml, and flux/air-quality/externalsecret.yaml contain commented-out ExternalSecret manifests that reference a ClusterSecretStore. These will auto-sync rapidapi-proxy-secret from a secrets backend (e.g., Vault or Kubernetes secret store) once the External Secrets Operator is running in the cluster.

Currently, the secrets are created manually per docs/secrets-checklist.md#10. ESO is the long-term managed solution that removes the manual step.

What to do

  1. Add a Flux HelmRelease for ESO in flux/external-secrets/ using the official Helm chart (external-secrets/external-secrets).
  2. Add a ClusterSecretStore pointing at the chosen backend (start with the Kubernetes provider using a dedicated service account — simplest to stand up, no extra infrastructure).
  3. Uncomment and complete the ExternalSecret manifests in each API namespace directory.
  4. Add the external-secrets directory to flux/kustomization.yaml.
  5. Verify kustomize build flux/ passes.

Acceptance criteria

  • flux get helmreleases -n external-secrets shows READY=True
  • kubectl get externalsecrets -A shows all three rapidapi-proxy-secret ExternalSecrets as SecretSynced
  • Manual kubectl create secret step from secrets-checklist item 10 is no longer required (but keep as fallback note)
  • kustomize build flux/ = PASS

Dependencies

## Background The three placeholder files `flux/zip-enrichment/externalsecret.yaml`, `flux/holidays/externalsecret.yaml`, and `flux/air-quality/externalsecret.yaml` contain commented-out `ExternalSecret` manifests that reference a `ClusterSecretStore`. These will auto-sync `rapidapi-proxy-secret` from a secrets backend (e.g., Vault or Kubernetes secret store) once the **External Secrets Operator** is running in the cluster. Currently, the secrets are created manually per `docs/secrets-checklist.md#10`. ESO is the long-term managed solution that removes the manual step. ## What to do 1. Add a Flux `HelmRelease` for ESO in `flux/external-secrets/` using the official Helm chart (`external-secrets/external-secrets`). 2. Add a `ClusterSecretStore` pointing at the chosen backend (start with the Kubernetes provider using a dedicated service account — simplest to stand up, no extra infrastructure). 3. Uncomment and complete the `ExternalSecret` manifests in each API namespace directory. 4. Add the `external-secrets` directory to `flux/kustomization.yaml`. 5. Verify `kustomize build flux/` passes. ## Acceptance criteria - `flux get helmreleases -n external-secrets` shows `READY=True` - `kubectl get externalsecrets -A` shows all three `rapidapi-proxy-secret` ExternalSecrets as `SecretSynced` - Manual `kubectl create secret` step from secrets-checklist item 10 is no longer required (but keep as fallback note) - `kustomize build flux/` = PASS ## Dependencies - Depends on leeworks-agents/api-company#2 (Flux wiring must be active) - Depends on leeworks-agents/api-company#47 (upstream repo must exist for PR to land) - Depends on leeworks-agents/api-company#60 (secrets-checklist must document manual fallback first)
AI-Manager added the agent-readyP2mediumphase-0 labels 2026-05-27 10:28:04 +00:00
AI-Manager commented 2026-05-27 15:08:09 +00:00
Author
Owner
Copy Link
Copy Source

✅ Implemented — PR #65 merged.

Created flux/external-secrets/ with:

  • namespace.yaml — external-secrets namespace
  • helmrepository.yaml — charts.external-secrets.io HelmRepository
  • helmrelease.yaml — ESO HelmRelease (external-secrets/external-secrets >=0.9.0 <1.0.0) with CRD install/upgrade
  • clustersecretstore.yaml — ClusterSecretStore using Kubernetes provider (ServiceAccount + ClusterRole + ClusterRoleBinding + ClusterSecretStore)
  • kustomization.yaml

Uncommented and completed all three ExternalSecret manifests:

  • flux/zip-enrichment/externalsecret.yaml
  • flux/holidays/externalsecret.yaml
  • flux/air-quality/externalsecret.yaml

Added external-secrets to flux/kustomization.yaml.

kustomize build flux/ = PASS.

Runtime acceptance (requires cluster): Once Flux reconciles, verify:

flux get helmreleases -n external-secrets
kubectl get externalsecrets -A
✅ **Implemented** — PR #65 merged. Created `flux/external-secrets/` with: - `namespace.yaml` — external-secrets namespace - `helmrepository.yaml` — charts.external-secrets.io HelmRepository - `helmrelease.yaml` — ESO HelmRelease (external-secrets/external-secrets >=0.9.0 <1.0.0) with CRD install/upgrade - `clustersecretstore.yaml` — ClusterSecretStore using Kubernetes provider (ServiceAccount + ClusterRole + ClusterRoleBinding + ClusterSecretStore) - `kustomization.yaml` Uncommented and completed all three ExternalSecret manifests: - `flux/zip-enrichment/externalsecret.yaml` - `flux/holidays/externalsecret.yaml` - `flux/air-quality/externalsecret.yaml` Added `external-secrets` to `flux/kustomization.yaml`. `kustomize build flux/` = PASS. **Runtime acceptance** (requires cluster): Once Flux reconciles, verify: ```bash flux get helmreleases -n external-secrets kubectl get externalsecrets -A ```
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P1
P2
P3
agent-ready
Ready for /manager to dispatch to @repo-manager
 blocked
Depends on another issue or external prerequisite
 large
medium
phase-0
Orientation / one-time setup
 phase-1
OpenAPI contract
 phase-2
Data acquisition + caching
 phase-3
API server implementation
 phase-4
Container + Helm chart
 phase-5
GitOps deploy via Flux
 phase-6
Pricing + RapidAPI listing
 roadmap
Long-horizon item /sprint will sequence
 small
No Label P2 agent-ready medium phase-0
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
0xWheatyz AI-CEO AI-Engineer AI-Manager AI-QA
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: leeworks-agents/api-company#61
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?