Skip to content

Commit b63f6da

Browse files
aravipraaravipra
committed
OSDOCS-14603-3: ESO assembly and modules
1 parent b933d0f commit b63f6da

20 files changed

+847
-2
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1255,6 +1255,14 @@ Topics:
12551255
Topics:
12561256
- Name: External Secrets Operator overview
12571257
File: index
1258+
- Name: External Secrets Operator release notes
1259+
File: external-secrets-operator-release-notes
1260+
- Name: Installing the External Secrets Operator
1261+
File: external-secrets-operator-install
1262+
- Name: Monitoring the External Secrets Operator
1263+
File: external-secrets-operator-monitoring
1264+
- Name: Uninstalling the External Secrets Operator
1265+
File: external-secrets-operator-uninstall
12581266
- Name: Viewing audit logs
12591267
File: audit-log-view
12601268
- Name: Configuring the audit log policy

‎modules/external-secrets-about.adoc

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/index.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="external-secrets-about_{context}"]
7+
= About the {external-secrets-operator}
8+
9+
Use the {external-secrets-operator} to integrate link:https://external-secrets.io/latest/[external-secrets] application with the {product-title} cluster. The `external-secrets` application fetches secrets stored in the external providers such as link:https://aws.amazon.com/secrets-manager/[AWS Secrets Manager], link:https://developer.hashicorp.com/vault[HashiCorp Vault], link:https://cloud.google.com/security/products/secret-manager[Google Secret Manager], link:https://azure.microsoft.com/en-us/products/key-vault/[Azure Key Vault], link:https://www.ibm.com/products/secrets-manager[{ibm-cloud-title} Secrets Manager], link:https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html[AWS Systems Manager Parameter Store] and integrates them with Kubernetes in a secure manner.
10+
11+
Using the {external-secrets-operator-short} ensures the following:
12+
13+
* Decouples applications from the secret-lifecycle management.
14+
* Centralizes secret storage to support compliance requirements.
15+
* Enables secure and automated secret rotation.
16+
* Supports multi-cloud secret sourcing with fine-grained access control.
17+
* Centralizes and audits access control.
18+
19+
[IMPORTANT]
20+
====
21+
Do not attempt to use more than one {external-secrets-operator-short} in your cluster. If you have a community {external-secrets-operator-short} installed in your cluster, you must uninstall it before installing the {external-secrets-operator}.
22+
====
23+
24+
For more information about `external-secrets` application, see link:https://external-secrets.io/latest/[external-secrets].
25+
26+
Use the {external-secrets-operator-short} to authenticate with the external secrets store, retrieve secrets, and inject the retrieved secrets into a native Kubernetes secret. This method removes the need for applications to directly access or manage external secrets.
27+

‎modules/external-secrets-enable-metrics-operand.adoc

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/external-secrets-operator-monitoring.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="external-secrets-enable-metrics-operand_{context}"]
7+
= Enabling monitoring for the External Secrets operand for Red Hat OpenShift by using a service monitor
8+
9+
Enable monitoring and metrics collection for the External Secrets operand by using a service monitor to perform the custom metrics scraping.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster with `cluster-admin` privileges.
14+
* The External Secrets operand is installed.
15+
16+
.Procedure
17+
18+
. Enable cluster monitoring by labeling the External Secrets operand namespace by running the following command:
19+
+
20+
[source,terminal]
21+
----
22+
$ oc label namespace external-secrets openshift.io/cluster-monitoring=true
23+
----
24+
25+
. Create a YAML file that defines the `Role`, `RoleBinding`, and `ServiceMonitor` objects:
26+
+
27+
.Example `monitoring.yaml` file
28+
[source,yaml]
29+
----
30+
apiVersion: rbac.authorization.k8s.io/v1
31+
kind: Role
32+
metadata:
33+
name: prometheus-k8s
34+
namespace: external-secrets
35+
rules:
36+
- apiGroups:
37+
- ""
38+
resources:
39+
- services
40+
- endpoints
41+
- pods
42+
verbs:
43+
- get
44+
- list
45+
- watch
46+
---
47+
apiVersion: rbac.authorization.k8s.io/v1
48+
kind: RoleBinding
49+
metadata:
50+
name: prometheus-k8s
51+
namespace: external-secrets
52+
roleRef:
53+
apiGroup: rbac.authorization.k8s.io
54+
kind: Role
55+
name: prometheus-k8s
56+
subjects:
57+
- kind: ServiceAccount
58+
name: prometheus-k8s
59+
namespace: external-secrets
60+
---
61+
apiVersion: monitoring.coreos.com/v1
62+
kind: ServiceMonitor
63+
metadata:
64+
labels:
65+
app: external-secrets
66+
app.kubernetes.io/component: controller
67+
app.kubernetes.io/instance: external-secrets
68+
app.kubernetes.io/name: external-secrets
69+
name: external-secrets
70+
namespace: external-secrets
71+
spec:
72+
endpoints:
73+
- interval: 30s
74+
port: tcp-prometheus-servicemonitor
75+
scheme: http
76+
selector:
77+
matchLabels:
78+
app.kubernetes.io/component: controller
79+
app.kubernetes.io/instance: external-secrets
80+
app.kubernetes.io/name: external-secrets
81+
----
82+
83+
. Create the `Role`, `RoleBinding`, and `ServiceMonitor` objects by running the following command:
84+
+
85+
[source,terminal]
86+
----
87+
$ oc create -f monitoring.yaml
88+
----

‎modules/external-secrets-enable-metrics.adoc

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/external-secrets-operator-monitoring.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="external-secrets-enable-metrics_{context}"]
7+
= Enabling monitoring for the {external-secrets-operator} by using a service monitor
8+
9+
Enable monitoring and metrics collection for the {external-secrets-operator} by using a service monitor to perform the custom metrics scraping.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster with `cluster-admin` privileges.
14+
* The {external-secrets-operator-short} is installed.
15+
16+
.Procedure
17+
18+
. Enable cluster monitoring by labeling the {external-secrets-operator-short} namespace by running the following command:
19+
+
20+
[source,terminal]
21+
----
22+
$ oc label namespace external-secrets-operator openshift.io/cluster-monitoring=true
23+
----
24+
25+
. Create a YAML file that defines the `Role`, `RoleBinding`, and `ServiceMonitor` objects:
26+
+
27+
.Example `monitoring.yaml` file
28+
[source,yaml]
29+
----
30+
apiVersion: rbac.authorization.k8s.io/v1
31+
kind: Role
32+
metadata:
33+
name: prometheus-k8s
34+
namespace: external-secrets-operator
35+
rules:
36+
- apiGroups:
37+
- ""
38+
resources:
39+
- services
40+
- endpoints
41+
- pods
42+
verbs:
43+
- get
44+
- list
45+
- watch
46+
---
47+
apiVersion: rbac.authorization.k8s.io/v1
48+
kind: RoleBinding
49+
metadata:
50+
name: prometheus-k8s
51+
namespace: external-secrets-operator
52+
roleRef:
53+
apiGroup: rbac.authorization.k8s.io
54+
kind: Role
55+
name: prometheus-k8s
56+
subjects:
57+
- kind: ServiceAccount
58+
name: prometheus-k8s
59+
namespace: external-secrets-operator
60+
---
61+
apiVersion: monitoring.coreos.com/v1
62+
kind: ServiceMonitor
63+
metadata:
64+
labels:
65+
app: external-secrets
66+
app.kubernetes.io/component: controller
67+
app.kubernetes.io/instance: external-secrets
68+
app.kubernetes.io/name: external-secrets
69+
name: external-secrets
70+
namespace: external-secrets-operator
71+
spec:
72+
endpoints:
73+
- interval: 30s
74+
port: tcp-prometheus-servicemonitor
75+
scheme: http
76+
selector:
77+
matchLabels:
78+
app.kubernetes.io/component: controller
79+
app.kubernetes.io/instance: external-secrets
80+
app.kubernetes.io/name: external-secrets
81+
----
82+
83+
. Create the `Role`, `RoleBinding`, and `ServiceMonitor` objects by running the following command:
84+
+
85+
[source,terminal]
86+
----
87+
$ oc create -f monitoring.yaml
88+
----
89+

‎modules/external-secrets-fips-support.adoc

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/index.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="external-secrets-fips-support_{context}"]
7+
= About FIPS compliance for {external-secrets-operator}
8+
9+
The {external-secrets-operator} supports FIPS compliance. When running on {product-title} in FIPS mode, {external-secrets-operator-short} uses the RHEL cryptographic libraries submitted to NIST for FIPS validation on the x86_64, ppc64le, and s390X architectures. For more information about the NIST validation program, see link:https://csrc.nist.gov/Projects/cryptographic-module-validation-program/validated-modules[Cryptographic module validation program]. For more information about the latest NIST status for the individual versions of the RHEL cryptographic libraries submitted for validation, see link:https://access.redhat.com/articles/2918071#fips-140-2-and-fips-140-3-2[Compliance activities and government standards].
10+
11+
To enable FIPS mode, install the {external-secrets-operator-short} on an {product-title} cluster that runs in FIPS mode. For more information, see "Do you need extra security for your cluster?".

‎modules/external-secrets-operand-install-cli.adoc

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/external-secrets-operator-install.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="external-secrets-operand-install-cli_{context}"]
7+
= Installing the External Secrets operand for Red Hat OpenShift by using the CLI
8+
9+
You can use the command-line interface (CLI) to install the External Secrets operand.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster with `cluster-admin` privileges.
14+
15+
.Procedure
16+
17+
. Create a `externalsecrets.openshift.operator.io` object by defining a YAML file with the following content:
18+
+
19+
.Example `externalsecrets.yaml` file
20+
[source,yaml]
21+
----
22+
apiVersion: operator.openshift.io/v1alpha1
23+
kind: ExternalSecrets
24+
metadata:
25+
labels:
26+
app.kubernetes.io/name: external-secrets-operator
27+
name: cluster
28+
spec: {}
29+
----
30+
+
31+
For more information on spec configuration, see "External Secrets Operator for Red Hat OpenShift APIs".
32+
33+
. Create the `externalsecrets.openshift.operator.io` object by running the following command:
34+
+
35+
[source,terminal]
36+
----
37+
$ oc create -f externalsecrets.yaml
38+
----
39+
40+
.Verification
41+
42+
. Verify that the `external-secrets` pods are running by entering the following command:
43+
+
44+
[source,terminal]
45+
----
46+
$ oc get pods -n external-secrets
47+
----
48+
+
49+
.Example output
50+
[source,terminal]
51+
----
52+
NAME READY STATUS RESTARTS AGE
53+
external-secrets-75d47cb9c8-6p4n2 1/1 Running 0 4h5m
54+
external-secrets-cert-controller-676444b897-qb6ft 1/1 Running 0 4h5m
55+
external-secrets-webhook-b566658ff-7m4d5 1/1 Running 0 4h5m
56+
----
57+
58+
. Verify that the `external-secrets-operator` deployment object reports a successful status by running the following command:
59+
+
60+
[source,terminal]
61+
----
62+
$ oc get externalsecrets.operator.openshift.io cluster -n external-secrets-operator -o jsonpath='{.status.conditions}' | jq .
63+
----
64+
+
65+
.Example output
66+
[source,terminal]
67+
----
68+
[
69+
{
70+
"lastTransitionTime": "2025-06-17T14:57:04Z",
71+
"message": "",
72+
"observedGeneration": 1,
73+
"reason": "Ready",
74+
"status": "False",
75+
"type": "Degraded"
76+
},
77+
{
78+
"lastTransitionTime": "2025-06-17T14:57:04Z",
79+
"message": "reconciliation successful",
80+
"observedGeneration": 1,
81+
"reason": "Ready",
82+
"status": "True",
83+
"type": "Ready"
84+
}
85+
]
86+
----

0 commit comments

Comments
 (0)