Create a ClusterSecretStore for RHEL

RHEL needs to extract secrets from same vault in more than one
namespace. Create a cluster level store for them since user can only
create namespace stores. This is similar to what we did for Insights.

Since this store is on internal cluster, configure to extract directly
from internal vault. To do so, inject the trusted-ca into the
appsre-vault namespace and get the approle secret from our own vault.

KFLUXINFRA-2706

Signed-off-by: Hugo Ares <[email protected]>

Author: hugares

argo-cd-apps/base/cluster-secret-store-rh/cluster-secret-store-rh.yaml

@@ -20,6 +20,8 @@ spec:
               elements:
                 - nameNormalized: stone-prd-rh01
                   values.clusterDir: stone-prd-rh01
+                - nameNormalized: kflux-rhel-p01
+                  values.clusterDir: kflux-rhel-p01
   template:
     metadata:
       name: cluster-secret-store-rh-{{nameNormalized}}

components/cluster-secret-store-rh/production/kflux-rhel-p01/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - trusted-ca-configmap.yaml
+  - rhel-secret-store.yaml
+  - rhel-appsre-vault-approle.yaml
+commonAnnotations:
+  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true

components/cluster-secret-store-rh/production/kflux-rhel-p01/rhel-appsre-vault-approle.yaml

@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: rhel-appsre-vault-approle
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  dataFrom:
+    - extract:
+        key: production/infrastructure/cluster-secret-store/rhel-appsre-vault-approle
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: appsre-stonesoup-vault
+  target:
+    creationPolicy: Owner
+    deletionPolicy: Delete
+    name: rhel-appsre-vault-approle

components/cluster-secret-store-rh/production/kflux-rhel-p01/rhel-secret-store.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: rhel-appsre-vault
+spec:
+  provider:
+    vault:
+      # This store is only deployed to internal cluster, so we use the internal vault server instead of the external one
+      server: "https://vault.corp.redhat.com:8200/"
+      path: apps
+      version: v2
+      # Reference to the Red Hat internal CA certificates
+      caProvider:
+        type: ConfigMap
+        name: trusted-ca
+        namespace: appsre-vault
+        key: ca-bundle.crt
+      auth:
+        appRole:
+          path: approle
+          roleId: osci
+          secretRef:
+            name: rhel-appsre-vault-approle
+            key: secret-id
+            namespace: appsre-vault

components/cluster-secret-store-rh/production/kflux-rhel-p01/trusted-ca-configmap.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: trusted-ca
+  namespace: appsre-vault
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+  labels:
+    config.openshift.io/inject-trusted-cabundle: "true"

components/cluster-secret-store/base/appsre-stonesoup-vault-secret-store.yaml

@@ -27,6 +27,7 @@ spec:
             namespace: appsre-vault
   conditions:
     - namespaces:
+        - appsre-vault
         - dora-metrics
         - dynatrace
         - application-service