Create a ClusterSecretStore for RHEL

argo-cd-apps/base/cluster-secret-store-rh/cluster-secret-store-rh.yaml

@@ -20,6 +20,8 @@ spec:
               elements:
                 - nameNormalized: stone-prd-rh01
                   values.clusterDir: stone-prd-rh01
+                - nameNormalized: kflux-rhel-p01
+                  values.clusterDir: kflux-rhel-p01
   template:
     metadata:
       name: cluster-secret-store-rh-{{nameNormalized}}

components/cluster-secret-store-rh/production/kflux-rhel-p01/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - trusted-ca-configmap.yaml
+  - rhel-secret-store.yaml
+  - rhel-appsre-vault-approle.yaml
+commonAnnotations:
+  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true

components/cluster-secret-store-rh/production/kflux-rhel-p01/rhel-appsre-vault-approle.yaml

@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: rhel-appsre-vault-approle
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  dataFrom:
+    - extract:
+        key: production/infrastructure/cluster-secret-store/rhel-appsre-vault-approle
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: appsre-stonesoup-vault
+  target:
+    creationPolicy: Owner
+    deletionPolicy: Delete
+    name: rhel-appsre-vault-approle

components/cluster-secret-store-rh/production/kflux-rhel-p01/rhel-secret-store.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: rhel-appsre-vault
+spec:
+  provider:
+    vault:
+      # This store is only deployed to internal cluster, so we use the internal vault server instead of the external one
+      server: "https://vault.corp.redhat.com:8200/"
+      path: apps
+      version: v2
+      # Reference to the Red Hat internal CA certificates
+      caProvider:
+        type: ConfigMap
+        name: trusted-ca
+        namespace: appsre-vault
+        key: ca-bundle.crt
+      auth:
+        appRole:
+          path: approle
+          roleId: osci
+          secretRef:
+            name: rhel-appsre-vault-approle
+            key: secret-id
+            namespace: appsre-vault

components/cluster-secret-store-rh/production/kflux-rhel-p01/trusted-ca-configmap.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: trusted-ca
+  namespace: appsre-vault
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+  labels:
+    config.openshift.io/inject-trusted-cabundle: "true"

components/cluster-secret-store/base/appsre-stonesoup-vault-secret-store.yaml

@@ -27,6 +27,7 @@ spec:
             namespace: appsre-vault
   conditions:
     - namespaces:
+        - appsre-vault
         - dora-metrics
         - dynatrace
         - application-service