feat(external-secrets): add new integration for External Secrets Operator

[willianccs]

What does this PR do?

Adds a new community integration for the External Secrets Operator (ESO), which synchronizes secrets from external providers (e.g. HashiCorp Vault, AWS Secrets Manager) into Kubernetes Secrets. This integration collects 22 Prometheus metrics from the ESO controller via the OpenMetrics endpoint, providing visibility into:

• Secret health: Status conditions and reconcile durations for ExternalSecrets, ClusterExternalSecrets, PushSecrets, SecretStores, and ClusterSecretStores
• Provider API activity: Counts of API calls to upstream providers and sync errors
• Controller runtime metrics: Reconciliation counts, errors, worker activity, and concurrent reconciliation limits
• Workqueue metrics: Queue depth to detect backpressure

Includes 4 recommended monitors and an out-of-the-box dashboard.

Motivation

The External Secrets Operator is a widely-used Kubernetes operator (3K+ GitHub stars) that is critical infrastructure for managing secrets across cloud-native environments. Until now, Datadog users lacked a native integration to monitor ESO's health and performance. This integration fills that gap, enabling teams to:

• Detect when secrets fail to sync from external providers
• Alert on provider API errors and workqueue backpressure
• Monitor controller performance and resource utilization
• Verify reconciliation health across all managed secret types

Review checklist

• PR has a meaningful title or PR has the no-changelog label attached
• Feature or bugfix has tests
• Git history is clean
• If PR impacts documentation, docs team has been notified or an issue has been opened on the documentation repo
• If this PR includes a log pipeline, please add a description describing the remappers and processors.

Additional Notes

• Integration follows the OpenMetrics pattern for Prometheus metrics collection
• Includes 22 metrics covering secrets, providers, controllers, and workqueues
• Bundles 4 recommended monitors: External Secret not ready, Secret Sync Errors, Provider API Errors, and Workqueue Depth High
• Includes an External Secrets Overview dashboard
• Unit, integration, and E2E tests are included

[willianccs]

@hestonhoffman could you help here? Is it necessary any change from me?

[hestonhoffman]

@hestonhoffman could you help here? Is it necessary any change from me?

@willianccs Hi! Someone from the Agent team should be along soon to give you a review!

[steveny91]

@willianccs I'll take a look soon. Would you mind addressing the monitors validation failures if you can see them?

[willianccs]

I can't see the failures, but I can try to fix if you want and share the details.

[steveny91]

@willianccs No problem. It seems like the monitor definition is not what we expect. I think it's from an exported monitor from the web app? Example:

https://github.com/DataDog/integrations-core/blob/master/dcgm/assets/monitors/gpu_temperature.json#L3

I can regenerate the json and push them directly into your fork/branch, is that okay? I'll do it once I finish reviewing the PR.

[willianccs]

Ok, thank you @steveny91 !

[steveny91]

@willianccs I've pushed the monitor fixes and that should fix the validate-asset failure. I also merged in another change that is related to the CI failure that we're seeing now. Can you update your branch with the changes from this PR:
#3080

Then finally run ddev validate ci --sync just incase and push up any changes?

The PR looks fine and I can approve afterwards.

[willianccs]

@steveny91 Done! Updated the branch with the changes from #3080, ran ddev validate ci --sync (passed), and pushed the CI config update. Should be ready for your review now

[steveny91]

@willianccs The code looks fine. I'll ping the docs team to review the readme and we can get this merged.

[evazorro]

Thanks for making those changes!