External Secrets Operator Onboarding

[BogdanAntoniu78]

Onboarding external secrets operator

Summary

Test Plan

Checklist

• No images hosted from dockerhub
• Are dashboards present to understand the health of the application. There must be at least 1 of these
  • all databases should have dashboards
  • ideally also have at least cpu/mem utilization dashboards for webserver tier of the app
  • you can use plural from-grafana to convert a grafana dashboard found via google to our CRD
• Are scaling runbooks present
  • all databases must have scaling runbooks
  • you can use the charts in pluralsh/module-library to accelerate this
• do you need to add config overlays?
  • inputing secrets
  • configuring autoscaling
• If there’s a web-facing component to the app, we need to support OIDC authentication and setting up private networks if no authentication option is viable
• All major clouds must be supported
  • Azure
  • AWS
  • GCP

[BogdanAntoniu78]

Prerequisites:

• Policy to access AWS Secret Manager (included in terraform main.tf)
• Role to be assumed via IRSA, with trust relationship with EKS OIDC provider and permission based on the policy created above
• output.tf should contain account_id and the service account name included in OIDC qualified subjects
• k8 values.yaml.tpl should include ServiceAccount variable with the correct annotation including the account id and the role to be assumed (defined above)