Spike: Check if external-secrets operator would make a nice PlatformService

[n3rdc4ptn]

Understand the Task

ToDo: needs to be changed regarding title! @n3rdc4ptn

Description
We want to add generic configurable external-secrets operator setup so platform owners can use it to connect their secret store.

We should also have a predefined configuration for vault / openbao and documentation for the platform owners how to set it up.

Any further valuable resources.

No response

What is required to accept the Task as done.

Done Criteria

• have the necessary resources for external-secrets operator deployment'
• create a generic secretstore implementation for vault / openbao configurable through kustomization
• add documentation around how to set it up on the vault side (maybe include a bash script for setup)
• Code has been reviewed by other team members
• Internal technical Documentation created/updated
• New / changed code is documented
• Unit Tests created for new code or existing Unit Tests updated
• Integration Test Suite updated
• Enduser Documentation updated (if applicable)
• Successful demonstration in Review

[maximilianbraun]

I’m wondering why it needs to be a platform service. Isn’t it just something which is deployed alongside and the contract is the secret?

[In-Ko]

removed the parent issue, as this task can be handled separately.

[n3rdc4ptn]

I’m wondering why it needs to be a platform service. Isn’t it just something which is deployed alongside and the contract is the secret?

My idea was to make it easier to handle. Like having a Resource SyncSecret which can sync secrets between cluster. This would also be great for our own Operators to integrate in to sync secrets into MCPs etc.

Also making it easier with a simpler Resource for consuming Vault / openBAO.

Maybe integrating a ServiceProvider into as well, which then would provide ESO to MCP Users.