Skip to content

Commit 3c7bce9

Browse files
aravipraaravipra
committed
OSDOCS-14603: assembly and module creation for ESO docs
1 parent 0650fda commit 3c7bce9

17 files changed

+650
-6
lines changed

‎_attributes/common-attributes.adoc‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,8 @@ endif::[]
6060
:rh-rhacm-version: 2.13
6161
:osc: OpenShift sandboxed containers
6262
:cert-manager-operator: cert-manager Operator for Red Hat OpenShift
63-
:external-secrets-operator: external secrets Operator for Red Hat OpenShift
63+
:external-secrets-operator: External Secrets Operator for Red Hat OpenShift
64+
:external-secrets-operator-short: External Secrets Operator
6465
:secondary-scheduler-operator-full: Secondary Scheduler Operator for Red Hat OpenShift
6566
:secondary-scheduler-operator: Secondary Scheduler Operator
6667
:descheduler-operator: Kube Descheduler Operator

‎_topic_maps/_topic_map.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1231,12 +1231,20 @@ Topics:
12311231
File: cert-manager-log-levels
12321232
- Name: Uninstalling the cert-manager Operator for Red Hat OpenShift
12331233
File: cert-manager-operator-uninstall
1234-
- Name: External secrets Operator for Red Hat OpenShift
1234+
- Name: External Secrets Operator for Red Hat OpenShift
12351235
Dir: external_secrets_operator
12361236
Distros: openshift-enterprise
12371237
Topics:
1238-
- Name: External secrets Operator for Red Hat OpenShift overview
1238+
- Name: External Secrets Operator overview
12391239
File: index
1240+
- Name: External Secrets Operator release notes
1241+
File: external-secrets-operator-release-notes
1242+
- Name: Installing the External Secrets Operator
1243+
File: external-secrets-operator-install
1244+
- Name: Monitoring the External Secrets Operator
1245+
File: external-secrets-operator-monitoring
1246+
- Name: Uninstalling the External Secrets Operator
1247+
File: external-secrets-operator-uninstall
12401248
- Name: Viewing audit logs
12411249
File: audit-log-view
12421250
- Name: Configuring the audit log policy

‎modules/external-secrets-about.adoc‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/index.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="external-secrets-about_{context}"]
7+
= About the {external-secrets-operator}
8+
9+
Use the {external-secrets-operator} to integrate link:https://external-secrets.io/latest/[external-secrets] application with the {product-title} cluster. The `external-secrets` application fetches secrets stored in the external providers such as link:https://aws.amazon.com/secrets-manager/[AWS Secrets Manager], link:https://developer.hashicorp.com/vault[HashiCorp Vault], link:https://cloud.google.com/security/products/secret-manager[Google Secrets Manager], link:https://azure.microsoft.com/en-us/products/key-vault/[Azure Key Vault], link:https://www.ibm.com/products/secrets-manager[{ibm-cloud-title} Secrets Manager], link:https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html[AWS Systems Manager Parameter Store] and integrates them with Kubernetes in a secure manner.
10+
11+
Using the {external-secrets-operator-short} ensures the following:
12+
13+
* Decouples applications from the secret-lifecycle management.
14+
* Centralizes secret storage to support compliance requirements.
15+
* Enables secure and automated secret rotation.
16+
* Supports multi-cloud secret sourcing with fine-grained access control.
17+
* Centralizes and audits access control.
18+
19+
[IMPORTANT]
20+
====
21+
Do not attempt to use more than one {external-secrets-operator-short} in your cluster. If you have a community {external-secrets-operator-short} installed in your cluster, you must uninstall it before installing the {external-secrets-operator}.
22+
====
23+
24+
For more information about `external-secrets` application, see link:https://external-secrets.io/latest/[external-secrets].
25+
26+
Use the {external-secrets-operator-short} to authenticate with the external secrets store, retrieve secrets, and inject the retrieved secrets into a native Kubernetes secret. This method removes the need for applications to directly access or manage external secrets.

‎modules/external-secrets-enable-metrics.adoc‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/external-secrets-operator-monitoring.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="external-secrets-enable-metrics_{context}"]
7+
= Enabling monitoring for the {external-secrets-operator} by using a service monitor
8+
9+
Enable monitoring and metrics collection for the {external-secrets-operator} by using a service monitor to perform the custom metrics scraping.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster with `cluster-admin` privileges.
14+
* The {external-secrets-operator-short} is installed.
15+
16+
.Procedure
17+
18+
. Enable cluster monitoring by labeling the {external-secrets-operator-short} namespace by running the following command:
19+
+
20+
[source,terminal]
21+
----
22+
$ oc label namespace external-secrets-operator openshift.io/cluster-monitoring=true
23+
----
24+
25+
. Create a YAML file that defines the `Role`, `RoleBinding`, and `ServiceMonitor` objects:
26+
+
27+
.Example `monitoring.yaml` file
28+
[source,yaml]
29+
----
30+
---
31+
apiVersion: v1
32+
kind: ServiceAccount
33+
metadata:
34+
name: prometheus-k8s
35+
namespace: external-secrets-operator
36+
---
37+
apiVersion: rbac.authorization.k8s.io/v1
38+
kind: Role
39+
metadata:
40+
name: prometheus-k8s
41+
namespace: external-secrets-operator
42+
rules:
43+
- apiGroups:
44+
- ""
45+
resources:
46+
- services
47+
- endpoints
48+
- pods
49+
verbs:
50+
- get
51+
- list
52+
- watch
53+
---
54+
apiVersion: rbac.authorization.k8s.io/v1
55+
kind: RoleBinding
56+
metadata:
57+
name: prometheus-k8s
58+
namespace: external-secrets-operator
59+
roleRef:
60+
apiGroup: rbac.authorization.k8s.io
61+
kind: Role
62+
name: prometheus-k8s
63+
subjects:
64+
- kind: ServiceAccount
65+
name: prometheus-k8s
66+
namespace: external-secrets-operator
67+
---
68+
apiVersion: monitoring.coreos.com/v1
69+
kind: ServiceMonitor
70+
metadata:
71+
labels:
72+
app: external-secrets
73+
app.kubernetes.io/component: controller
74+
app.kubernetes.io/instance: external-secrets
75+
app.kubernetes.io/name: external-secrets
76+
name: external-secrets
77+
namespace: external-secrets-operator
78+
spec:
79+
endpoints:
80+
- interval: 30s
81+
port: tcp-prometheus-servicemonitor
82+
scheme: http
83+
selector:
84+
matchLabels:
85+
app.kubernetes.io/component: controller
86+
app.kubernetes.io/instance: external-secrets
87+
app.kubernetes.io/name: external-secrets
88+
----
89+
90+
. Create the `Role`, `RoleBinding`, and `ServiceMonitor` objects by running the following command:
91+
+
92+
[source,terminal]
93+
----
94+
$ oc create -f monitoring.yaml
95+
----

‎modules/external-secrets-fips-support.adoc‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/index.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="external-secrets-fips-support_{context}"]
7+
= About FIPS compliance for {external-secrets-operator}
8+
9+
The {external-secrets-operator} supports FIPS compliance. When running on {product-title} in FIPS mode, {external-secrets-operator-short} uses the RHEL cryptographic libraries submitted to NIST for FIPS validation on the x86_64, ppc64le, and s390X architectures. For more information about the NIST validation program, see link:https://csrc.nist.gov/Projects/cryptographic-module-validation-program/validated-modules[Cryptographic module validation program]. For more information about the latest NIST status for the individual versions of the RHEL cryptographic libraries submitted for validation, see link:https://access.redhat.com/articles/2918071#fips-140-2-and-fips-140-3-2[Compliance activities and government standards].
10+
11+
To enable FIPS mode, install the {external-secrets-operator-short} on an {product-title} cluster that runs in FIPS mode. For more information, see "Do you need extra security for your cluster?".

‎modules/external-secrets-operator-install-cli.adoc‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/external-secrets-operator-install.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="external-secrets-operator-install-cli_{context}"]
7+
= Installing the {external-secrets-operator} by using the CLI
8+
9+
You can use the command-line interface (CLI) to install the {external-secrets-operator}.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster with `cluster-admin` privileges.
14+
15+
.Procedure
16+
17+
. Create a new project named `external-secrets-operator` by running the following command:
18+
+
19+
[source,terminal]
20+
----
21+
$ oc new-project external-secrets-operator
22+
----
23+
24+
. Create an `OperatorGroup` object by defining a YAML file with the following content:
25+
+
26+
.Example `operatorGroup.yaml` file
27+
[source,yaml]
28+
----
29+
apiVersion: operators.coreos.com/v1
30+
kind: OperatorGroup
31+
metadata:
32+
name: openshift-external-secrets-operator
33+
namespace: external-secrets-operator
34+
spec:
35+
targetNamespaces: []
36+
- "external-secrets-operator"
37+
spec:{}
38+
----
39+
40+
. Create the `OperatorGroup` object by running the following command:
41+
+
42+
[source,terminal]
43+
----
44+
$ oc create -f operatorGroup.yaml
45+
----
46+
47+
. Create a `Subscription` object by defining a YAML file with the following content:
48+
+
49+
.Example `subscription.yaml` file
50+
[source,yaml]
51+
----
52+
apiVersion: operators.coreos.com/v1alpha1
53+
kind: Subscription
54+
metadata:
55+
name: openshift-external-secrets-operator
56+
namespace: external-secrets-operator
57+
spec:
58+
channel: stable-v1
59+
name: openshift-external-secrets-operator
60+
source: redhat-operators
61+
sourceNamespace: openshift-marketplace
62+
installPlanApproval: Automatic
63+
----
64+
65+
. Create the `Subscription` object by running the following command:
66+
+
67+
[source,terminal]
68+
----
69+
$ oc create -f subscription.yaml
70+
----
71+
72+
.Verification
73+
74+
. Verify that the {olm} subscription is created by running the following command:
75+
+
76+
[source,terminal]
77+
----
78+
$ oc get subscription -n external-secrets-operator
79+
----
80+
+
81+
.Example output
82+
[source,terminal]
83+
----
84+
//content to be added
85+
----
86+
87+
. Verify whether the Operator is successfully installed by running the following command:
88+
+
89+
[source,terminal]
90+
----
91+
$ oc get csv -n external-secrets-operator
92+
----
93+
+
94+
.Example output
95+
[source,terminal]
96+
----
97+
//content to be added
98+
----
99+
100+
. Verify that the status of the {external-secrets-operator-short} is `Running` by running the following command:
101+
+
102+
[source,terminal]
103+
----
104+
$ oc get pods -n external-secrets-operator
105+
----
106+
+
107+
.Example output
108+
[source,terminal]
109+
----
110+
// content to be added
111+
----
112+
113+
. Verify that the status of the `external-secrets` pods is `Running` by running the following command:
114+
+
115+
[source,terminal]
116+
----
117+
$ oc get pods -n external-secrets
118+
----
119+
+
120+
.Example output
121+
[source,terminal]
122+
----
123+
// content to be added
124+
----

‎modules/external-secrets-operator-install-console.adoc‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/external-secrets-operator-install.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="external-secrets-operator-install-console_{context}"]
7+
= Installing the {external-secrets-operator} by using the web console
8+
9+
You can use the web console to install the {external-secrets-operator}.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster with `cluster-admin` privileges.
14+
* You have access to the {product-title} web console.
15+
16+
.Procedure
17+
18+
. Log in to the {product-title} web console.
19+
20+
. Navigate to *Operators* -> *OperatorHub*.
21+
22+
. Enter *{external-secrets-operator-short}* in the search box.
23+
24+
. Select the *{external-secrets-operator}* from the generated list and click *Install*.
25+
//+
26+
//[NOTE]
27+
//====
28+
//place holder for TechPreview release details or See supported {external-secrets-operator-short} versions in the following "Additional resources" section.
29+
//====
30+
. On the *Install Operator* page:
31+
32+
.. Update the *Update channel*, if necessary. The channel defaults to *name to be added*, which installs the latest stable release of the {external-secrets-operator-short}.
33+
34+
.. Select the version from *Version* drop-down list.
35+
36+
.. Choose the *Installed Namespace* for the Operator.
37+
+
38+
* To use the default Operator namespace, select the *Operator recommended Namespace* option.
39+
+
40+
* To use the namespace that you created, select the *Select a Namespace* option, and then select the namespace from the drop-down list.
41+
+
42+
* If the default `external-secrets-operator` namespace does not exist, it is created for you by the {olm-first}.
43+
+
44+
.. Select an *Update approval* strategy.
45+
+
46+
* The *Automatic* strategy enables {olm} to automatically update the Operator when a new version is available.
47+
+
48+
* The *Manual* strategy requires a user with appropriate credentials to approve the Operator update.
49+
50+
.. Click *Install*.
51+
52+
.Verification
53+
54+
. Navigate to *Operators* -> *Installed Operators*.
55+
56+
. Verify that *{external-secrets-operator-short}* is listed with a *Status* of *Succeeded* in the `external-secrets-operator` namespace.
57+
58+
. Verify that `external-secrets` pods are up and running by entering the following command:
59+
+
60+
[source,terminal]
61+
----
62+
$ oc get pods -n external-secrets
63+
----
64+
+
65+
.Example output
66+
[source,terminal]
67+
----
68+
//to be added
69+
----
70+
+
71+
You can use the {external-secrets-operator-short} only after the `external-secrets` pods are up and running.

‎modules/external-secrets-operator-uninstall-console.adoc‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/external_secrets_operator/external-secrets-operator-uninstall.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="external-secrets-operator-uninstall-console_{context}"]
7+
= Uninstalling the {external-secrets-operator} using the web console
8+
9+
You can uninstall the {external-secrets-operator} by using the web console.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster with `cluster-admin` privileges.
14+
* You have access to the {product-title} web console.
15+
* The {external-secrets-operator-short} is installed.
16+
17+
.Procedure
18+
19+
. Log in to the {product-title} web console.
20+
21+
. Uninstall the {external-secrets-operator} using the following steps:
22+
23+
.. Navigate to *Operators* -> *Installed Operators*.
24+
25+
.. Click the Options menu {kebab} next to the *{external-secrets-operator}* entry and click *Uninstall Operator*.
26+
27+
.. In the confirmation dialog, click *Uninstall*.

0 commit comments

Comments
 (0)