PMM-14839: Add External Secrets Operator support for OAuth credentials

[kapendra007]

Summary

This PR adds support for External Secrets Operator (ESO) integration to fetch OAuth credentials from external secret management systems for Grafana authentication in the PMM Helm chart.

Jira Issue

https://perconadev.atlassian.net/browse/PMM-14839

Motivation

• Organizations using secret management systems (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager) need a secure way to inject OAuth credentials without storing them in values files
• Current PMM chart only supports standard Kubernetes Secrets
• External Secrets Operator is widely adopted in enterprise Kubernetes environments for secret management

Changes Made

1. Generic External Secrets Configuration (values.yaml)

• Added externalSecrets section with OAuth support
• Provider-agnostic design (works with any OAuth provider: Okta, Google, Azure AD, GitHub, GitLab, etc.)
• Backend-agnostic design (works with any secret backend: Vault, AWS, Azure, GCP, etc.)
• Configurable refresh interval, secret store reference, and data mappings

2. ExternalSecret Template (templates/external-secret-oauth.yaml)

• Creates ExternalSecret custom resource when enabled
• Maps remote secrets to Kubernetes secret keys
• Supports custom annotations and labels
• Includes validation for required fields

3. StatefulSet Integration (templates/statefulset.yaml)

• Injects OAuth credentials from ExternalSecret as environment variables
• Conditionally enabled only when externalSecrets.oauth.enabled is true
• Uses secret references for GF_AUTH_GENERIC_OAUTH_CLIENT_ID and GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET

4. Documentation (README.md)

• Added "External Secrets Integration" section to parameters table
• Included comprehensive usage examples for:
  • HashiCorp Vault with Okta
  • AWS Secrets Manager
  • Azure Key Vault
• Documented all new configuration parameters

5. Chart Version Bump (Chart.yaml)

• Bumped version from 1.5.1 to 1.5.2

Backward Compatibility

✅ Fully backward compatible - existing deployments are not affected:

• externalSecrets.enabled defaults to false
• Standard Kubernetes secret creation (secret.create: true) continues to work as before
• No breaking changes to existing configuration

Testing

• ✅ helm lint passes successfully
• ✅ helm template renders correctly with externalSecrets.enabled=true
• ✅ helm template renders correctly with externalSecrets.enabled=false (default)
• ✅ ExternalSecret resource created only when explicitly enabled
• ✅ OAuth environment variables injected correctly in StatefulSet

Usage Example

externalSecrets:
  enabled: true
  oauth:
    enabled: true
    secretStoreRef:
      name: vault-backend
      kind: SecretStore
    data:
      - secretKey: "GF_AUTH_GENERIC_OAUTH_CLIENT_ID"
        remoteRef:
          key: "secret/data/prod/pmm/oauth"
          property: "client_id"
      - secretKey: "GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET"
        remoteRef:
          key: "secret/data/prod/pmm/oauth"
          property: "client_secret"

pmmEnv:
  GF_AUTH_GENERIC_OAUTH_ENABLED: 'true'
  GF_AUTH_GENERIC_OAUTH_AUTH_URL: 'https://oauth-provider.com/authorize'
  GF_AUTH_GENERIC_OAUTH_TOKEN_URL: 'https://oauth-provider.com/token'
  GF_AUTH_GENERIC_OAUTH_API_URL: 'https://oauth-provider.com/userinfo'
Benefits
 Secure credential management - No sensitive data in values files or source control
 Automatic rotation - Secrets sync automatically based on refresh interval
 Universal compatibility - Works with any OAuth provider and secret backend Zero breaking changes - Existing deployments continue working without modification
 Well documented - Comprehensive examples for multiple providers
Checklist
 Code follows Percona Helm chart conventions
 Chart version bumped appropriately
 README updated with new parameters
 Usage examples provided
 Backward compatibility maintained
 Helm lint passes
 Templates render correctly
 Jira issue referenced in commit message
Related Links
External Secrets Operator: https://external-secrets.io/
PMM Documentation: https://docs.percona.com/percona-monitoring-and-management/

[it-percona-cla]

All committers have signed the CLA.