External Secrets Operator DA

.catalog-onboard-pipeline.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+offerings:
+  - name: deploy-arch-ibm-eso
+    kind: solution
+    catalog_id: 7df1e4ca-d54c-4fd0-82ce-3d13247308cd
+    offering_id: 70e68cb4-7026-4329-9faa-8a1e56444aba
+    variations:
+      - name: standard
+        mark_ready: true
+        install_type: fullstack
+        pre_validation: "tests/scripts/pre-validation-eso.sh"
+        post_validation: "tests/scripts/post-validation-eso.sh"

README.md

@@ -522,9 +522,9 @@ module "es_kubernetes_secret" {
 | <a name="input_eso_enroll_in_servicemesh"></a> [eso\_enroll\_in\_servicemesh](#input\_eso\_enroll\_in\_servicemesh) | Flag to enroll ESO into istio servicemesh | `bool` | `false` | no |
 | <a name="input_eso_image"></a> [eso\_image](#input\_eso\_image) | The External Secrets Operator image in the format of `[registry-url]/[namespace]/[image]`. | `string` | `"ghcr.io/external-secrets/external-secrets"` | no |
 | <a name="input_eso_image_version"></a> [eso\_image\_version](#input\_eso\_image\_version) | The version or digest for the external secrets image to deploy. If changing the value, ensure it is compatible with the chart version set in eso\_chart\_version. | `string` | `"v0.17.0-ubi@sha256:5c9f7750fb922fb09cfc3b430d5916923b85f17ba5099b244173344ab3046b53"` | no |
-| <a name="input_eso_namespace"></a> [eso\_namespace](#input\_eso\_namespace) | Namespace to create and be used to install ESO components including helm releases. If eso\_store\_scope == cluster, this will also be used to deploy ClusterSecretStore/cluster\_store in it | `string` | `null` | no |
+| <a name="input_eso_namespace"></a> [eso\_namespace](#input\_eso\_namespace) | Namespace to create and be used to install ESO components including helm releases. | `string` | `null` | no |
 | <a name="input_eso_pod_configuration"></a> [eso\_pod\_configuration](#input\_eso\_pod\_configuration) | Configuration to use to customise ESO deployment on specific pods. Setting appropriate values will result in customising ESO helm release. Default value is {} to keep ESO standard deployment. Ignore the key if not required. | <pre>object({<br/>    annotations = optional(object({<br/>      # The annotations for external secret controller pods.<br/>      external_secrets = optional(map(string), {})<br/>      # The annotations for external secret cert controller pods.<br/>      external_secrets_cert_controller = optional(map(string), {})<br/>      # The annotations for external secret controller pods.<br/>      external_secrets_webhook = optional(map(string), {})<br/>    }), {})<br/><br/>    labels = optional(object({<br/>      # The labels for external secret controller pods.<br/>      external_secrets = optional(map(string), {})<br/>      # The labels for external secret cert controller pods.<br/>      external_secrets_cert_controller = optional(map(string), {})<br/>      # The labels for external secret controller pods.<br/>      external_secrets_webhook = optional(map(string), {})<br/>    }), {})<br/>  })</pre> | `{}` | no |
-| <a name="input_existing_eso_namespace"></a> [existing\_eso\_namespace](#input\_existing\_eso\_namespace) | Existing Namespace to be used to install ESO components including helm releases. If eso\_store\_scope == cluster, this will also be used to deploy ClusterSecretStore/cluster\_store in it | `string` | `null` | no |
+| <a name="input_existing_eso_namespace"></a> [existing\_eso\_namespace](#input\_existing\_eso\_namespace) | Existing Namespace to be used to install ESO components including helm releases. | `string` | `null` | no |
 | <a name="input_reloader_chart_location"></a> [reloader\_chart\_location](#input\_reloader\_chart\_location) | The location of the Reloader Helm chart. | `string` | `"https://stakater.github.io/stakater-charts"` | no |
 | <a name="input_reloader_chart_version"></a> [reloader\_chart\_version](#input\_reloader\_chart\_version) | The version of the Reloader Helm chart. Ensure that the chart version is compatible with the image version specified in reloader\_image\_version. | `string` | `"2.1.3"` | no |
 | <a name="input_reloader_custom_values"></a> [reloader\_custom\_values](#input\_reloader\_custom\_values) | String containing custom values to be used for reloader helm chart. See https://github.com/stakater/Reloader/blob/master/deployments/kubernetes/chart/reloader/values.yaml | `string` | `null` | no |

ibm_catalog.json

@@ -0,0 +1,199 @@
+
+{
+    "products": [
+      {
+        "name": "deploy-arch-ibm-eso",
+        "label": "Cloud automation for External Secrets Operator",
+        "product_kind": "solution",
+        "tags": [
+          "ibm_created",
+          "target_terraform",
+          "terraform",
+          "solution",
+          "security"
+        ],
+        "keywords": [
+          "Secrets",
+          "Secrets Manager",
+          "IaC",
+          "infrastructure as code",
+          "terraform",
+          "solution"
+        ],
+        "short_description": "Deploys the External Secrets Operator (ESO) on an IBM Cloud Kubernetes Service (IKS) OpenShift cluster.",
+        "long_description": "This architecture allows to deploy the External Secrets Operator (ESO) and the related configuration on an IBM Cloud OpenShift Cluster to manage the secrets deployed on the cluster through IBM Cloud Secrets Manager.",
+        "offering_docs_url": "https://github.com/terraform-ibm-modules/terraform-ibm-external-secrets-operator/blob/main/solutions/fully-configurable/README.md",
+        "offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-external-secrets-operator/refs/heads/da_task_11723/deploy-arch-ibm-eso.svg",
+        "provider_name": "IBM",
+        "features": [
+          {
+            "title": "Deploys the External Secrets Operator (ESO)",
+            "description": "This architecture allows to deploy [External Secrets Operator](https://external-secrets.io/latest/) (also known as ESO) on an existing IBM Cloud OpenShift Cluster."
+          },
+          {
+            "title": "Configures the External Secrets Operator (ESO) Cluster Secrets Stores and Secrets Stores with the related ServiceIDs and Secrets Groups",
+            "description": "Deploy and configure [ClusterSecretStore](https://external-secrets.io/latest/api/clustersecretstore/) resources for cluster scoped secrets store and [SecretStore](https://external-secrets.io/latest/api/secretstore/) resources for namespace scoped secrets store"
+          },
+          {
+            "title": "Deploys Stakater Reloader](https://github.com/stakater/Reloader] into the cluster to refresh the secrets in the cluster pods when needed",
+            "description": "The architecture allows to deploy optionally Stakater Reloader](https://github.com/stakater/Reloader) to configure automatic pod reloading"
+          }
+        ],
+        "support_details": "This product is in the community registry, as such support is handled through the originated repo. If you experience issues please open an issue in this repository [https://github.com/terraform-ibm-modules/terraform-ibm-external-secrets-operator/issues). Please note this product is not supported via the IBM Cloud Support Center.",
+        "flavors": [
+          {
+            "label": "Fully configurable",
+            "name": "fully-configurable",
+            "install_type": "fullstack",
+            "working_directory": "solutions/fully-configurable",
+            "iam_permissions": [
+              {
+                "role_crns": [
+                  "crn:v1:bluemix:public:iam::::role:Administrator"
+                ],
+                "service_name": "iam-identity",
+                "notes": "[Optional] Required if Cloud automation for account configuration is enabled."
+              }
+            ],
+            "configuration": [
+              {
+                "key": "ibmcloud_api_key"
+              },
+              {
+                "key": "prefix",
+                "required": true
+              },
+              {
+                "key": "existing_cluster_crn",
+                "required": true
+              },
+              {
+                "key": "existing_secrets_manager_crn",
+                "required": true
+              },
+              {
+                "key": "eso_namespace"
+              },
+              {
+                "key": "existing_eso_namespace"
+              },
+              {
+                "key": "eso_cluster_nodes_configuration"
+              },
+              {
+                "key": "eso_pod_configuration"
+              },
+              {
+                "key": "eso_image"
+              },
+              {
+                "key": "eso_image_version"
+              },
+              {
+                "key": "eso_chart_location"
+              },
+              {
+                "key": "eso_chart_version"
+              },
+              {
+                "key": "eso_enroll_in_servicemesh"
+              },
+              {
+                "key": "reloader_deployed"
+              },
+              {
+                "key": "reloader_reload_strategy"
+              },
+              {
+                "key": "reloader_namespaces_to_ignore"
+              },
+              {
+                "key": "reloader_resources_to_ignore"
+              },
+              {
+                "key": "reloader_namespaces_selector"
+              },
+              {
+                "key": "reloader_resource_label_selector"
+              },
+              {
+                "key": "reloader_ignore_secrets"
+              },
+              {
+                "key": "reloader_ignore_configmaps"
+              },
+              {
+                "key": "reloader_is_openshift"
+              },
+              {
+                "key": "reloader_is_argo_rollouts"
+              },
+              {
+                "key": "reloader_reload_on_create"
+              },
+              {
+                "key": "reloader_sync_after_restart"
+              },
+              {
+                "key": "reloader_pod_monitor_metrics"
+              },
+              {
+                "key": "reloader_log_format"
+              },
+              {
+                "key": "reloader_custom_values"
+              },
+              {
+                "key": "reloader_image"
+              },
+              {
+                "key": "reloader_image_version"
+              },
+              {
+                "key": "reloader_chart_location"
+              },
+              {
+                "key": "reloader_chart_version"
+              },
+              {
+                "key": "eso_secretsstores_configuration"
+              },
+              {
+                "key": "service_endpoints"
+              }
+            ],
+            "architecture": {
+              "description": "This architecture supports deploying External Secrets Operator on IBM Cloud OpenShift cluster.",
+              "features": [
+                {
+                  "title": "External Secrets Operator",
+                  "description": "Deploys External Secrets Operator."
+                },
+                {
+                  "title": "Configures External Secrets Operator Cluster Secrets Stores and Secrets Stores",
+                  "description": "Creates and configures External Secrets Operator Cluster Secrets Stores and Secrets Stores."
+                },
+                {
+                  "title": "Deploys Stakater Reloader",
+                  "description": "Deploys Stakater Reloader to refresh the secrets in the cluster pods when needed."
+                }
+              ],
+              "diagrams": [
+                {
+                  "diagram": {
+                    "caption": "External Secrets Operator architecture on IBM Cloud OpenShift cluster",
+                    "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-external-secrets-operator/refs/heads/da_task_11723/reference-architecture/eso.svg",
+                    "type": "image/svg+xml"
+                  },
+                  "description": "This architecture supports deploying External Secrets Operator on IBM Cloud OpenShift cluster."
+                }
+              ]
+            },
+            "dependencies": [],
+            "dependency_version_2": true,
+            "terraform_version": "1.10.5"
+          }
+        ]
+      }
+    ]
+  }