Skip to content

Commit fa55bbb

Browse files
cjeannerclaude
cjeanner
and
claude
committed
[rhoso-gitops] add secret management page and fix docs
Add new secret-management.adoc covering both the secure storage backend + ESO approach and direct injection for the rhoso-gitops pattern. Update deploying and configuration pages to cross-reference the new page, remove duplicated Secret zero section, fix imagesdir attribute ordering across all rhoso-gitops pages, apply doc-review style fixes, and update diagrams. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent b2e0a2a commit fa55bbb

11 files changed

Lines changed: 298 additions & 67 deletions

‎content/patterns/rhoso-gitops/_index.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@ links:
2020
---
2121

2222
:toc:
23-
:imagesdir: /images
2423
:_content-type: ASSEMBLY
2524
include::modules/comm-attributes.adoc[]
25+
:imagesdir: /images
2626

2727
include::modules/rhoso-gitops/rhoso-gitops-about.adoc[leveloffset=+1]
2828

‎content/patterns/rhoso-gitops/cluster-sizing.adoc‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@ aliases: /rhoso-gitops/cluster-sizing/
55
---
66

77
:toc:
8-
:imagesdir: /images
98
:_content-type: ASSEMBLY
109
include::modules/comm-attributes.adoc[]
10+
:imagesdir: /images
1111
include::modules/rhoso-gitops/metadata-rhoso-gitops.adoc[]
1212

1313
[id="rhoso-gitops-cluster-requirements"]
@@ -27,9 +27,3 @@ in the {rh-rhoso} _Planning your deployment_ guide.
2727
The {rh-ocp} cluster hosts the {rh-rhoso-short} control plane. A full
2828
{rh-rhoso-short} deployment also requires separate {rhel-short} hosts for the
2929
data plane (compute nodes running data plane elements).
30-
31-
Plan additional {rhel-short} capacity beyond the OpenShift worker sizing in
32-
`pattern-metadata.yaml`.
33-
For Operator stages, sync order, and version pins, see
34-
the pattern repository link:https://github.com/validatedpatterns-sandbox/rhoso-gitops/blob/main/VERSIONS.md[VERSIONS.md]
35-
file.

‎content/patterns/rhoso-gitops/configuration.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ aliases: /rhoso-gitops/configuration/
55
---
66

77
:toc:
8-
:imagesdir: /images
98
:_content-type: ASSEMBLY
109
include::modules/comm-attributes.adoc[]
10+
:imagesdir: /images
1111

1212
include::modules/rhoso-gitops/rhoso-gitops-configuration.adoc[leveloffset=+1]

‎content/patterns/rhoso-gitops/getting-started.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ aliases: /rhoso-gitops/getting-started/
55
---
66

77
:toc:
8-
:imagesdir: /images
98
:_content-type: ASSEMBLY
109
include::modules/comm-attributes.adoc[]
10+
:imagesdir: /images
1111

1212
include::modules/rhoso-gitops/rhoso-gitops-deploying.adoc[leveloffset=+1]

‎content/patterns/rhoso-gitops/secret-management.adoc‎

Lines changed: 278 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,278 @@
1+
---
2+
title: Secret management
3+
weight: 25
4+
aliases: /rhoso-gitops/secret-management/
5+
---
6+
7+
:toc:
8+
:_content-type: ASSEMBLY
9+
include::modules/comm-attributes.adoc[]
10+
:imagesdir: /images
11+
12+
[id="rhoso-gitops-secret-management"]
13+
= Secret management for the {rhoso-gitops-pattern}
14+
15+
The {rhoso-gitops-pattern} requires secrets for OpenStack service passwords, SSH
16+
key pairs, bare-metal controller credentials, and container registry
17+
authentication. You can provide these secrets in two ways depending on whether a
18+
secure storage backend is available. The two approaches can also be combined: for
19+
example, store shared credentials (registry, subscription) in the backend while
20+
injecting service-specific passwords as `bootstrap_secrets`, or use
21+
`onMissingValue: generate` to let the backend generate passwords at deployment
22+
time.
23+
24+
For the canonical list of required secrets, see
25+
link:https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/latest/html/deploying_red_hat_openstack_services_on_openshift/assembly_preparing-rhocp-for-rhoso#proc_providing-secure-access-to-the-RHOSO-services_preparing[Providing secure access to the {rh-rhoso-short} services]
26+
in the {rh-rhoso} documentation.
27+
28+
[id="rhoso-secrets-approaches"]
29+
== Choosing a secrets approach
30+
31+
Review the following approaches before you deploy the pattern.
32+
33+
[id="rhoso-secrets-vault-eso"]
34+
=== Secure storage backend and {eso-op}
35+
36+
image::rhoso-gitops/rhoso-gitops-secrets-vault-eso.png[Secure storage backend and {eso-op} secrets flow]
37+
38+
This is the recommended approach for production deployments. You store secrets
39+
in a secure storage backend (for example {hashicorp-vault}, AWS Secrets Manager,
40+
or any
41+
link:https://external-secrets.io/latest/provider/aws-secrets-manager/[provider supported by the {eso-op}]).
42+
`ExternalSecret` resources project these secrets into the `openstack` namespace
43+
through a `SecretStore`.
44+
45+
The framework does not install the storage backend or the {eso-op}
46+
automatically. You must include the {eso-op} through the `operator-dependencies`
47+
Argo CD application by using a Kustomize component from the upstream
48+
link:https://github.com/openstack-k8s-operators/gitops/tree/main/components/secrets[secrets components].
49+
The `openstack-secrets` Argo CD application deploys the `SecretStore` and
50+
`ExternalSecret` resources that pull secrets from the backend.
51+
52+
This approach uses the following configuration:
53+
54+
* The bootstrap secret (for example `vault-approle-secret-id`) is defined as a
55+
`bootstrap_secret`. The framework injects it into the `openstack` namespace
56+
during `make install` so that the {eso-op} `SecretStore` can authenticate
57+
against the backend.
58+
* All other secrets are defined under the `secrets:` section of the
59+
`values-secret.yaml` file. The framework loads them into the backend during
60+
`make load-secrets`.
61+
* `ExternalSecret` resources, deployed by the `openstack-secrets` Argo CD
62+
application, fetch secrets from the backend and create the corresponding
63+
Kubernetes `Secret` objects.
64+
65+
[id="rhoso-secrets-direct-injection"]
66+
=== Direct injection without an external store
67+
68+
image::rhoso-gitops/rhoso-gitops-secrets-direct.png[Direct injection secrets flow]
69+
70+
Use this approach when you do not have a secure storage backend. All secrets are
71+
defined as `bootstrap_secrets` in the `values-secret.yaml` file. The framework
72+
injects them as Kubernetes `Secret` objects during `make install`. No storage
73+
backend or {eso-op} is installed.
74+
75+
When you use this approach, configure the following:
76+
77+
* Set `global.secretStore.backend` to `"none"` in `values-global.yaml`.
78+
* Define every required secret under the `bootstrap_secrets:` section.
79+
* Leave the `secrets:` section empty.
80+
81+
[id="rhoso-required-secrets"]
82+
== Required secrets
83+
84+
The {rhoso-gitops-pattern} requires the following secrets in the `openstack`
85+
namespace. The `values-secret.yaml.template` file in the pattern repository
86+
contains placeholder entries for each secret.
87+
88+
[cols="2,3,3",options="header"]
89+
|===
90+
| Secret name | Key fields | Purpose
91+
92+
| `vault-approle-secret-id`
93+
| `id`
94+
| Authentication credential for the {eso-op} `SecretStore` to connect to the
95+
secure storage backend. Required only with the backend + {eso-op} approach.
96+
97+
| `osp-secret`
98+
| Multiple service and database password fields
99+
| OpenStack service passwords (for example `AdminPassword`,
100+
`KeystoneDatabasePassword`, `NeutronPassword`). See the
101+
link:https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/latest/html/deploying_red_hat_openstack_services_on_openshift/assembly_preparing-rhocp-for-rhoso#proc_providing-secure-access-to-the-RHOSO-services_preparing[{rh-rhoso} documentation]
102+
for the complete list.
103+
104+
| `baremetalset-password-secret`
105+
| `NodeRootPassword`
106+
| Root password for bare-metal data plane nodes.
107+
108+
| `dataplane-ansible-ssh-private-key-secret`
109+
| `ssh-privatekey`, `ssh-publickey`, `authorized_keys`
110+
| SSH key pair for Ansible provisioning of data plane nodes.
111+
112+
| `libvirt-secret`
113+
| `LibvirtPassword`
114+
| Libvirt authentication password.
115+
116+
| `nova-migration-ssh-key`
117+
| `ssh-privatekey`, `ssh-publickey`
118+
| SSH key pair for Nova live migration.
119+
120+
| `redfish-bmc-secret-auth`
121+
| `username`, `password`
122+
| Redfish BMC credentials for bare-metal node management.
123+
124+
| `redhat-registry`
125+
| `edpm_container_registry_logins`
126+
| Container registry credentials for EDPM nodes (JSON format).
127+
128+
| `subscription-manager`
129+
| `username`, `password`, `rhc_auth`
130+
| {redhat} Subscription Manager credentials for EDPM nodes.
131+
|===
132+
133+
[id="rhoso-configuring-vault-eso"]
134+
== Configuring secrets with a secure storage backend
135+
136+
.Prerequisites
137+
138+
* You have forked and cloned the
139+
link:https://github.com/validatedpatterns-sandbox/rhoso-gitops[rhoso-gitops]
140+
repository.
141+
* You have deployed a secure storage backend and have an authentication
142+
credential (for example an AppRole secret ID) available.
143+
* You have a Git repository with Kustomize overlays that define the
144+
`SecretStore` and `ExternalSecret` resources for the `openstack` namespace.
145+
* You have the OpenStack service passwords, SSH key pairs, BMC credentials, and
146+
registry credentials listed in the
147+
link:https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/latest/html/deploying_red_hat_openstack_services_on_openshift/assembly_preparing-rhocp-for-rhoso#proc_providing-secure-access-to-the-RHOSO-services_preparing[{rh-rhoso} documentation].
148+
149+
.Procedure
150+
151+
. Include the {eso-op} in the `operator-dependencies` application by adding a
152+
Kustomize component in `overrides/values-rhoso-gitops.yaml`. The following
153+
example uses the {redhat} build of the {eso-op}:
154+
+
155+
[source,yaml,subs="+quotes"]
156+
----
157+
applications:
158+
operator-dependencies:
159+
kustomize:
160+
components:
161+
- "https://github.com/openstack-k8s-operators/gitops/components/secrets/external-secrets-operator/redhat?ref=__<gitops-tag>__"
162+
----
163+
+
164+
For other {eso-op} variants, see the upstream
165+
link:https://github.com/openstack-k8s-operators/gitops/tree/main/components/secrets[components/secrets]
166+
README.
167+
168+
. Enable the `openstack-secrets` application in the same overrides file. This
169+
application deploys the `SecretStore` and `ExternalSecret` resources that pull
170+
secrets from the backend:
171+
+
172+
[source,yaml,subs="+quotes"]
173+
----
174+
openstack-secrets:
175+
enabled: true
176+
repoURL: "https://github.com/__<your_organization>__/__<your-gitops-overlay>__.git"
177+
path: "__<path-to-eso-overlay>__"
178+
targetRevision: "__<branch-or-tag>__"
179+
----
180+
181+
. Extract the authentication credential from your secure storage backend (for
182+
example an AppRole secret ID) and save it to a file:
183+
+
184+
[source,terminal,subs="+quotes"]
185+
----
186+
$ echo -n "__<approle-secret-id>__" > ~/vault-approle-secret-id
187+
----
188+
189+
. Create a `values-secret.yaml` file based on the template. Include the
190+
bootstrap secret for the backend credential and define all other secrets under
191+
the `secrets:` section for backend injection:
192+
+
193+
[source,yaml,subs="+quotes"]
194+
----
195+
version: "2.0"
196+
197+
bootstrap_secrets:
198+
- name: vault-approle-secret-id
199+
targetNamespaces:
200+
- openstack
201+
fields:
202+
- name: id
203+
path: ~/vault-approle-secret-id
204+
onMissingValue: error
205+
206+
secrets:
207+
- name: osp-secret
208+
fields:
209+
- name: AdminPassword
210+
value: "__<admin-password>__"
211+
# ... remaining service password fields
212+
# ... remaining secrets
213+
----
214+
215+
. Install the pattern:
216+
+
217+
[source,terminal]
218+
----
219+
$ ./pattern.sh make install
220+
----
221+
222+
. Verify that the `ExternalSecret` resources are synchronized:
223+
+
224+
[source,terminal]
225+
----
226+
$ oc get externalsecrets -n openstack
227+
----
228+
+
229+
Each `ExternalSecret` shows a `SecretSynced` status when the {eso-op} has
230+
created the corresponding Kubernetes `Secret`.
231+
232+
[id="rhoso-configuring-direct-injection"]
233+
== Configuring secrets with direct injection
234+
235+
.Prerequisites
236+
237+
* You have forked and cloned the
238+
link:https://github.com/validatedpatterns-sandbox/rhoso-gitops[rhoso-gitops]
239+
repository.
240+
* You have the OpenStack service passwords, SSH key pairs, BMC credentials, and
241+
registry credentials listed in the
242+
link:https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/latest/html/deploying_red_hat_openstack_services_on_openshift/assembly_preparing-rhocp-for-rhoso#proc_providing-secure-access-to-the-RHOSO-services_preparing[{rh-rhoso} documentation].
243+
244+
.Procedure
245+
246+
. Set the secret store backend to `none` in `values-global.yaml`:
247+
+
248+
[source,yaml]
249+
----
250+
global:
251+
secretStore:
252+
backend: "none"
253+
----
254+
255+
. Copy the secrets template and edit it:
256+
+
257+
[source,terminal,subs="+quotes"]
258+
----
259+
$ cp values-secret.yaml.template ~/values-secret-rhoso-gitops.yaml
260+
----
261+
+
262+
Replace every `CHANGEME_*` placeholder with the actual value. For SSH key pairs,
263+
set the `path:` field to point at your local key files. Secret values must be in
264+
plain text, not base64-encoded.
265+
266+
. Install the pattern:
267+
+
268+
[source,terminal]
269+
----
270+
$ ./pattern.sh make install
271+
----
272+
273+
. Verify that the secrets exist in the `openstack` namespace:
274+
+
275+
[source,terminal]
276+
----
277+
$ oc get secrets -n openstack
278+
----

‎content/patterns/rhoso-gitops/troubleshooting.adoc‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@ aliases: /rhoso-gitops/troubleshooting/
55
---
66

77
:toc:
8-
:imagesdir: /images
98
:_content-type: ASSEMBLY
109
include::modules/comm-attributes.adoc[]
10+
:imagesdir: /images
1111

1212
[id="troubleshooting-rhoso-gitops"]
1313
= Troubleshooting the {rhoso-gitops-pattern}
@@ -96,9 +96,8 @@ The following known issues can affect pattern deployment:
9696

9797
* *`openstack-secrets` disabled*: The default pattern leaves
9898
`openstack-secrets` disabled because no Git path exists (`path: TODO`).
99-
Enable it only after you configure secret wiring and a bootstrap credential
100-
out of band. See link:../configuration/#rhoso-gitops-secret-zero[Secret zero
101-
(bootstrap credential)].
99+
Enable it only after you configure secret wiring. See
100+
link:../secret-management/[Secret management for the {rhoso-gitops-pattern}].
102101
* *Upstream sync failures*: Confirm that `targetRevision` and paths in
103102
`overrides/values-rhoso-gitops.yaml` match a tag or branch that exists in
104103
link:https://github.com/openstack-k8s-operators/gitops[openstack-k8s-operators/gitops].

0 commit comments

Comments
 (0)