feat: deploy External Secrets Operator via ArgoCD#6
Draft
nbrieussel wants to merge 1 commit into
Draft
Conversation
- external-secrets.yml: Helm Application (chart external-secrets 2.6.0, installCRDs), sync-wave 0. - external-secrets-store(.yml + dir): ClusterSecretStore pointing at Infisical (project platform-p-qc1, env staging), sync-wave 1 so it lands after the CRDs. Auth uses the universal-auth Secret seeded by Terraform (infrastructure repo). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Deploy External Secrets Operator as a platform component, managed by ArgoCD. The one secret ESO can't source from itself (its Infisical universal-auth creds) is seeded out-of-band by Terraform — see companion PR in
infrastructure. The previous local POC (external-secret-operator.yml, never committed) is dropped; this is a clean rewrite.Changes
platform/scaleway/external-secrets.yml— Helm Application (chartexternal-secrets2.6.0,installCRDs), sync-wave0.platform/scaleway/external-secrets-store.yml+external-secrets-store/cluster-secret-store.yaml—ClusterSecretStore→ Infisical (projectplatform-p-qc1, envstaging, path/), sync-wave1so it applies after the CRDs. Auth reads theinfisical-universal-authSecret seeded by Terraform.Notes
external-secrets-store.ymlpinstargetRevision: main(platform dir is synced as plain manifests, norevisionpropagation) — merge to test the store content end-to-end.Companion
infrastructure
feature/external-secrets-operator(secret-zero).🤖 Generated with Claude Code