Overview

Integrate Konflux with Red Hat IT corporate HashiCorp Vault using External Secrets Operator (ESO) to sync secrets into Konflux tenant namespace.

Steps

1. Add Authentication Secrets - Add two Key/value secrets to Konflux tenant namespace: Vault app role secret and Red Hat IT root certificate PEM
2. Create SecretStore via GitOps - Create SecretStore CR in konflux-release-data repository defining Vault connection and authentication
3. Add Target Secret to Vault - Add secret data to designated Vault path via web UI or CLI
4. Create ExternalSecret Manifest - Define ExternalSecret YAML referencing SecretStore and Vault path
5. Generate Manifests and Merge - Run ./build-manifests.sh, commit, open MR, and let ArgoCD reconcile