trusted-profiles-authentication

Example that uses trusted profiles (container authentication)

This example shows how external secrets can be configured to use trusted profile with compute resource-based authentication.

Resources with trusted profiles with compute resource can authenticate with IAM tokens that are generated by the compute resources. This type of authentication avoids key-related operations, such as rotation.

The example shows also how to configure external secrets with trusted profiles in a multitenant configuration, by creating two different trusted profiles, the related external secrets resources, the stores and deploying the ESO into the cluster

This example includes the following operations:

• Creates a Secrets Manager instance and two different secrets groups for each tenant (represented by tenant namespace)
• Creates a trusted profile to access the created instance and secret group with secrets reader-only access, for each tenant
• Installs and configures external secrets operator
• Creates a secret store with trusted profile container authentication for each tenant

In addiction to the mentioned details, this example includes guidance on:

• customising the deployment of external secrets operator on specific cluster's worker nodes: variable eso_deployment_nodes_configuration allows to configure nodeSelector and tolerations setting for the ESO deployment
• creating Virtual Private Endpoints (VPE) towards IAM and Secrets Manager private endpoints in the case of service_endpoints set to private