KOP Recipes - External Secrets Operator Create - Rafay Product Documentation

Create

In this part, you will

Configure and provision an Amazon EKS Cluster
Create External Secrets Operator addon
Create a custom cluster blueprint with the newly created addon
Apply the custom cluster blueprint to your EKS cluster

Step 1: Configure RCTL

This step is a one-time task. In this step, you will download the RCTL CLI so that you can interact with your Org programmatically and embed all operations in your existing automation platform.

Login into your Org and click on My Tools
Download the RCTL CLI binary for your operating system and install it on a node from which you can perform Kubectl operations to your EKS cluster
Download the CLI config and initialize the RCTL CLI with the config file

./rctl config init <full path to config file>

Optionally, check if RCTL is properly configured and can interact with your Org. You should see an output similar to the example below.

./rctl get projects

NAME
defaultproject

Step 2: Provision EKS cluster

This step assumes the following:

You have already created "cloud credentials" in the "default project".
You have configured the RCTL CLI to interact with "default project".

In the example below, you will provision an Amazon EKS cluster in the "default project" with "one managed nodegroup" using the cluster specification provided below.

Type	Description
Cluster Name	eso-demo
Project	default
Blueprint	minimal
k8s Version	1.26
AWS Region	us-west-2
Worker Nodes	1
Node Group Type	Managed

apiVersion: infra.k8smgmt.io/v3
kind: Cluster
metadata:
  name: eso-demo
  project: defaultproject
spec:
  blueprintConfig:
    name: minimal
    version: latest
  cloudCredentials: demo-aws-full-role
  config:
    addons:
    - name: aws-ebs-csi-driver
      version: latest
    managedNodeGroups:
    - amiFamily: AmazonLinux2
      desiredCapacity: 1
      iam:
        withAddonPolicies:
          autoScaler: true
      instanceTypes:
      - t3.large
      maxSize: 5
      minSize: 1
      name: dreta-managed-ng
      privateNetworking: true
      version: "1.26"
      volumeSize: 80
      volumeType: gp3
    metadata:
      name: eso-demo
      region: us-west-2
      tags:
        email: demo@rafay.co
        env: dev
      version: "1.26"
    network:
      cni:
        name: aws-cni
    vpc:
      cidr: 192.168.0.0/16
      clusterEndpoints:
        privateAccess: true
        publicAccess: false
      nat:
        gateway: Single
  proxyConfig: {}
  type: aws-eks

Copy the cluster specification and save it to a YAML file (e.g "eso-demo.yaml")
Use the RCTL CLI to provision the EKS cluster in your project

./rctl apply -f "eso-demo.yaml"

This will start the provisioning of an EKS cluster in the project. This step can take ~20-30 minutes to complete. Once provisioning is successful, you should be able to interact with your EKS cluster in your Project.

Step 3: Cluster Blueprint

In this step, you will:

Create an External Secrets Operator addon allowing you to synchronize secrets stored in AWS Secrets Manager to K8s Secrets.
Create a custom cluster blueprint with the External Secrets Operator addon.

Create Namespace

Click on Infrastructure -> Namespaces
Click New Namespace
Enter "external-secrets" in the "Name" section
For "Type" Select "Wizard" from the dropdown
Click "SAVE"
Click "SAVE & GO TO PLACEMENT"
For the placement select the cluster we just created
Click "SAVE & GO TO PUBLISH"
Click on "Publish"

Create External Secrets Operator Addon

Click on Infrastructure -> Addons
Click on "Create New Addon from Catalog"
Select the "external-secrets" chart from the "default-helm" catalog
Select a Version, we are using "0.9.1".
Click on "Create Add-On"
Enter "external-secrets-operator" for the Name
Enter "external-secrets" for the namespace
Click on "CREATE"
Enter a version name, for this exercise we are using "v0.9.1-1"
Click on "SAVE CHANGES"

New Blueprint

Select blueprints and create a new blueprint (e.g. external-secrets-operator)
Click on "SAVE"
Enter "v1" for the "Version Name" (e.g. v1)
Click on "Configure Add-Ons"
Add the "external-secrets-operator" Add-On
Click on "SAVE CHANGES"
DeSelect the "Local Storage", and "Ingress Controller" managed system add-on
Click on "SAVE CHANGES"

Step 4: Apply Blueprint

Now, we are ready to apply the newly created, custom blueprint to our EKS cluster.

Select Infrastructure -> Clusters
Click on the gear icon on the far right of the EKS cluster
Update blueprint and select the new blueprint and version
Click on "SAVE AND PUBLISH"

In a few minutes, all the k8s resources matching the custom cluster blueprint will become operational on the cluster.

Notice that the cluster's blueprint name and version match what you created in the prior step.

Step 5: Verify Setup

Optionally, to verify if the External Sercrets Operator has been properly deployed you can do the following:

Click on the EKS cluster
Select Resources to view the integrated k8s dashboard
Select "pods" from the resource selector and filter by the "external-secrets" namespace
Verify all pods are in a running state

Next Steps

You are now ready to move on to the second part of the recipe.