feat: team secret management with sealed secrets

[ferruhcihan]

📌 Summary

This PR adds team secret management with sealed secrets and separates it from the ESO managed cluster secret store.

PR: apl-api | apl-console

🔍 Reviewer Notes

🧹 Checklist

• Code is readable, maintainable, and robust.
• Unit tests added/updated

[merll]

I know we have some apl.io labels already, but I think we should not go further with this. These prefixes are often associated with domains, and someone else owns this one. I would suggest using otomi.io unless we find something more suitable.

[ferruhcihan]

Updated as otomi.io.

[svcAPLBot]

Comparison of Helm chart templating output:

# external-secrets/templates/deployment.yaml

@@ spec.template.spec.containers.external-secrets.args @@
! - one list entry removed:
- - "--enable-push-secret-reconciler=false"

# external-secrets/templates/rbac.yaml

@@ rules @@
# rbac.authorization.k8s.io/v1/ClusterRole/external-secrets-controller
! - two list entries removed:
- - resources:
-   - clustersecretstores
-   - externalsecrets
-   - secretstores
-   apiGroups:
-   - external-secrets.io
-   verbs:
-   - get
-   - list
-   - watch
- - resources:
-   - clustersecretstores
-   - clustersecretstores/status
-   - externalsecrets
-   - externalsecrets/status
-   - secretstores
-   - secretstores/status
-   apiGroups:
-   - external-secrets.io
-   verbs:
-   - get
-   - patch
-   - update
! + three list entries added:
+ - resources:
+   - clustersecretstores
+   - externalsecrets
+   - pushsecrets
+   - secretstores
+   apiGroups:
+   - external-secrets.io
+   verbs:
+   - get
+   - list
+   - watch
+ - resources:
+   - clustersecretstores
+   - clustersecretstores/status
+   - externalsecrets
+   - externalsecrets/status
+   - pushsecrets
+   - pushsecrets/status
+   - secretstores
+   - secretstores/status
+   apiGroups:
+   - external-secrets.io
+   verbs:
+   - get
+   - patch
+   - update
+ - resources:
+   - pushsecrets
+   apiGroups:
+   - external-secrets.io
+   verbs:
+   - create
+   - delete
+   - update

@@ rules @@
# rbac.authorization.k8s.io/v1/ClusterRole/external-secrets-view
! - one list entry removed:
- - resources:
-   - clustersecretstores
-   - externalsecrets
-   - secretstores
-   apiGroups:
-   - external-secrets.io
-   verbs:
-   - get
-   - list
-   - watch
! + one list entry added:
+ - resources:
+   - clustersecretstores
+   - externalsecrets
+   - pushsecrets
+   - secretstores
+   apiGroups:
+   - external-secrets.io
+   verbs:
+   - get
+   - list
+   - watch

@@ rules @@
# rbac.authorization.k8s.io/v1/ClusterRole/external-secrets-edit
! - one list entry removed:
- - resources:
-   - clustersecretstores
-   - externalsecrets
-   - secretstores
-   apiGroups:
-   - external-secrets.io
-   verbs:
-   - create
-   - delete
-   - deletecollection
-   - patch
-   - update
! + one list entry added:
+ - resources:
+   - clustersecretstores
+   - externalsecrets
+   - pushsecrets
+   - secretstores
+   apiGroups:
+   - external-secrets.io
+   verbs:
+   - create
+   - delete
+   - deletecollection
+   - patch
+   - update

@@ rules.0.resources @@
# rbac.authorization.k8s.io/v1/ClusterRole/external-secrets-servicebindings
! + one list entry added:
+ - pushsecrets

# raw/templates/resources.yaml

@@ spec @@
# external-secrets.io/v1/ClusterSecretStore/core-secrets-store
! + one map entry added:
+ conditions:
+ - namespaceSelector:
+     matchExpressions:
+     - key: otomi.io/team
+       operator: DoesNotExist

@@ (root level) @@
# rbac.authorization.k8s.io/v1/ClusterRole/eso-push-secret-writer
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRole
+ metadata:
+   name: eso-push-secret-writer
+   labels:
+     app: raw
+     app.kubernetes.io/instance: external-secrets-artifacts
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: raw
+     app.kubernetes.io/part-of: otomi
+     app.kubernetes.io/version: 0.2.3
+     helm.sh/chart: raw-0.2.3
+ rules:
+ - resources:
+   - secrets
+   apiGroups:
+   - 
+   verbs:
+   - get
+   - create
+   - update
+   - patch
+   - delete

# rabbitmq-cluster-operator/templates/messaging-topology-operator/validating-webhook-configuration.yaml

# raw/templates/resources.yaml

@@ metadata.name @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-demo-alertmanager-composite
! ± value change
- alertmanager-credentials
+ team-demo-alertmanager-composite

@@ metadata.namespace @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-demo-alertmanager-composite
! ± value change
- team-demo
+ apl-secrets

@@ spec.target.name @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-demo-alertmanager-composite
! ± value change
- alertmanager-credentials
+ team-demo-alertmanager-composite

@@ metadata.name @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-demo-grafana-oidc-composite
! ± value change
- grafana-oidc-secret
+ team-demo-grafana-oidc-composite

@@ metadata.namespace @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-demo-grafana-oidc-composite
! ± value change
- team-demo
+ apl-secrets

@@ spec.data.0.secretKey @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-demo-grafana-oidc-composite
! ± value change
- clientSecret
+ idp_clientSecret

@@ spec.target.name @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-demo-grafana-oidc-composite
! ± value change
- grafana-oidc-secret
+ team-demo-grafana-oidc-composite

@@ spec.target.template @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-demo-grafana-oidc-composite
! - one map entry removed:
- type: Opaque

@@ spec.target.template.data.client_secret @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-demo-grafana-oidc-composite
! ± value change
- {{ .clientSecret | toString }}
+ {{ .idp_clientSecret | toString }}

@@ metadata.name @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-demo-grafana-admin-composite
! ± value change
- team-demo-grafana-admin
+ team-demo-grafana-admin-composite

@@ metadata.namespace @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-demo-grafana-admin-composite
! ± value change
- team-demo
+ apl-secrets

@@ spec.data.0.secretKey @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-demo-grafana-admin-composite
! ± value change
- password
+ settings_password

@@ spec.target.name @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-demo-grafana-admin-composite
! ± value change
- team-demo-grafana-admin
+ team-demo-grafana-admin-composite

@@ spec.target.template @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-demo-grafana-admin-composite
! - one map entry removed:
- type: Opaque

@@ spec.target.template.data.admin-password @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-demo-grafana-admin-composite
! ± value change
- {{ .password | toString }}
+ {{ .settings_password | toString }}

@@ (root level) @@
# external-secrets.io/v1/ExternalSecret/team-demo/grafana-loki-datasource-secret
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: external-secrets.io/v1
- kind: ExternalSecret
- metadata:
-   name: grafana-loki-datasource-secret
-   namespace: team-demo
-   labels:
-     app: raw
-     app.kubernetes.io/instance: team-secrets-demo
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/name: raw
-     app.kubernetes.io/part-of: otomi
-     app.kubernetes.io/version: 0.2.3
-     helm.sh/chart: raw-0.2.3
- spec:
-   data:
-   - remoteRef:
-       key: loki-secrets
-       property: adminPassword
-     secretKey: adminPassword
-   refreshInterval: 1h
-   secretStoreRef:
-     name: core-secrets-store
-     kind: ClusterSecretStore
-   target:
-     name: grafana-loki-datasource-secret
-     creationPolicy: Owner
-     template:
-       type: Opaque
-       data:
-         password: "{{ .adminPassword | toString }}"

@@ (root level) @@
# external-secrets.io/v1/ClusterSecretStore/team-demo-push-store
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1
+ kind: ClusterSecretStore
+ metadata:
+   name: team-demo-push-store
+   labels:
+     app: raw
+     app.kubernetes.io/instance: team-secrets-demo
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: raw
+     app.kubernetes.io/part-of: otomi
+     app.kubernetes.io/version: 0.2.3
+     helm.sh/chart: raw-0.2.3
+ spec:
+   conditions:
+   - namespaceSelector:
+       matchLabels:
+         kubernetes.io/metadata.name: apl-secrets
+   provider:
+     kubernetes:
+       auth:
+         serviceAccount:
+           name: eso-store-sa
+           namespace: external-secrets
+       remoteNamespace: team-demo
+       server:
+         url: "https://kubernetes.default.svc"
+         caProvider:
+           name: kube-root-ca.crt
+           type: ConfigMap
+           key: ca.crt
+           namespace: external-secrets

@@ (root level) @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-demo-pullsecret-composite
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1
+ kind: ExternalSecret
+ metadata:
+   name: team-demo-pullsecret-composite
+   namespace: apl-secrets
+   labels:
+     app: raw
+     app.kubernetes.io/instance: team-secrets-demo
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: raw
+     app.kubernetes.io/part-of: otomi
+     app.kubernetes.io/version: 0.2.3
+     helm.sh/chart: raw-0.2.3
+ spec:
+   data:
+   - remoteRef:
+       key: otomi-secrets
+       property: globalPullSecret_password
+     secretKey: globalPullSecret_password
+   refreshInterval: 1h
+   secretStoreRef:
+     name: core-secrets-store
+     kind: ClusterSecretStore
+   target:
+     name: team-demo-pullsecret-composite
+     creationPolicy: Owner
+     template:
+       type: kubernetes.io/dockerconfigjson
+       data:
+         .dockerconfigjson: "{\"auths\":{\"docker.io\":{\"username\":\"otomi\",\"password\":\"{{ .globalPullSecret_password | toString }}\",\"email\":\"not@val.id\"}}}"

@@ (root level) @@
# external-secrets.io/v1alpha1/PushSecret/apl-secrets/team-demo-grafana-admin-push
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1alpha1
+ kind: PushSecret
+ metadata:
+   name: team-demo-grafana-admin-push
+   namespace: apl-secrets
+   labels:
+     app: raw
+     app.kubernetes.io/instance: team-secrets-demo
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: raw
+     app.kubernetes.io/part-of: otomi
+     app.kubernetes.io/version: 0.2.3
+     helm.sh/chart: raw-0.2.3
+ spec:
+   data:
+   - match:
+       remoteRef:
+         property: admin-user
+         remoteKey: team-demo-grafana-admin
+       secretKey: admin-user
+   - match:
+       remoteRef:
+         property: admin-password
+         remoteKey: team-demo-grafana-admin
+       secretKey: admin-password
+   deletionPolicy: Delete
+   refreshInterval: 1h
+   secretStoreRefs:
+   - name: team-demo-push-store
+     kind: ClusterSecretStore
+   selector:
+     secret:
+       name: team-demo-grafana-admin-composite

@@ (root level) @@
# external-secrets.io/v1alpha1/PushSecret/apl-secrets/team-demo-grafana-oidc-push
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1alpha1
+ kind: PushSecret
+ metadata:
+   name: team-demo-grafana-oidc-push
+   namespace: apl-secrets
+   labels:
+     app: raw
+     app.kubernetes.io/instance: team-secrets-demo
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: raw
+     app.kubernetes.io/part-of: otomi
+     app.kubernetes.io/version: 0.2.3
+     helm.sh/chart: raw-0.2.3
+ spec:
+   data:
+   - match:
+       remoteRef:
+         property: client_id
+         remoteKey: grafana-oidc-secret
+       secretKey: client_id
+   - match:
+       remoteRef:
+         property: client_secret
+         remoteKey: grafana-oidc-secret
+       secretKey: client_secret
+   deletionPolicy: Delete
+   refreshInterval: 1h
+   secretStoreRefs:
+   - name: team-demo-push-store
+     kind: ClusterSecretStore
+   selector:
+     secret:
+       name: team-demo-grafana-oidc-composite

@@ (root level) @@
# external-secrets.io/v1alpha1/PushSecret/apl-secrets/team-demo-grafana-loki-push
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1alpha1
+ kind: PushSecret
+ metadata:
+   name: team-demo-grafana-loki-push
+   namespace: apl-secrets
+   labels:
+     app: raw
+     app.kubernetes.io/instance: team-secrets-demo
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: raw
+     app.kubernetes.io/part-of: otomi
+     app.kubernetes.io/version: 0.2.3
+     helm.sh/chart: raw-0.2.3
+ spec:
+   data:
+   - match:
+       remoteRef:
+         property: password
+         remoteKey: grafana-loki-datasource-secret
+       secretKey: adminPassword
+   deletionPolicy: Delete
+   refreshInterval: 1h
+   secretStoreRefs:
+   - name: team-demo-push-store
+     kind: ClusterSecretStore
+   selector:
+     secret:
+       name: loki-secrets

@@ (root level) @@
# external-secrets.io/v1alpha1/PushSecret/apl-secrets/team-demo-alertmanager-push
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1alpha1
+ kind: PushSecret
+ metadata:
+   name: team-demo-alertmanager-push
+   namespace: apl-secrets
+   labels:
+     app: raw
+     app.kubernetes.io/instance: team-secrets-demo
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: raw
+     app.kubernetes.io/part-of: otomi
+     app.kubernetes.io/version: 0.2.3
+     helm.sh/chart: raw-0.2.3
+ spec:
+   data:
+   - match:
+       remoteRef:
+         property: slackUrl
+         remoteKey: alertmanager-credentials
+       secretKey: slackUrl
+   deletionPolicy: Delete
+   refreshInterval: 1h
+   secretStoreRefs:
+   - name: team-demo-push-store
+     kind: ClusterSecretStore
+   selector:
+     secret:
+       name: team-demo-alertmanager-composite

@@ (root level) @@
# external-secrets.io/v1alpha1/PushSecret/apl-secrets/team-demo-pullsecret-push
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1alpha1
+ kind: PushSecret
+ metadata:
+   name: team-demo-pullsecret-push
+   namespace: apl-secrets
+   labels:
+     app: raw
+     app.kubernetes.io/instance: team-secrets-demo
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: raw
+     app.kubernetes.io/part-of: otomi
+     app.kubernetes.io/version: 0.2.3
+     helm.sh/chart: raw-0.2.3
+ spec:
+   data:
+   - match:
+       remoteRef:
+         property: .dockerconfigjson
+         remoteKey: otomi-pullsecret-global
+       secretKey: .dockerconfigjson
+   deletionPolicy: Delete
+   refreshInterval: 1h
+   secretStoreRefs:
+   - name: team-demo-push-store
+     kind: ClusterSecretStore
+   selector:
+     secret:
+       name: team-demo-pullsecret-composite

# raw/templates/resources.yaml

@@ metadata.name @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-dev-grafana-oidc-composite
! ± value change
- grafana-oidc-secret
+ team-dev-grafana-oidc-composite

@@ metadata.namespace @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-dev-grafana-oidc-composite
! ± value change
- team-dev
+ apl-secrets

@@ spec.data.0.secretKey @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-dev-grafana-oidc-composite
! ± value change
- clientSecret
+ idp_clientSecret

@@ spec.target.name @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-dev-grafana-oidc-composite
! ± value change
- grafana-oidc-secret
+ team-dev-grafana-oidc-composite

@@ spec.target.template @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-dev-grafana-oidc-composite
! - one map entry removed:
- type: Opaque

@@ spec.target.template.data.client_secret @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-dev-grafana-oidc-composite
! ± value change
- {{ .clientSecret | toString }}
+ {{ .idp_clientSecret | toString }}

@@ metadata.name @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-dev-grafana-admin-composite
! ± value change
- team-dev-grafana-admin
+ team-dev-grafana-admin-composite

@@ metadata.namespace @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-dev-grafana-admin-composite
! ± value change
- team-dev
+ apl-secrets

@@ spec.data.0.secretKey @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-dev-grafana-admin-composite
! ± value change
- password
+ settings_password

@@ spec.target.name @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-dev-grafana-admin-composite
! ± value change
- team-dev-grafana-admin
+ team-dev-grafana-admin-composite

@@ spec.target.template @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-dev-grafana-admin-composite
! - one map entry removed:
- type: Opaque

@@ spec.target.template.data.admin-password @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-dev-grafana-admin-composite
! ± value change
- {{ .password | toString }}
+ {{ .settings_password | toString }}

@@ (root level) @@
# external-secrets.io/v1/ExternalSecret/team-dev/grafana-loki-datasource-secret
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: external-secrets.io/v1
- kind: ExternalSecret
- metadata:
-   name: grafana-loki-datasource-secret
-   namespace: team-dev
-   labels:
-     app: raw
-     app.kubernetes.io/instance: team-secrets-dev
-     app.kubernetes.io/managed-by: Helm
-     app.kubernetes.io/name: raw
-     app.kubernetes.io/part-of: otomi
-     app.kubernetes.io/version: 0.2.3
-     helm.sh/chart: raw-0.2.3
- spec:
-   data:
-   - remoteRef:
-       key: loki-secrets
-       property: adminPassword
-     secretKey: adminPassword
-   refreshInterval: 1h
-   secretStoreRef:
-     name: core-secrets-store
-     kind: ClusterSecretStore
-   target:
-     name: grafana-loki-datasource-secret
-     creationPolicy: Owner
-     template:
-       type: Opaque
-       data:
-         password: "{{ .adminPassword | toString }}"

@@ (root level) @@
# external-secrets.io/v1/ClusterSecretStore/team-dev-push-store
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1
+ kind: ClusterSecretStore
+ metadata:
+   name: team-dev-push-store
+   labels:
+     app: raw
+     app.kubernetes.io/instance: team-secrets-dev
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: raw
+     app.kubernetes.io/part-of: otomi
+     app.kubernetes.io/version: 0.2.3
+     helm.sh/chart: raw-0.2.3
+ spec:
+   conditions:
+   - namespaceSelector:
+       matchLabels:
+         kubernetes.io/metadata.name: apl-secrets
+   provider:
+     kubernetes:
+       auth:
+         serviceAccount:
+           name: eso-store-sa
+           namespace: external-secrets
+       remoteNamespace: team-dev
+       server:
+         url: "https://kubernetes.default.svc"
+         caProvider:
+           name: kube-root-ca.crt
+           type: ConfigMap
+           key: ca.crt
+           namespace: external-secrets

@@ (root level) @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-dev-pullsecret-composite
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1
+ kind: ExternalSecret
+ metadata:
+   name: team-dev-pullsecret-composite
+   namespace: apl-secrets
+   labels:
+     app: raw
+     app.kubernetes.io/instance: team-secrets-dev
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: raw
+     app.kubernetes.io/part-of: otomi
+     app.kubernetes.io/version: 0.2.3
+     helm.sh/chart: raw-0.2.3
+ spec:
+   data:
+   - remoteRef:
+       key: otomi-secrets
+       property: globalPullSecret_password
+     secretKey: globalPullSecret_password
+   refreshInterval: 1h
+   secretStoreRef:
+     name: core-secrets-store
+     kind: ClusterSecretStore
+   target:
+     name: team-dev-pullsecret-composite
+     creationPolicy: Owner
+     template:
+       type: kubernetes.io/dockerconfigjson
+       data:
+         .dockerconfigjson: "{\"auths\":{\"docker.io\":{\"username\":\"otomi\",\"password\":\"{{ .globalPullSecret_password | toString }}\",\"email\":\"not@val.id\"}}}"

@@ (root level) @@
# external-secrets.io/v1alpha1/PushSecret/apl-secrets/team-dev-grafana-admin-push
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1alpha1
+ kind: PushSecret
+ metadata:
+   name: team-dev-grafana-admin-push
+   namespace: apl-secrets
+   labels:
+     app: raw
+     app.kubernetes.io/instance: team-secrets-dev
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: raw
+     app.kubernetes.io/part-of: otomi
+     app.kubernetes.io/version: 0.2.3
+     helm.sh/chart: raw-0.2.3
+ spec:
+   data:
+   - match:
+       remoteRef:
+         property: admin-user
+         remoteKey: team-dev-grafana-admin
+       secretKey: admin-user
+   - match:
+       remoteRef:
+         property: admin-password
+         remoteKey: team-dev-grafana-admin
+       secretKey: admin-password
+   deletionPolicy: Delete
+   refreshInterval: 1h
+   secretStoreRefs:
+   - name: team-dev-push-store
+     kind: ClusterSecretStore
+   selector:
+     secret:
+       name: team-dev-grafana-admin-composite

@@ (root level) @@
# external-secrets.io/v1alpha1/PushSecret/apl-secrets/team-dev-grafana-oidc-push
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1alpha1
+ kind: PushSecret
+ metadata:
+   name: team-dev-grafana-oidc-push
+   namespace: apl-secrets
+   labels:
+     app: raw
+     app.kubernetes.io/instance: team-secrets-dev
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: raw
+     app.kubernetes.io/part-of: otomi
+     app.kubernetes.io/version: 0.2.3
+     helm.sh/chart: raw-0.2.3
+ spec:
+   data:
+   - match:
+       remoteRef:
+         property: client_id
+         remoteKey: grafana-oidc-secret
+       secretKey: client_id
+   - match:
+       remoteRef:
+         property: client_secret
+         remoteKey: grafana-oidc-secret
+       secretKey: client_secret
+   deletionPolicy: Delete
+   refreshInterval: 1h
+   secretStoreRefs:
+   - name: team-dev-push-store
+     kind: ClusterSecretStore
+   selector:
+     secret:
+       name: team-dev-grafana-oidc-composite

@@ (root level) @@
# external-secrets.io/v1alpha1/PushSecret/apl-secrets/team-dev-grafana-loki-push
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1alpha1
+ kind: PushSecret
+ metadata:
+   name: team-dev-grafana-loki-push
+   namespace: apl-secrets
+   labels:
+     app: raw
+     app.kubernetes.io/instance: team-secrets-dev
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: raw
+     app.kubernetes.io/part-of: otomi
+     app.kubernetes.io/version: 0.2.3
+     helm.sh/chart: raw-0.2.3
+ spec:
+   data:
+   - match:
+       remoteRef:
+         property: password
+         remoteKey: grafana-loki-datasource-secret
+       secretKey: adminPassword
+   deletionPolicy: Delete
+   refreshInterval: 1h
+   secretStoreRefs:
+   - name: team-dev-push-store
+     kind: ClusterSecretStore
+   selector:
+     secret:
+       name: loki-secrets

@@ (root level) @@
# external-secrets.io/v1alpha1/PushSecret/apl-secrets/team-dev-pullsecret-push
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1alpha1
+ kind: PushSecret
+ metadata:
+   name: team-dev-pullsecret-push
+   namespace: apl-secrets
+   labels:
+     app: raw
+     app.kubernetes.io/instance: team-secrets-dev
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: raw
+     app.kubernetes.io/part-of: otomi
+     app.kubernetes.io/version: 0.2.3
+     helm.sh/chart: raw-0.2.3
+ spec:
+   data:
+   - match:
+       remoteRef:
+         property: .dockerconfigjson
+         remoteKey: otomi-pullsecret-global
+       secretKey: .dockerconfigjson
+   deletionPolicy: Delete
+   refreshInterval: 1h
+   secretStoreRefs:
+   - name: team-dev-push-store
+     kind: ClusterSecretStore
+   selector:
+     secret:
+       name: team-dev-pullsecret-composite

# values-repo.yaml