diff --git a/quickstarts/install-cert-manager.yaml b/quickstarts/install-cert-manager.yaml new file mode 100644 index 0000000000..47c7f6db11 --- /dev/null +++ b/quickstarts/install-cert-manager.yaml @@ -0,0 +1,100 @@ +apiVersion: console.openshift.io/v1 +kind: ConsoleQuickStart +metadata: + name: install-cert-manager + annotations: + include.release.openshift.io/ibm-cloud-managed: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + capability.openshift.io/name: Console +spec: + accessReviewResources: + - group: operators.coreos.com + resource: operatorgroups + verb: list + - group: packages.operators.coreos.com + resource: packagemanifests + verb: list + displayName: Install the cert-manager Operator for Red Hat OpenShift + durationMinutes: 5 + description: >- + Install the cert-manager Operator for Red Hat OpenShift to manage TLS + certificates from an external PKI. + tags: + - security + - certificates + - tls + introduction: |- + ### In this quick start, you'll install the cert-manager Operator for Red Hat OpenShift to manage TLS certificates in your cluster. + + The cert-manager Operator enables you to create and sign TLS certificates from an external PKI for your workloads + running on an OpenShift cluster. It provides Kubernetes-native certificate management capabilities that + integrate seamlessly with your cluster's security infrastructure. + + ### What is cert-manager? + + cert-manager adds certificates and certificate issuers as resource types in OpenShift clusters and simplifies + the process of obtaining, renewing and using those certificates. + + ### Usage + + You can use an **Issuer** or **ClusterIssuer** to define what will be issuing the certificates, and a **Certificate** + resource to define what the contents of the certificate should contain. cert-manager supports various certificate + authorities including Let's Encrypt, HashiCorp Vault, Venafi, self-signed certificates etc. + tasks: + - title: Install the cert-manager Operator for Red Hat OpenShift + description: |- + ### To install the cert-manager Operator: + + 1. Go to the **Software Catalog** from the [Ecosystem]{{highlight qs-nav-ecosystem}} section of the navigation. + + 2. In the **Filter by keyword** field, type `cert-manager`. + + 3. Look for **cert-manager Operator for Red Hat OpenShift**. If the tile has an **Installed** label on it, the Operator is already installed. You can close this quick start. + + 4. Click the tile to open the side panel. + + 5. At the top of the side panel, click **Install**. + + 6. On the Install Operator page, ensure the **Update Channel** is set to the latest stable version. + + 7. Click **Install** to begin the installation process. + + 8. Wait for the cert-manager Operator's status to change from **Installing operator** to **Operator installed - Ready for use**. + review: + instructions: |- + #### Verify the cert-manager Operator was successfully installed: + + 1. Navigate to **Ecosystem** → **Installed Operators** from the [Ecosystem]{{highlight qs-nav-ecosystem}} section. + + 2. Look for **cert-manager Operator for Red Hat OpenShift** in the list. + + 3. In the Status column, is the cert-manager Operator's status **Succeeded**? + + To verify the pods are running: + + 1. Navigate to **Workloads** → **Pods** from the [Workloads]{{highlight qs-nav-workloads}} section. + + 2. In the **Project** dropdown menu at the top, select **cert-manager**. + + 3. Verify that the following pods are in **Running** status: + - cert-manager + - cert-manager-cainjector + - cert-manager-webhook + failedTaskHelp: >- + This task isn't verified yet. Try the task again, or [read + more](https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/cert-manager-operator-for-red-hat-openshift) + about installing the cert-manager Operator. + summary: + success: >- + You just installed the cert-manager Operator for Red Hat OpenShift! + You can now create Issuers and Certificates to manage TLS certificates + for your workloads. + failed: >- + This task is incomplete. Try the task again, or read more about this + topic. + conclusion: >- + Your cert-manager Operator is ready! You can now create certificate issuers + and certificates to secure your applications. To learn more about using + cert-manager, refer to the [OpenShift documentation](https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/cert-manager-operator-for-red-hat-openshift). + nextQuickStart: [] diff --git a/quickstarts/install-external-secrets-operator.yaml b/quickstarts/install-external-secrets-operator.yaml new file mode 100644 index 0000000000..ee4978a1ad --- /dev/null +++ b/quickstarts/install-external-secrets-operator.yaml @@ -0,0 +1,149 @@ +apiVersion: console.openshift.io/v1 +kind: ConsoleQuickStart +metadata: + name: install-external-secrets-operator + annotations: + include.release.openshift.io/ibm-cloud-managed: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + capability.openshift.io/name: Console +spec: + accessReviewResources: + - group: operators.coreos.com + resource: operatorgroups + verb: list + - group: packages.operators.coreos.com + resource: packagemanifests + verb: list + displayName: Install the External Secrets Operator for Red Hat OpenShift + durationMinutes: 10 + description: >- + Install the External Secrets Operator for Red Hat OpenShift to synchronize secrets from external + secret management systems into OpenShift. + tags: + - security + - secrets + - vault + - integration + introduction: |- + ### In this quick start, you'll install the External Secrets Operator for Red Hat OpenShift to manage secrets from external sources. + + The External Secrets Operator for Red Hat OpenShift is a OpenShift operator that integrates external secret management systems like + HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, Google Secret Manager and more. + It reads information from external APIs and automatically injects the values into a Kubernetes Secret. + + + ### Usage + + You can use a **SecretStore** or **ClusterSecretStore** to define how to connect to your external secrets manager, + and use an **ExternalSecret** resource to define which secrets to pull and where to place them in your OpenShift cluster. + tasks: + - title: Install the External Secrets Operator for Red Hat OpenShift + description: |- + ### To install the External Secrets Operator: + + 1. Go to the **Software Catalog** from the [Ecosystem]{{highlight qs-nav-ecosystem}} section of the navigation. + + 2. In the **Filter by keyword** field, type `External Secrets`. + + 3. Look for **External Secrets Operator for Red Hat OpenShift**. If the tile has an **Installed** label on it, the Operator is already installed. Proceed to task two. + + 4. Click the tile to open the side panel. + + 5. At the top of the side panel, click **Install**. + + 6. On the Install Operator page, ensure the **Update Channel** is set to the latest stable version. + + 7. Select the installation mode and namespace. The default **All namespaces on the cluster** is recommended. + + 8. Click **Install** to begin the installation process. + + 9. Wait for the External Secrets Operator for Red Hat OpenShift's status to change from **Installing operator** to **Operator installed - Ready for use**. + review: + instructions: |- + #### Verify the External Secrets Operator was successfully installed: + + 1. Navigate to **Ecosystem** → **Installed Operators** from the [Ecosystem]{{highlight qs-nav-ecosystem}} section. + + 2. Look for **External Secrets Operator for Red Hat OpenShift** in the list. + + 3. In the Status column, is the External Secrets Operator for Red Hat OpenShift's status **Succeeded**? + failedTaskHelp: >- + This task isn't verified yet. Try the task again, or [read + more](https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/external-secrets-operator-for-red-hat-openshift) + about installing the External Secrets Operator. + summary: + success: >- + You just installed the External Secrets Operator for Red Hat OpenShift! Next, we'll deploy + the ExternalSecretsConfig to activate the operator components. + failed: >- + This task is incomplete. Try the task again, or read more about this + topic. + - title: Deploy the ExternalSecretsConfig custom resource + description: |- + ### What is ExternalSecretsConfig? + + Installing the External Secrets Operator for Red Hat OpenShift provides you with the necessary APIs to deploy the ExternalSecrets operand. + When an ExternalSecretsConfig CR is deployed, a new Deployment is created that manages the external-secrets singleton and + keeps it in the desired state. + + ### To deploy the ExternalSecretsConfig custom resource: + + 1. Navigate to **Ecosystem** → **Installed Operators** from the [Ecosystem]{{highlight qs-nav-ecosystem}} section. + + 2. Click on **External Secrets Operator for Red Hat OpenShift** from the list. + + 3. Find the **ExternalSecretsConfig** custom resource in the **Provided APIs** list or in the top side-scrolling menu bar. + - From the list of **Provided APIs** click the **Create instance** link + - From the **top side-scrolling menu bar** click **ExternalSecretsConfig** and then click **Create ExternalSecretsConfig** + + 4. For this quick start, you can use the default configurations for the ExternalSecretsConfig deployment, including an allow-all egress policy. + - **Note**: An allow-all egress policy is not recommended in production environments. + + 5. Copy the below manifest into the console editor for the ExternalSecretsConfig deployment: + + ```yaml + spec: + controllerConfig: + networkPolicies: + - name: allow-external-secrets-egress + componentName: ExternalSecretsCoreController + egress: + - {} + ``` + + 6. Click **Create** to deploy the ExternalSecretsConfig. + + 7. Wait for the controller pods to start running. + review: + instructions: |- + #### Verify the ExternalSecretsConfig was successfully deployed: + + 1. Navigate to **Workloads** → **Pods** from the [Workloads]{{highlight qs-nav-workloads}} section. + + 2. In the **Project** dropdown menu at the top, select **external-secrets**. + + 3. Verify that the following pods are in **Running** status: + - external-secrets + - external-secrets-cert-controller + - external-secrets-webhook + + Do all pods show a **Running** status? + failedTaskHelp: >- + This task isn't verified yet. Try the task again. If the pods are not + running, check the operator logs for more details. + summary: + success: >- + You have completely deployed the External Secrets Operator for Red Hat OpenShift! You can + now create SecretStores and ExternalSecrets to synchronize secrets + from external sources. Check out the next quick start for a simple + example of how to use the Custom Resources provided by the operator. + failed: >- + This task is incomplete. Check your work to make sure the ExternalSecretsConfig + was created correctly. + conclusion: >- + Your External Secrets Operator for Red Hat OpenShift is ready! You can now configure connections + to external secret management systems and start synchronizing secrets into + your OpenShift cluster. To learn more about using the External Secrets Operator, + refer to the [OpenShift documentation](https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/external-secrets-operator-for-red-hat-openshift). + nextQuickStart: [] diff --git a/quickstarts/install-secrets-store-csi.yaml b/quickstarts/install-secrets-store-csi.yaml new file mode 100644 index 0000000000..57c6a1497b --- /dev/null +++ b/quickstarts/install-secrets-store-csi.yaml @@ -0,0 +1,159 @@ +apiVersion: console.openshift.io/v1 +kind: ConsoleQuickStart +metadata: + name: install-secrets-store-csi + annotations: + include.release.openshift.io/ibm-cloud-managed: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + capability.openshift.io/name: Console +spec: + accessReviewResources: + - group: operators.coreos.com + resource: operatorgroups + verb: list + - group: packages.operators.coreos.com + resource: packagemanifests + verb: list + displayName: Install the Secrets Store CSI Driver Operator + durationMinutes: 10 + description: >- + Install the Secrets Store CSI Driver Operator to mount secrets from external + stores as volumes in your pods. + tags: + - storage + - security + - secrets + - csi + introduction: |- + ### In this quick start, you'll install the Secrets Store CSI Driver Operator to mount secrets from external sources as volumes. + + The Secrets Store CSI Driver Operator allows you to mount secrets, keys, and certificates from external secret + management systems directly into your pods as volumes. This is accomplished using a CSI (Container Storage Interface) + volume, which enables the Kubelet to retrieve the secrets directly from external sources and mount them into the pod. + + ### Why use Secrets Store CSI Driver? + + - **Volume Mounting**: Mount secrets directly as files in your pod's filesystem + - **Provider Integration**: Works with HashiCorp Vault, Azure Key Vault, AWS Secrets Manager, GCP Secret Manager, and more + - **Ephemeral Volumes**: Secrets are only accessible to the pod and are removed when the pod is deleted + - **Sync to Kubernetes Secrets**: Optionally sync mounted secrets to Kubernetes Secret objects + - **Rotation**: Secrets can be automatically updated when they change in the external system + + ### How it works + + You define a **SecretProviderClass** that specifies how to connect to your external secrets manager and which + secrets to retrieve. Then, you reference this SecretProviderClass in your pod's volume definition. When the pod + starts, the CSI driver retrieves the secrets and mounts them into the pod. + tasks: + - title: Install the Secrets Store CSI Driver Operator + description: |- + ### To install the Secrets Store CSI Driver Operator: + + 1. Go to the **Software Catalog** from the [Ecosystem]{{highlight qs-nav-ecosystem}} section of the navigation. + + 2. In the **Filter by keyword** field, type `Secrets Store CSI`. + + 3. Look for **Secrets Store CSI Driver Operator**. If the tile has an **Installed** label on it, the Operator is already installed. Proceed to next task. + + 4. Click the tile to open the side panel. + + 5. At the top of the side panel, click **Install**. + + 6. On the Install Operator page, ensure the **Update Channel** is set to the latest stable version. + + 7. Click **Install** to begin the installation process. The operator will be installed in the **openshift-cluster-csi-drivers** namespace. + + 8. Wait for the Secrets Store CSI Driver Operator's status to change from **Installing operator** to **Operator installed - Ready for use**. + review: + instructions: |- + #### Verify the Secrets Store CSI Driver Operator was successfully installed: + + 1. Navigate to **Ecosystem** → **Installed Operators** from the [Ecosystem]{{highlight qs-nav-ecosystem}} section. + + 2. Look for **Secrets Store CSI Driver Operator** in the list. + + 3. In the Status column, is the Secrets Store CSI Driver Operator's status **Succeeded**? + + To verify the operator pod is running: + + 1. Navigate to **Workloads** → **Pods** from the [Workloads]{{highlight qs-nav-workloads}} section. + + 2. In the **Project** dropdown menu at the top, select **openshift-cluster-csi-drivers**. + + 3. Verify that the **secrets-store-csi-driver-operator** pod is in **Running** status. + failedTaskHelp: >- + This task isn't verified yet. Try the task again, or [read + more](https://docs.openshift.com/container-platform/latest/storage/container_storage_interface/persistent-storage-csi-secrets-store.html) + about installing the Secrets Store CSI Driver Operator. + summary: + success: >- + You just installed the Secrets Store CSI Driver Operator! Next, we'll + deploy the ClusterCSIDriver to activate the CSI driver. + failed: >- + This task is incomplete. Try the task again, or read more about this + topic. + - title: Deploy the ClusterCSIDriver custom resource + description: |- + ### What is ClusterCSIDriver? + + The ClusterCSIDriver custom resource instructs the operator to deploy and manage the Secrets Store CSI driver + on your cluster. Once deployed, the CSI driver will run as a DaemonSet on all nodes, ready to mount secrets + from external sources into your pods. + + ### To deploy the ClusterCSIDriver custom resource: + + 1. Navigate to **CustomResourceDefinitions** from the [Administration]{{highlight qs-nav-administration}} section. + + 2. In the **Search by name** field, type `ClusterCSIDriver`. + + 3. Click on the **ClusterCSIDriver** custom resource definition from the list. + + 4. Click on the **Instances** tab. + + 5. Click **Create ClusterCSIDriver** button. + + 6. In the YAML editor, use the following configuration: + + ```yaml + apiVersion: operator.openshift.io/v1 + kind: ClusterCSIDriver + metadata: + name: secrets-store.csi.k8s.io + spec: + managementState: Managed + ``` + + 7. Click **Create** to deploy the ClusterCSIDriver. + + 8. Wait for the CSI driver pods to be deployed across your cluster nodes. + review: + instructions: |- + #### Verify the ClusterCSIDriver was successfully deployed: + + 1. Navigate to **Workloads** → **DaemonSets** from the [Workloads]{{highlight qs-nav-workloads}} section. + + 2. In the **Project** dropdown menu at the top, select **openshift-cluster-csi-drivers**. + + 3. Look for **csi-secrets-store** and **csi-secrets-store-node** DaemonSets. + + 4. Verify that the desired number of pods matches the current number of pods for each DaemonSet. + + Are all CSI driver pods running successfully? + failedTaskHelp: >- + This task isn't verified yet. Try the task again. Check the operator + logs if the CSI driver pods are not deploying correctly. + summary: + success: >- + You have successfully deployed the Secrets Store CSI Driver! You can + now create SecretProviderClass resources and mount secrets from external + sources as volumes in your pods. + failed: >- + This task is incomplete. Check your work to make sure the ClusterCSIDriver + was created correctly. + conclusion: >- + Your Secrets Store CSI Driver is ready! You can now create SecretProviderClass + resources to define connections to external secret management systems and mount + secrets as volumes in your workloads. To learn more, refer to the + [OpenShift documentation](https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/nodes/working-with-pods#nodes-pods-secrets-store). + nextQuickStart: []