Add RBAC roles for ESO

components/argocd/annotations/kustomization.yaml

@@ -99,7 +99,7 @@ patches:
         value:
           argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
           argocd.argoproj.io/sync-wave: "-5"
-  # --- Wave 1: MetalLB, network policies, and Vault connection ---
+  # --- Wave 1: MetalLB, network policies, Vault connection, and ESO config ---
   - target:
       kind: MetalLB
     patch: |-
@@ -108,6 +108,22 @@ patches:
         value:
           argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
           argocd.argoproj.io/sync-wave: "1"
+  - target:
+      kind: NetworkPolicy
+    patch: |-
+      - op: add
+        path: /metadata/annotations
+        value:
+          argocd.argoproj.io/sync-wave: "1"
+  - target:
+      group: operator.openshift.io
+      kind: ExternalSecretsConfig
+    patch: |-
+      - op: add
+        path: /metadata/annotations
+        value:
+          argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+          argocd.argoproj.io/sync-wave: "1"
   - target:
       group: nmstate.io
       version: v1

components/secrets/external-secrets-operator/redhat/external-secrets-namespace.yaml

@@ -0,0 +1,8 @@
+---
+# Explicitly create the external-secrets namespace so the allow-vault-egress
+# NetworkPolicy (wave 2) can always find it, regardless of ESO operator timing.
+# The ESO operator will use this existing namespace when deploying its pods.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: external-secrets

components/secrets/external-secrets-operator/redhat/externalsecretsconfig.yaml

@@ -0,0 +1,10 @@
+---
+# ExternalSecretsConfig is required by the Red Hat External Secrets Operator (RHESO)
+# to deploy the actual ESO controller pods (external-secrets, webhook, cert-controller).
+# Sync wave and SkipDryRunOnMissingResource are managed centrally via
+# components/argocd/annotations/kustomization.yaml.
+apiVersion: operator.openshift.io/v1alpha1
+kind: ExternalSecretsConfig
+metadata:
+  name: cluster
+spec: {}

components/secrets/external-secrets-operator/redhat/kustomization.yaml

@@ -4,6 +4,9 @@ kind: Component
 resources:
   - namespace.yaml
   - operatorgroup.yaml
+  - external-secrets-namespace.yaml
+  - vault-egress-netpol.yaml
+  - externalsecretsconfig.yaml
 components:
   - ../community
 patches:

components/secrets/external-secrets-operator/redhat/vault-egress-netpol.yaml

@@ -0,0 +1,27 @@
+---
+# Allow ESO pods to reach Vault on port 8200.
+# The RHESO operator creates a deny-all-traffic NetworkPolicy by default,
+# so egress to Vault must be explicitly permitted.
+# Replace the cidr below with your Vault server's network CIDR to restrict
+# egress to only the network segment where Vault resides.
+# The external-secrets namespace is pre-created explicitly (external-secrets-namespace.yaml)
+# to ensure this NetworkPolicy can be applied without timing issues.
+# Sync wave is managed centrally via components/argocd/annotations/kustomization.yaml.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-vault-egress
+  namespace: external-secrets
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: external-secrets
+  policyTypes:
+  - Egress
+  egress:
+  - to:
+    - ipBlock:
+        cidr: 0.0.0.0/0
+    ports:
+    - protocol: TCP
+      port: 8200

openshift-gitops.deploy/enable/clusterrole.yaml

@@ -90,6 +90,27 @@ rules:
       - 'vaultauths'
     verbs:
       - '*'
+  - apiGroups:
+      - external-secrets.io
+    resources:
+      - 'externalsecrets'
+      - 'secretstores'
+      - 'clustersecretstores'
+    verbs:
+      - '*'
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - 'networkpolicies'
+    verbs:
+      - '*'
+  - apiGroups:
+      - operator.openshift.io
+    resources:
+      - 'externalsecretsconfigs'
+      - 'externalsecretsmanagers'
+    verbs:
+      - '*'
   - apiGroups:
       - operator.openstack.org
     resources: