From 91398ad15289cd93705d2bdf7dbc9cbfaee63600 Mon Sep 17 00:00:00 2001
From: OAharoni-RedHat <oaharoni@redhat.com>
Date: Tue, 29 Sep 2026 15:59:06 -0400
Subject: [PATCH] Migrate from golang-external-secrets to External Secrets
 Operator (ESO)

- Replace golang-external-secrets namespace with external-secrets-operator and external-secrets
- Add ESO operator subscription (openshift-external-secrets-operator, stable-v1 channel)
- Replace golang-external-secrets path-based application with openshift-external-secrets Helm chart (0.0.*)
- Follows the same ESO migration pattern as layered-zero-trust

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 values-hub.yaml | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/values-hub.yaml b/values-hub.yaml
index a20a7e2..757c4a8 100644
--- a/values-hub.yaml
+++ b/values-hub.yaml
@@ -5,7 +5,8 @@ clusterGroup:
   namespaces:
     - open-cluster-management
     - vault
-    - golang-external-secrets
+    - external-secrets-operator
+    - external-secrets
     - landing-page
     - coffeeshop-store
     - quarkuscoffeeshop-cicd
@@ -28,6 +29,11 @@ clusterGroup:
       namespace: openshift-operators
       source: certified-operators
 
+    eso:
+      name: openshift-external-secrets-operator
+      namespace: external-secrets-operator
+      channel: stable-v1
+
   projects:
     - hub
     - coffeeshop-store
@@ -51,11 +57,14 @@ clusterGroup:
       project: hub
       path: common/hashicorp-vault
 
-    golang-external-secrets:
-      name: golang-external-secrets
-      namespace: golang-external-secrets
+    openshift-external-secrets:
+      name: openshift-external-secrets
+      namespace: external-secrets
       project: hub
-      path: common/golang-external-secrets
+      chart: openshift-external-secrets
+      chartVersion: 0.0.*
+      annotations:
+        argocd.argoproj.io/sync-wave: "30"
 
     quarkuscoffeeshop-cicd:
       name: quarkuscoffeeshop-cicd