Store Longhorn Encryption Secrets in Vault with pushSecrets for mgmt cluster

closes #3403 (closed)

in vault it's stored under /data in longhorn-encryption/<namespace>/enc-vol-<pvc-name>

all the corresponding pushSecrets are created , data is stored in vault : Artifacts · deploy-management-cluster (#15572577833) · Jobs · Sylva-projects / sylva-core · GitLab

NAMESPACE                 NAME                                                                         AGE   STATUS   LAST SYNC
cattle-resources-system   enc-vol-rancher-backup-restore-operator-1                                    22m   Synced   22m
harbor                    enc-vol-cnpg-harbor-1                                                        14m   Synced   14m
harbor                    enc-vol-cnpg-harbor-2                                                        13m   Synced   13m
harbor                    enc-vol-cnpg-harbor-3                                                        11m   Synced   11m
harbor                    enc-vol-data-harbor-redis-0                                                  10m   Synced   10m
harbor                    enc-vol-harbor-jobservice                                                    10m   Synced   10m
harbor                    enc-vol-harbor-registry                                                      10m   Synced   10m
keycloak                  enc-vol-keycloak-postgresql-1                                                22m   Synced   22m
keycloak                  enc-vol-keycloak-postgresql-2                                                22m   Synced   22m
keycloak                  enc-vol-keycloak-postgresql-3                                                22m   Synced   22m
longhorn-system           enc-vol-encrypted-longhorn-pvc-test                                          22m   Synced   22m
metal3-system             enc-vol-ironic-shared-volume                                                 22m   Synced   22m
os-images                 enc-vol-os-image-server-ubuntu-noble-hardened-kubeadm-1-34-aeee39-aeee3938   22m   Synced   22m
os-images                 enc-vol-os-image-server-ubuntu-noble-hardened-kubeadm-1-35-57128a-57128a1c   22m   Synced   22m
pushgateway               enc-vol-prometheus-pushgateway                                               11m   Synced   11m
vault                     enc-vol-vault-raft-vault-0                                                   22m   Synced   22m
vault                     enc-vol-vault-raft-vault-1                                                   22m   Synced   22m
vault                     enc-vol-vault-raft-vault-2                                                   22m   Synced   22m

~~for wkld cluster : ~~Artifacts · deploy-workload-cluster (#15572578164) · Jobs · Sylva-projects / sylva-core · GitLab

removed for wkld cluster and raised a follow-up issue #4518

CI configuration

Below you can choose test deployment variants to run in this MR's CI.

Click to open to CI configuration

Legend:

Icon	Meaning	Available values
☁️	Infra Provider	capd, capo, capm3
🚀	Bootstrap Provider	kubeadm (alias kadm), rke2, okd, ck8s
🐧	Node OS	ubuntu, suse, na, leapmicro
🛠️	Deployment Options	Deployment option list and description
🎬	Pipeline Scenarios	Available scenario list and description
🟢	Enabled units	Any available units name, by default apply to management and workload cluster. Can be prefixed by mgmt: or wkld: to be applied only to a specific cluster type
🔴	Disabled units	Any available units name, by default apply to management and workload cluster. Can be prefixed by mgmt: or wkld: to be applied only to a specific cluster type
🏗️	Target platform	Can be used to select specific deployment environment Available platform list and description
⚡	Pipeline control	autorun, manual or blocking. Can be used to override global config and start a deployment pipeline the required way

• 🎬 preview ☁️ capd 🚀 kadm 🐧 ubuntu
• 🎬 preview ☁️ capo 🚀 rke2 🐧 suse
• 🎬 preview ☁️ capm3 🚀 rke2 🐧 ubuntu
• ☁️ capd 🚀 kadm 🛠️ light-deploy 🐧 ubuntu
• ☁️ capd 🚀 rke2 🛠️ light-deploy 🐧 suse
• ☁️ capo 🚀 rke2 🐧 suse
• ☁️ capo 🚀 rke2 🐧 leapmicro
• ☁️ capo 🚀 kadm 🐧 ubuntu
• ☁️ capo 🚀 kadm 🐧 ubuntu 🟢 neuvector,mgmt:harbor
• ☁️ capo 🚀 rke2 🎬 rolling-update 🛠️ ha 🐧 ubuntu
• ☁️ capo 🚀 kadm 🎬 wkld-k8s-upgrade 🐧 ubuntu
• ☁️ capo 🚀 rke2 🎬 rolling-update-no-wkld 🛠️ ha 🐧 suse
• ☁️ capo 🚀 rke2 🎬 sylva-upgrade 🛠️ ha 🐧 ubuntu
• ☁️ capo 🚀 rke2 🎬 sylva-upgrade-from-1.6.x 🛠️ ha,misc 🐧 ubuntu
• ☁️ capo 🚀 rke2 🛠️ ha,misc 🐧 ubuntu
• ☁️ capo 🚀 rke2 🛠️ misc 🐧 ubuntu 🟢 mgmt:harbor 🔴 neuvector
• ☁️ capo 🚀 rke2 🛠️ ha,misc,openbao 🐧 suse
• ☁️ capo 🚀 rke2 🐧 suse 🎬 upgrade-from-prev-tag
• ☁️ capm3 🚀 rke2 🐧 suse 🛠️ encryption 🟢 mgmt:vault
• ☁️ capm3 🚀 kadm 🐧 ubuntu 🛠️ encryption 🟢 mgmt:vault
• ☁️ capm3 🚀 ck8s 🐧 ubuntu 🛠️ encryption
• ☁️ capm3 🚀 kadm 🎬 rolling-update-no-wkld 🛠️ ha,misc 🐧 ubuntu
• ☁️ capm3 🚀 rke2 🎬 wkld-k8s-upgrade 🛠️ ha 🐧 suse
• ☁️ capm3 🚀 kadm 🎬 rolling-update 🛠️ ha 🐧 ubuntu
• ☁️ capm3 🚀 rke2 🎬 upgrade-from-prev-release-branch 🛠️ ha 🐧 suse
• ☁️ capm3 🚀 rke2 🛠️ misc,ha 🐧 suse
• ☁️ capm3 🚀 rke2 🎬 sylva-upgrade 🛠️ ha,misc 🐧 suse
• ☁️ capm3 🚀 kadm 🎬 rolling-update 🛠️ ha 🐧 suse
• ☁️ capm3 🚀 ck8s 🎬 rolling-update 🛠️ ha 🐧 ubuntu
• ☁️ capm3 🚀 rke2|okd 🎬 no-update 🐧 ubuntu|na
• ☁️ capm3 🚀 rke2 🐧 suse 🎬 upgrade-from-release-1.5
• ☁️ capm3 🚀 rke2 🐧 suse 🎬 upgrade-to-main

Global config for deployment pipelines

• autorun pipelines

• allow failure on pipelines

• record sylvactl events

Notes:

• Enabling autorun will make deployment pipelines to be run automatically without human interaction
• Disabling allow failure will make deployment pipelines mandatory for pipeline success.
• if both autorun and allow failure are disabled, deployment pipelines will need manual triggering but will be blocking the pipeline

Be aware: after configuration change, pipeline is not triggered automatically. Please run it manually (by clicking the run pipeline button in Pipelines tab) or push new code.