(Doc+) secure settings link K8 docs and note base64 encoded

[stefnestor]

👋🏽 @jlim0930 @paulrossmeier +ECK Dev/Docs,

If I understood y'alls call out from office hours today, this notes that k8 expects values to be base64 encoded by default. Which is a K8 assumption but one our customers ask support about. Also links the related K8 docs for more info for users.

[barkbay]

LGTM!

[barkbay]

Before hitting the merge button, I took a quick look at the rest of our documentation, and I think this is the only place where we do not use stringData, I wonder if we should not change this for consistency? (and because it is less error prone?)

Change still LGTM otherwise...

[stefnestor]

Thanks, @barkbay ! I'm doing the ECK training this week and am ignorant myself on how to fix it. Would you mind suggesting what you'd think it be updated to?

[barkbay]

@stefnestor the idea would be to replace data: with stringData: in the 2 Secrets, and replace the base64 example with a "clear text" sample value, for example:

index 52fec5c61..f22006b4d 100644
--- a/docs/orchestrating-elastic-stack-applications/elasticsearch/es-secure-settings.asciidoc
+++ b/docs/orchestrating-elastic-stack-applications/elasticsearch/es-secure-settings.asciidoc
@@ -32,8 +32,20 @@ kind: Secret
 metadata:
   name: one-secure-settings-secret
 type: Opaque
-data:
-  gcs.client.default.credentials_file: RWxhc3RpYyBDbG91ZCBvbiBLOHMgKEVDSykK
+stringData:
+  gcs.client.default.credentials_file: |
+    {
+      "type": "service_account",
+      "project_id": "your-project-id",
+      "private_key_id": "...",
+      "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n",
+      "client_email": "service-account-for-your-repository@your-project-id.iam.gserviceaccount.com",
+      "client_id": "...",
+      "auth_uri": "https://accounts.google.com/o/oauth2/auth",
+      "token_uri": "https://accounts.google.com/o/oauth2/token",
+      "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
+      "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/your-bucket@your-project-id.iam.gserviceaccount.com"
+    }
 ----


@@ -68,10 +80,46 @@ kind: Secret
 metadata:
   name: gcs-secure-settings
 type: Opaque
-data:
-  gcs.client.default.credentials_file: RWxhc3RpYyBDbG91ZCBvbiBLOHMgKEVDSykK
-  gcs_client_1: RWxhc3RpYyBDbG91ZCBvbiBLOHMgKEVDSykgLSBHQ1MgY2xpZW50IDEK
-  gcs_client_2: RWxhc3RpYyBDbG91ZCBvbiBLOHMgKEVDSykgLSBHQ1MgY2xpZW50IDIK
+stringData:
+  gcs.client.default.credentials_file: |
+    {
+      "type": "service_account",
+      "project_id": "project-id-to-be-used-for-default-client",
+      "private_key_id": "private key ID for default-client",
+      "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n",
+      "client_email": "service-account-for-your-repository@your-project-id.iam.gserviceaccount.com",
+      "client_id": "client ID for the default client",
+      "auth_uri": "https://accounts.google.com/o/oauth2/auth",
+      "token_uri": "https://accounts.google.com/o/oauth2/token",
+      "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
+      "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/your-bucket@your-project-id.iam.gserviceaccount.com"
+    }
+  gcs_client_1: |
+    {
+      "type": "service_account",
+      "project_id": "project-id-to-be-used-for-gcs_client_1",
+      "private_key_id": "private key ID for gcs_client_1",
+      "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n",
+      "client_email": "service-account-for-your-repository@your-project-id.iam.gserviceaccount.com",
+      "client_id": "client ID for the gcs_client_1 client",
+      "auth_uri": "https://accounts.google.com/o/oauth2/auth",
+      "token_uri": "https://accounts.google.com/o/oauth2/token",
+      "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
+      "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/your-bucket@your-project-id.iam.gserviceaccount.com"
+    }
+  gcs_client_2: |
+    {
+      "type": "service_account",
+      "project_id": "project-id-to-be-used-for-gcs_client_2",
+      "private_key_id": "private key ID for gcs_client_2",
+      "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n",
+      "client_email": "service-account-for-your-repository@your-project-id.iam.gserviceaccount.com",
+      "client_id": "client ID for the gcs_client_2 client",
+      "auth_uri": "https://accounts.google.com/o/oauth2/auth",
+      "token_uri": "https://accounts.google.com/o/oauth2/token",
+      "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
+      "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/your-bucket@your-project-id.iam.gserviceaccount.com"
+    }
 ----

(I replaced the base64 value of Elastic Cloud on K8s (ECK) by what a JSON service account file looks like in GCP to have more realistic examples and show how to use multiple lines in yaml)

[stefnestor]

Awesome, cheers 😄! Example added to PR 👌.

@kilfoyle as long as it builds, I believe this is ready for you again 🙏

[kilfoyle]

@elasticmachine run docs-build