docs(security): add opt-in Manual installPlanApproval overlays (FIND-010)

components/secrets/external-secrets-operator/manual-approval/kustomization.yaml

@@ -0,0 +1,44 @@
+---
+# Opt-in overlay: switch the ESO subscription to Manual installPlanApproval.
+#
+# Include this component AFTER the base ESO component (community or redhat)
+# to override installPlanApproval from Automatic to Manual and pin a
+# specific startingCSV.
+#
+# Manual approval means OLM will not install a new operator version until
+# an administrator (or automation) explicitly approves the InstallPlan.
+# This provides change-control over operator upgrades at the cost of
+# requiring an approval step on every new version.
+#
+# NOTE: When using Manual approval you must ensure InstallPlans are approved
+# before the operator can install or upgrade. Options:
+#   - Approve manually: oc patch installplan <name> -n <ns> --type merge
+#       -p '{"spec":{"approved":true}}'
+#   - Or implement an automated approval Job (see the pattern in
+#     components/utilities/approve-installplan for the openstack-operator).
+#
+# Usage in a consumer kustomization:
+#   components:
+#     - https://github.com/openstack-k8s-operators/gitops/components/secrets/external-secrets-operator/redhat?ref=<tag>
+#     - https://github.com/openstack-k8s-operators/gitops/components/secrets/external-secrets-operator/manual-approval?ref=<tag>
+#
+# Remember to update startingCSV to the version currently running in your
+# cluster before switching to Manual. Query with:
+#   oc get subscription openshift-external-secrets-operator -n external-secrets-operator \
+#     -o jsonpath='{.status.currentCSV}'
+
+# ---- EXAMPLE — uncomment and fill in before using ----
+#
+# apiVersion: kustomize.config.k8s.io/v1alpha1
+# kind: Component
+# patches:
+#   - target:
+#       kind: Subscription
+#       name: external-secrets-operator
+#     patch: |-
+#       - op: replace
+#         path: /spec/installPlanApproval
+#         value: Manual
+#       - op: add
+#         path: /spec/startingCSV
+#         value: openshift-external-secrets-operator.v<VERSION>   # replace with current CSV

components/secrets/vault-secrets-operator/manual-approval/kustomization.yaml

@@ -0,0 +1,33 @@
+---
+# Opt-in overlay: switch the VSO subscription to Manual installPlanApproval.
+#
+# Include this component AFTER the base VSO component to override
+# installPlanApproval from Automatic to Manual and pin a specific startingCSV.
+#
+# See components/secrets/external-secrets-operator/manual-approval/kustomization.yaml
+# for full usage notes and approval options.
+#
+# Query your currently installed CSV:
+#   oc get subscription vault-secrets-operator -n openshift-operators \
+#     -o jsonpath='{.status.currentCSV}'
+#
+# Usage in a consumer kustomization:
+#   components:
+#     - https://github.com/openstack-k8s-operators/gitops/components/secrets/vault-secrets-operator?ref=<tag>
+#     - https://github.com/openstack-k8s-operators/gitops/components/secrets/vault-secrets-operator/manual-approval?ref=<tag>
+
+# ---- EXAMPLE — uncomment and fill in before using ----
+#
+# apiVersion: kustomize.config.k8s.io/v1alpha1
+# kind: Component
+# patches:
+#   - target:
+#       kind: Subscription
+#       name: vault-secrets-operator
+#     patch: |-
+#       - op: replace
+#         path: /spec/installPlanApproval
+#         value: Manual
+#       - op: add
+#         path: /spec/startingCSV
+#         value: vault-secrets-operator.v<VERSION>   # replace with current CSV