Skip to content

Commit 3a0f5c8

Browse files
PacobartPacobart
authored
Feat/external secrets irsa (#889)
Co-authored-by: Parker Barthlome <[email protected]>
1 parent 514b4fd commit 3a0f5c8

File tree

10 files changed

+124
-28
lines changed

10 files changed

+124
-28
lines changed

‎examples/analytics/airflow-on-eks/main.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -303,8 +303,8 @@ module "airflow_s3_bucket" {
303303
# Apache Airflow Postgres Metastore DB Master password
304304
#---------------------------------------------------------------
305305
resource "random_password" "postgres" {
306-
length = 16
307-
special = false
306+
length = 16
307+
special = false
308308
}
309309
#tfsec:ignore:aws-ssm-secret-use-customer-key
310310
resource "aws_secretsmanager_secret" "postgres" {

‎modules/kubernetes-addons/README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -188,6 +188,9 @@
188188
| <a name="input_external_dns_private_zone"></a> [external\_dns\_private\_zone](#input\_external\_dns\_private\_zone) | Determines if referenced Route53 zone is private. | `bool` | `false` | no |
189189
| <a name="input_external_dns_route53_zone_arns"></a> [external\_dns\_route53\_zone\_arns](#input\_external\_dns\_route53\_zone\_arns) | List of Route53 zones ARNs which external-dns will have access to create/manage records | `list(string)` | `[]` | no |
190190
| <a name="input_external_secrets_helm_config"></a> [external\_secrets\_helm\_config](#input\_external\_secrets\_helm\_config) | External Secrets operator Helm Chart config | `any` | `{}` | no |
191+
| <a name="input_external_secrets_irsa_policies"></a> [external\_secrets\_irsa\_policies](#input\_external\_secrets\_irsa\_policies) | Additional IAM policies for a IAM role for service accounts | `list(string)` | `[]` | no |
192+
| <a name="input_external_secrets_secrets_manager_arns"></a> [external\_secrets\_secrets\_manager\_arns](#input\_external\_secrets\_secrets\_manager\_arns) | List of Secrets Manager ARNs that contain secrets to mount using External Secrets | `list(string)` | <pre>[<br> "arn:aws:secretsmanager:*:*:secret:*"<br>]</pre> | no |
193+
| <a name="input_external_secrets_ssm_parameter_arns"></a> [external\_secrets\_ssm\_parameter\_arns](#input\_external\_secrets\_ssm\_parameter\_arns) | List of Systems Manager Parameter ARNs that contain secrets to mount using External Secrets | `list(string)` | <pre>[<br> "arn:aws:ssm:*:*:parameter/*"<br>]</pre> | no |
191194
| <a name="input_fargate_fluentbit_addon_config"></a> [fargate\_fluentbit\_addon\_config](#input\_fargate\_fluentbit\_addon\_config) | Fargate fluentbit add-on config | `any` | `{}` | no |
192195
| <a name="input_grafana_helm_config"></a> [grafana\_helm\_config](#input\_grafana\_helm\_config) | Kubernetes Grafana Helm Chart config | `any` | `null` | no |
193196
| <a name="input_grafana_irsa_policies"></a> [grafana\_irsa\_policies](#input\_grafana\_irsa\_policies) | IAM policy ARNs for grafana IRSA | `list(string)` | `[]` | no |

‎modules/kubernetes-addons/external-secrets/README.md

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,13 @@ External Secrets Operator is a Kubernetes operator that integrates external secr
88
| Name | Version |
99
|------|---------|
1010
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
11-
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.10 |
11+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.72 |
1212

1313
## Providers
1414

1515
| Name | Version |
1616
|------|---------|
17-
| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | >= 2.10 |
17+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.72 |
1818

1919
## Modules
2020

@@ -26,14 +26,18 @@ External Secrets Operator is a Kubernetes operator that integrates external secr
2626

2727
| Name | Type |
2828
|------|------|
29-
| [kubernetes_namespace_v1.this](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace_v1) | resource |
29+
| [aws_iam_policy.external_secrets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
30+
| [aws_iam_policy_document.external_secrets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
3031

3132
## Inputs
3233

3334
| Name | Description | Type | Default | Required |
3435
|------|-------------|------|---------|:--------:|
35-
| <a name="input_addon_context"></a> [addon\_context](#input\_addon\_context) | Input configuration for the addon | <pre>object({<br> aws_caller_identity_account_id = string<br> aws_caller_identity_arn = string<br> aws_eks_cluster_endpoint = string<br> aws_partition_id = string<br> aws_region_name = string<br> eks_cluster_id = string<br> eks_oidc_issuer_url = string<br> eks_oidc_provider_arn = string<br> tags = map(string)<br> })</pre> | n/a | yes |
36+
| <a name="input_addon_context"></a> [addon\_context](#input\_addon\_context) | Input configuration for the addon | <pre>object({<br> aws_caller_identity_account_id = string<br> aws_caller_identity_arn = string<br> aws_eks_cluster_endpoint = string<br> aws_partition_id = string<br> aws_region_name = string<br> eks_cluster_id = string<br> eks_oidc_issuer_url = string<br> eks_oidc_provider_arn = string<br> tags = map(string)<br> irsa_iam_role_path = string<br> irsa_iam_permissions_boundary = string<br> })</pre> | n/a | yes |
37+
| <a name="input_external_secrets_secrets_manager_arns"></a> [external\_secrets\_secrets\_manager\_arns](#input\_external\_secrets\_secrets\_manager\_arns) | List of Secrets Manager ARNs that contain secrets to mount using External Secrets | `list(string)` | <pre>[<br> "arn:aws:secretsmanager:*:*:secret:*"<br>]</pre> | no |
38+
| <a name="input_external_secrets_ssm_parameter_arns"></a> [external\_secrets\_ssm\_parameter\_arns](#input\_external\_secrets\_ssm\_parameter\_arns) | List of Systems Manager Parameter ARNs that contain secrets to mount using External Secrets | `list(string)` | <pre>[<br> "arn:aws:ssm:*:*:parameter/*"<br>]</pre> | no |
3639
| <a name="input_helm_config"></a> [helm\_config](#input\_helm\_config) | Helm provider config for External Secrets Operator | `any` | `{}` | no |
40+
| <a name="input_irsa_policies"></a> [irsa\_policies](#input\_irsa\_policies) | Additional IAM policies for a IAM role for service accounts | `list(string)` | `[]` | no |
3741
| <a name="input_manage_via_gitops"></a> [manage\_via\_gitops](#input\_manage\_via\_gitops) | Determines if the add-on should be managed via GitOps | `bool` | `false` | no |
3842

3943
## Outputs

‎modules/kubernetes-addons/external-secrets/data.tf

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
data "aws_iam_policy_document" "external_secrets" {
2+
statement {
3+
actions = ["ssm:GetParameter"]
4+
resources = var.external_secrets_ssm_parameter_arns
5+
}
6+
7+
statement {
8+
actions = [
9+
"secretsmanager:GetResourcePolicy",
10+
"secretsmanager:GetSecretValue",
11+
"secretsmanager:DescribeSecret",
12+
"secretsmanager:ListSecretVersionIds",
13+
]
14+
resources = var.external_secrets_secrets_manager_arns
15+
}
16+
}

‎modules/kubernetes-addons/external-secrets/locals.tf

Lines changed: 39 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
locals {
2-
name = "external-secrets"
2+
name = "external-secrets"
3+
service_account_name = "${local.name}-sa"
34

45
default_helm_config = {
56
name = local.name
@@ -17,7 +18,43 @@ locals {
1718
var.helm_config
1819
)
1920

21+
set_values = [
22+
{
23+
name = "serviceAccount.name"
24+
value = local.service_account_name
25+
},
26+
{
27+
name = "serviceAccount.create"
28+
value = false
29+
},
30+
{
31+
name = "webhook.serviceAccount.name"
32+
value = local.service_account_name
33+
},
34+
{
35+
name = "webhook.serviceAccount.create"
36+
value = false
37+
},
38+
{
39+
name = "certController.serviceAccount.name"
40+
value = local.service_account_name
41+
},
42+
{
43+
name = "certController.serviceAccount.create"
44+
value = false
45+
}
46+
]
47+
48+
irsa_config = {
49+
kubernetes_namespace = local.helm_config["namespace"]
50+
kubernetes_service_account = local.service_account_name
51+
create_kubernetes_namespace = try(local.helm_config["create_namespace"], true)
52+
create_kubernetes_service_account = true
53+
irsa_iam_policies = concat([aws_iam_policy.external_secrets.arn], var.irsa_policies)
54+
}
55+
2056
argocd_gitops_config = {
21-
enable = true
57+
enable = true
58+
serviceAccountName = local.service_account_name
2259
}
2360
}

‎modules/kubernetes-addons/external-secrets/main.tf

Lines changed: 7 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,15 @@
11
module "helm_addon" {
22
source = "../helm-addon"
33
manage_via_gitops = var.manage_via_gitops
4+
set_values = local.set_values
45
helm_config = local.helm_config
5-
irsa_config = null
6+
irsa_config = local.irsa_config
67
addon_context = var.addon_context
7-
8-
depends_on = [kubernetes_namespace_v1.this]
98
}
109

11-
resource "kubernetes_namespace_v1" "this" {
12-
count = try(local.helm_config["create_namespace"], true) && local.helm_config["namespace"] != "kube-system" ? 1 : 0
13-
metadata {
14-
name = local.helm_config["namespace"]
15-
16-
labels = {
17-
"app.kubernetes.io/managed-by" = "terraform-aws-eks-blueprints"
18-
}
19-
}
10+
resource "aws_iam_policy" "external_secrets" {
11+
name = "${var.addon_context.eks_cluster_id}-${local.helm_config["name"]}-irsa"
12+
path = var.addon_context.irsa_iam_role_path
13+
description = "Provides permissions to for External Secrets to retrieve secrets from AWS SSM and AWS Secrets Manager"
14+
policy = data.aws_iam_policy_document.external_secrets.json
2015
}

‎modules/kubernetes-addons/external-secrets/variables.tf

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,14 @@ variable "manage_via_gitops" {
1010
description = "Determines if the add-on should be managed via GitOps"
1111
}
1212

13+
variable "irsa_policies" {
14+
description = "Additional IAM policies for a IAM role for service accounts"
15+
type = list(string)
16+
default = []
17+
}
18+
1319
variable "addon_context" {
20+
description = "Input configuration for the addon"
1421
type = object({
1522
aws_caller_identity_account_id = string
1623
aws_caller_identity_arn = string
@@ -21,6 +28,19 @@ variable "addon_context" {
2128
eks_oidc_issuer_url = string
2229
eks_oidc_provider_arn = string
2330
tags = map(string)
31+
irsa_iam_role_path = string
32+
irsa_iam_permissions_boundary = string
2433
})
25-
description = "Input configuration for the addon"
34+
}
35+
36+
variable "external_secrets_ssm_parameter_arns" {
37+
description = "List of Systems Manager Parameter ARNs that contain secrets to mount using External Secrets"
38+
type = list(string)
39+
default = ["arn:aws:ssm:*:*:parameter/*"]
40+
}
41+
42+
variable "external_secrets_secrets_manager_arns" {
43+
description = "List of Secrets Manager ARNs that contain secrets to mount using External Secrets"
44+
type = list(string)
45+
default = ["arn:aws:secretsmanager:*:*:secret:*"]
2646
}

‎modules/kubernetes-addons/external-secrets/versions.tf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ terraform {
22
required_version = ">= 1.0.0"
33

44
required_providers {
5-
kubernetes = {
6-
source = "hashicorp/kubernetes"
7-
version = ">= 2.10"
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 3.72"
88
}
99
}
1010
}

‎modules/kubernetes-addons/main.tf

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -490,8 +490,11 @@ module "kuberay_operator" {
490490
}
491491

492492
module "external_secrets" {
493-
count = var.enable_external_secrets ? 1 : 0
494-
source = "./external-secrets"
495-
helm_config = var.external_secrets_helm_config
496-
addon_context = local.addon_context
493+
count = var.enable_external_secrets ? 1 : 0
494+
source = "./external-secrets"
495+
helm_config = var.external_secrets_helm_config
496+
addon_context = local.addon_context
497+
irsa_policies = var.external_secrets_irsa_policies
498+
external_secrets_ssm_parameter_arns = var.external_secrets_ssm_parameter_arns
499+
external_secrets_secrets_manager_arns = var.external_secrets_secrets_manager_arns
497500
}

‎modules/kubernetes-addons/variables.tf

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -965,6 +965,24 @@ variable "external_secrets_helm_config" {
965965
description = "External Secrets operator Helm Chart config"
966966
}
967967

968+
variable "external_secrets_irsa_policies" {
969+
description = "Additional IAM policies for a IAM role for service accounts"
970+
type = list(string)
971+
default = []
972+
}
973+
974+
variable "external_secrets_ssm_parameter_arns" {
975+
description = "List of Systems Manager Parameter ARNs that contain secrets to mount using External Secrets"
976+
type = list(string)
977+
default = ["arn:aws:ssm:*:*:parameter/*"]
978+
}
979+
980+
variable "external_secrets_secrets_manager_arns" {
981+
description = "List of Secrets Manager ARNs that contain secrets to mount using External Secrets"
982+
type = list(string)
983+
default = ["arn:aws:secretsmanager:*:*:secret:*"]
984+
}
985+
968986
#-----------Grafana ADDON-------------
969987
variable "enable_grafana" {
970988
description = "Enable Grafana add-on"

0 commit comments

Comments
 (0)