Skip to content

Commit f45b1c8

Browse files
vara-bonthubryantbiggs
vara-bonthu
and
bryantbiggs
authored
ArgoCD admin password update (#748)
Co-authored-by: Bryant Biggs <[email protected]>
1 parent a95d7e0 commit f45b1c8

File tree

10 files changed

+52
-51
lines changed

10 files changed

+52
-51
lines changed

‎examples/gitops/argocd/main.tf

Lines changed: 38 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,17 @@ module "eks_blueprints_kubernetes_addons" {
7878
eks_oidc_provider = module.eks_blueprints.oidc_provider
7979
eks_cluster_version = module.eks_blueprints.eks_cluster_version
8080

81-
enable_argocd = true
81+
enable_argocd = true
82+
# This example shows how to set default ArgoCD Admin Password using SecretsManager with Helm Chart set_sensitive values.
83+
argocd_helm_config = {
84+
set_sensitive = [
85+
{
86+
name = "configs.secret.argocdServerAdminPassword"
87+
value = data.aws_secretsmanager_secret_version.admin_password_version.secret_string
88+
}
89+
]
90+
}
91+
8292
argocd_manage_add_ons = true # Indicates that ArgoCD is responsible for managing/deploying add-ons
8393
argocd_applications = {
8494
addons = {
@@ -110,6 +120,33 @@ module "eks_blueprints_kubernetes_addons" {
110120

111121
}
112122

123+
#---------------------------------------------------------------
124+
# ArgoCD Admin Password credentials with Secrets Manager
125+
# Login to AWS Secrets manager with the same role as Terraform to extract the ArgoCD admin password with the secret name as "argocd"
126+
#---------------------------------------------------------------
127+
resource "random_password" "argocd" {
128+
length = 16
129+
special = true
130+
override_special = "!#$%&*()-_=+[]{}<>:?"
131+
}
132+
133+
#tfsec:ignore:aws-ssm-secret-use-customer-key
134+
resource "aws_secretsmanager_secret" "arogcd" {
135+
name = "argocd"
136+
recovery_window_in_days = 0 # Set to zero for this example to force delete during Terraform destroy
137+
}
138+
139+
resource "aws_secretsmanager_secret_version" "arogcd" {
140+
secret_id = aws_secretsmanager_secret.arogcd.id
141+
secret_string = random_password.argocd.result
142+
}
143+
144+
data "aws_secretsmanager_secret_version" "admin_password_version" {
145+
secret_id = aws_secretsmanager_secret.arogcd.id
146+
147+
depends_on = [aws_secretsmanager_secret_version.arogcd]
148+
}
149+
113150
#---------------------------------------------------------------
114151
# Supporting Resources
115152
#---------------------------------------------------------------

‎examples/gitops/argocd/versions.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@ terraform {
1414
source = "hashicorp/helm"
1515
version = ">= 2.4.1"
1616
}
17+
random = {
18+
source = "hashicorp/random"
19+
version = "3.3.2"
20+
}
1721
}
1822

1923
# ## Used for end-to-end testing on project; update to suit your needs

‎modules/kubernetes-addons/README.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,6 @@
8888
| <a name="input_amazon_prometheus_workspace_endpoint"></a> [amazon\_prometheus\_workspace\_endpoint](#input\_amazon\_prometheus\_workspace\_endpoint) | AWS Managed Prometheus WorkSpace Endpoint | `string` | `null` | no |
8989
| <a name="input_amazon_prometheus_workspace_region"></a> [amazon\_prometheus\_workspace\_region](#input\_amazon\_prometheus\_workspace\_region) | AWS Managed Prometheus WorkSpace Region | `string` | `null` | no |
9090
| <a name="input_argo_rollouts_helm_config"></a> [argo\_rollouts\_helm\_config](#input\_argo\_rollouts\_helm\_config) | Argo Rollouts Helm Chart config | `any` | `null` | no |
91-
| <a name="input_argocd_admin_password_secret_name"></a> [argocd\_admin\_password\_secret\_name](#input\_argocd\_admin\_password\_secret\_name) | Name for a secret stored in AWS Secrets Manager that contains the admin password | `string` | `""` | no |
9291
| <a name="input_argocd_applications"></a> [argocd\_applications](#input\_argocd\_applications) | Argo CD Applications config to bootstrap the cluster | `any` | `{}` | no |
9392
| <a name="input_argocd_helm_config"></a> [argocd\_helm\_config](#input\_argocd\_helm\_config) | Argo CD Kubernetes add-on config | `any` | `{}` | no |
9493
| <a name="input_argocd_manage_add_ons"></a> [argocd\_manage\_add\_ons](#input\_argocd\_manage\_add\_ons) | Enable managing add-on configuration via ArgoCD | `bool` | `false` | no |

‎modules/kubernetes-addons/argocd/README.md

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,7 @@ Application definitions, configurations, and environments should be declarative
4040
| [kubectl_manifest.argocd_kustomize_application](https://registry.terraform.io/providers/gavinbunney/kubectl/latest/docs/resources/manifest) | resource |
4141
| [kubernetes_namespace_v1.this](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace_v1) | resource |
4242
| [kubernetes_secret.argocd_gitops](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |
43-
| [aws_secretsmanager_secret.admin_password](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/secretsmanager_secret) | data source |
4443
| [aws_secretsmanager_secret.ssh_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/secretsmanager_secret) | data source |
45-
| [aws_secretsmanager_secret_version.admin_password_version](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/secretsmanager_secret_version) | data source |
4644
| [aws_secretsmanager_secret_version.ssh_key_version](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/secretsmanager_secret_version) | data source |
4745

4846
## Inputs
@@ -51,7 +49,6 @@ Application definitions, configurations, and environments should be declarative
5149
|------|-------------|------|---------|:--------:|
5250
| <a name="input_addon_config"></a> [addon\_config](#input\_addon\_config) | Configuration for managing add-ons via ArgoCD | `any` | `{}` | no |
5351
| <a name="input_addon_context"></a> [addon\_context](#input\_addon\_context) | Input configuration for the addon | <pre>object({<br> aws_caller_identity_account_id = string<br> aws_caller_identity_arn = string<br> aws_eks_cluster_endpoint = string<br> aws_partition_id = string<br> aws_region_name = string<br> eks_cluster_id = string<br> eks_oidc_issuer_url = string<br> eks_oidc_provider_arn = string<br> tags = map(string)<br> })</pre> | n/a | yes |
54-
| <a name="input_admin_password_secret_name"></a> [admin\_password\_secret\_name](#input\_admin\_password\_secret\_name) | Name for a secret stored in AWS Secrets Manager that contains the admin password for ArgoCD. | `string` | `""` | no |
5552
| <a name="input_applications"></a> [applications](#input\_applications) | ArgoCD Application config used to bootstrap a cluster. | `any` | `{}` | no |
5653
| <a name="input_helm_config"></a> [helm\_config](#input\_helm\_config) | ArgoCD Helm Chart Config values | `any` | `{}` | no |
5754

‎modules/kubernetes-addons/argocd/data.tf

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,3 @@
1-
# ---------------------------------------------------------------------------------------------------------------------
2-
# Admin Password
3-
# ---------------------------------------------------------------------------------------------------------------------
4-
5-
data "aws_secretsmanager_secret" "admin_password" {
6-
count = var.admin_password_secret_name == "" ? 0 : 1
7-
name = var.admin_password_secret_name
8-
}
9-
10-
data "aws_secretsmanager_secret_version" "admin_password_version" {
11-
count = var.admin_password_secret_name == "" ? 0 : 1
12-
secret_id = data.aws_secretsmanager_secret.admin_password[0].id
13-
}
14-
151
# ---------------------------------------------------------------------------------------------------------------------
162
# SSH Key
173
# ---------------------------------------------------------------------------------------------------------------------

‎modules/kubernetes-addons/argocd/locals.tf

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,6 @@
11
locals {
22
default_helm_values = [templatefile("${path.module}/values.yaml", {})]
33

4-
# Admin Password
5-
set_sensitive = var.admin_password_secret_name != "" ? [
6-
{
7-
name = "configs.secret.argocdServerAdminPassword"
8-
value = data.aws_secretsmanager_secret_version.admin_password_version[0].secret_string
9-
}
10-
] : []
11-
124
name = "argo-cd"
135
namespace = "argocd"
146

‎modules/kubernetes-addons/argocd/main.tf

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
11
module "helm_addon" {
2-
source = "../helm-addon"
3-
helm_config = local.helm_config
4-
irsa_config = null
5-
set_sensitive_values = local.set_sensitive
6-
addon_context = var.addon_context
2+
source = "../helm-addon"
3+
helm_config = local.helm_config
4+
irsa_config = null
5+
addon_context = var.addon_context
76

87
depends_on = [kubernetes_namespace_v1.this]
98
}

‎modules/kubernetes-addons/argocd/variables.tf

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,6 @@ variable "applications" {
1010
default = {}
1111
}
1212

13-
variable "admin_password_secret_name" {
14-
description = "Name for a secret stored in AWS Secrets Manager that contains the admin password for ArgoCD."
15-
type = string
16-
default = ""
17-
}
18-
1913
variable "addon_config" {
2014
description = "Configuration for managing add-ons via ArgoCD"
2115
type = any

‎modules/kubernetes-addons/main.tf

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -64,13 +64,12 @@ module "agones" {
6464
}
6565

6666
module "argocd" {
67-
count = var.enable_argocd ? 1 : 0
68-
source = "./argocd"
69-
helm_config = var.argocd_helm_config
70-
applications = var.argocd_applications
71-
admin_password_secret_name = var.argocd_admin_password_secret_name
72-
addon_config = { for k, v in local.argocd_addon_config : k => v if v != null }
73-
addon_context = local.addon_context
67+
count = var.enable_argocd ? 1 : 0
68+
source = "./argocd"
69+
helm_config = var.argocd_helm_config
70+
applications = var.argocd_applications
71+
addon_config = { for k, v in local.argocd_addon_config : k => v if v != null }
72+
addon_context = local.addon_context
7473
}
7574

7675
module "argo_rollouts" {

‎modules/kubernetes-addons/variables.tf

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -638,12 +638,6 @@ variable "argocd_applications" {
638638
default = {}
639639
}
640640

641-
variable "argocd_admin_password_secret_name" {
642-
description = "Name for a secret stored in AWS Secrets Manager that contains the admin password"
643-
type = string
644-
default = ""
645-
}
646-
647641
variable "argocd_manage_add_ons" {
648642
description = "Enable managing add-on configuration via ArgoCD"
649643
type = bool

0 commit comments

Comments
 (0)