[DPE-1435] install external secret manager with helm

deployments/stacks/dpe-k8s-deployments/main.tf

@@ -29,6 +29,13 @@ module "argo-cd" {
   source = "../../../modules/argo-cd"
 }
 
+module "external-secrets" {
+  source      = "../../../modules/external-secrets"
+  region      = var.region
+  aws_account_id = var.aws_account_id
+  namespace = "external-secrets"
+}
+
 module "flux-cd" {
   depends_on = [module.sage-aws-eks-autoscaler]
   source     = "../../../modules/flux-cd"

deployments/stacks/dpe-k8s-deployments/variables.tf

@@ -118,4 +118,4 @@ variable "docker_access_token" {
   description = "The access token to use for docker authenticated pulls. Created via by setting 'TF_VAR_docker_access_token' within spacelift as an environment variable"
   type        = string
   default     = ""
-}
+}

modules/argo-cd/main.tf

@@ -14,3 +14,4 @@ resource "helm_release" "argo-cd" {
 
   values = [templatefile("${path.module}/templates/values.yaml", {})]
 }
+

modules/external-secrets/main.tf

@@ -0,0 +1,38 @@
+resource "kubernetes_namespace" "external-secrets" {
+  metadata { name =  var.namespace }
+}
+
+
+# Argo CD Application that installs ESO from the official Helm repo
+resource "kubectl_manifest" "external-secrets-app" {
+  yaml_body = <<YAML
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-secrets
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: default
+  %{if var.auto_deploy}
+  syncPolicy:
+    automated:
+      prune: ${var.auto_prune}
+  %{endif}
+  sources:
+  - repoURL: 'https://charts.external-secrets.io'
+    chart: external-secrets
+    targetRevision: v0.19.1
+    helm:
+      releaseName: external-secrets
+      valueFiles:
+      - $values/modules/external-secrets/templates/values.yaml
+  - repoURL: 'https://github.com/Sage-Bionetworks-Workflows/eks-stack.git'
+    targetRevision: ${var.git_revision}
+    ref: values
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: external-secrets
+YAML
+}