create policy an role for secrets manager access from EKS

Author: eddiewebb

akuity-bootstrap/main.tf

@@ -119,3 +119,13 @@ resource "akp_cluster" "kargo-cluster" {
   depends_on = [akp_kargo_instance.kargo-instance, akp_instance.se-demo-iac]
 }
 
+resource "aws_route53_record" "records" {
+
+  zone_id = data.terraform_remote_state.eks_clusters.outputs.root_zone_id
+  name    = "argo.${data.terraform_remote_state.eks_clusters.outputs.demo_domain}"
+  type    = "CNAME"
+  ttl     = 5
+
+  records    = [output.argo_server_url]
+  depends_on = [akp_instance.se-demo-iac]
+}

core-env/aws/main.tf

@@ -103,9 +103,50 @@ resource "aws_iam_role_policy_attachment" "gha_attachment" {
   policy_arn = aws_iam_policy.demo_gha_policy.arn
 }
 
-output "demo_operator_role_arn" {
-  value = aws_iam_role.demo_role.arn
+
+
+#
+# Secrets Manager for ESO
+#
+
+
+# Specific role for GHA via OIDC to assume (can also be assumed by team)
+resource "aws_iam_policy" "demo_secrets_policy" {
+  name        = var.priviledged_assumed_role
+  description = "Policy to grant demo cluster access to secrets via ESO"
+
+  policy = templatefile(
+    "${path.module}/templates/secrets_policy.json.tpl",
+    {
+      AWS_ACCOUNT_ID = data.aws_caller_identity.current.id
+    }
+  )
+
+  tags = var.common_tags
+  lifecycle {
+    create_before_destroy = true
+  }
 }
-output "demo_pipeline_role_arn" {
-  value = aws_iam_role.demo_gha_role.arn
+
+# Specific role for GHA via OIDC to assume (can also be assumed by team)
+resource "aws_iam_role" "secrets_role" {
+  name        = var.priviledged_assumed_role
+  description = "Role grants access to secrets policy for ESO"
+
+  assume_role_policy = templatefile(
+    "${path.module}/templates/secrets_role.json.tpl",
+    {
+
+    }
+  )
+
+  tags = var.common_tags
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_iam_role_policy_attachment" "secrets_attachment" {
+  role       = aws_iam_role.secrets_role.name
+  policy_arn = aws_iam_policy.demo_secrets_policy.arn
 }

core-env/aws/variables.tf

@@ -13,13 +13,6 @@ variable "common_tags" {
   }
 }
 
-
-variable "demo_domain" {
-  description = "Domain apps will be exposed via ingress"
-  type        = string
-  default     = "demoapps.akuity.io"
-}
-
 variable "email_usernames" {
   description = "Who can act as operator on ARAD resources, by assume operator role."
   default = [

core-env/eks-clusters/outputs.tf

@@ -6,4 +6,11 @@ output "primary_cluster_endpoint" {
 }
 output "primary_cluster_ca" {
     value = module.eks.cluster_certificate_authority_data
+}
+output "demo_domain" {
+    value = var.root_domain_name
+}
+
+output "root_zone_id" {
+    value = data.aws_route53_zone.root_demo_domain_zone.id
 }