Skip to content

Commit ad2c485

Browse files
csantanaprcsantanapr
committed
update external-secrets example
Signed-off-by: Carlos Santana <csantana23@gmail.com>
1 parent c173a58 commit ad2c485

File tree

7 files changed

+233
-68
lines changed

7 files changed

+233
-68
lines changed

‎argocd/iac/terraform/examples/eks/external-secrets/bootstrap/addons.yaml‎

Lines changed: 27 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,32 @@
1+
---
12
apiVersion: argoproj.io/v1alpha1
2-
kind: Application
3+
kind: ApplicationSet
34
metadata:
45
name: bootstrap-addons
5-
namespace: 'argocd'
66
spec:
7-
destination:
8-
server: https://kubernetes.default.svc
9-
namespace: 'argocd'
10-
project: default
11-
source:
12-
path: ${path}
13-
repoURL: ${repoURL}
14-
targetRevision: ${targetRevision}
15-
directory:
16-
recurse: true
17-
exclude: exclude/*
187
syncPolicy:
19-
automated: {}
8+
preserveResourcesOnDeletion: true
9+
generators:
10+
- clusters:
11+
selector:
12+
matchExpressions:
13+
- key: akuity.io/argo-cd-cluster-name
14+
operator: NotIn
15+
values: [in-cluster]
16+
template:
17+
metadata:
18+
name: 'bootstrap-addons'
19+
spec:
20+
project: default
21+
source:
22+
repoURL: '{{metadata.annotations.gitops_bridge_repo_url}}'
23+
path: '{{metadata.annotations.gitops_bridge_repo_path}}'
24+
targetRevision: '{{metadata.annotations.gitops_bridge_repo_revision}}'
25+
directory:
26+
recurse: true
27+
exclude: exclude/*
28+
destination:
29+
namespace: 'argocd'
30+
name: '{{name}}'
31+
syncPolicy:
32+
automated: {}

‎argocd/iac/terraform/examples/eks/external-secrets/bootstrap/workloads.yaml‎

Lines changed: 40 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,44 @@
1+
---
12
apiVersion: argoproj.io/v1alpha1
2-
kind: Application
3+
kind: ApplicationSet
34
metadata:
4-
name: bootstrap-workloads
5-
namespace: 'argocd'
6-
finalizers:
7-
- resources-finalizer.argocd.argoproj.io
5+
name: external-secrets-example
86
spec:
9-
destination:
10-
server: https://kubernetes.default.svc
11-
namespace: 'guestbook'
12-
project: default
13-
source:
14-
path: helm-guestbook
15-
repoURL: git@github.com:argoproj/argocd-example-apps.git
16-
targetRevision: HEAD
177
syncPolicy:
18-
automated: {}
19-
syncOptions:
20-
- CreateNamespace=true
8+
preserveResourcesOnDeletion: true
9+
generators:
10+
- clusters:
11+
selector:
12+
matchExpressions:
13+
- key: akuity.io/argo-cd-cluster-name
14+
operator: NotIn
15+
values: [in-cluster]
16+
template:
17+
metadata:
18+
name: 'external-secrets-example'
19+
spec:
20+
project: default
21+
source:
22+
repoURL: '{{metadata.annotations.workload_repo_url}}'
23+
path: '{{metadata.annotations.workload_repo_path}}'
24+
targetRevision: '{{metadata.annotations.workload_repo_revision}}'
25+
helm:
26+
releaseName: 'external-secrets-example'
27+
values: |
28+
region: '{{metadata.annotations.aws_region}}'
29+
externalSecret:
30+
clusterSecretStore:
31+
secret: '{{metadata.annotations.workload_sm_secret}}'
32+
secretStore:
33+
secret: '{{metadata.annotations.workload_pm_secret}}'
34+
destination:
35+
namespace: '{{metadata.annotations.external_secrets_namespace}}'
36+
name: '{{name}}'
37+
syncPolicy:
38+
automated:
39+
retry:
40+
backoff:
41+
duration: 1m
42+
limit: 10
43+
syncOptions:
44+
- CreateNamespace=true

‎argocd/iac/terraform/examples/eks/external-secrets/k8s/Chart.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: v2
2+
name: resources
3+
description: A Helm chart for Kubernetes
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 1.0.0
19+
20+
# This is the version number of the application being deployed. This version number should be
21+
# incremented each time you make changes to the application. Versions are not expected to
22+
# follow Semantic Versioning. They should reflect the version the application is using.
23+
# It is recommended to use it with quotes.
24+
appVersion: "1.0.0"

‎argocd/iac/terraform/examples/eks/external-secrets/k8s/templates/secrets.yaml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
---
2+
apiVersion: external-secrets.io/v1beta1
3+
kind: ClusterSecretStore
4+
metadata:
5+
name: cluster-secretstore-sm
6+
spec:
7+
provider:
8+
aws:
9+
service: SecretsManager
10+
region: {{ .Values.region }}
11+
---
12+
apiVersion: external-secrets.io/v1beta1
13+
kind: ExternalSecret
14+
metadata:
15+
name: external-secrets-sm
16+
spec:
17+
refreshInterval: 1h
18+
secretStoreRef:
19+
name: cluster-secretstore-sm
20+
kind: ClusterSecretStore
21+
dataFrom:
22+
- extract:
23+
key: {{ .Values.externalSecret.clusterSecretStore.secret }}
24+
---
25+
apiVersion: external-secrets.io/v1beta1
26+
kind: SecretStore
27+
metadata:
28+
name: secretstore-ps
29+
spec:
30+
provider:
31+
aws:
32+
service: ParameterStore
33+
region: {{ .Values.region }}
34+
---
35+
apiVersion: external-secrets.io/v1beta1
36+
kind: ExternalSecret
37+
metadata:
38+
name: external-secrets-ps
39+
spec:
40+
refreshInterval: 1h
41+
secretStoreRef:
42+
name: secretstore-ps
43+
kind: SecretStore
44+
dataFrom:
45+
- extract:
46+
key: {{ .Values.externalSecret.secretStore.secret }}

‎argocd/iac/terraform/examples/eks/external-secrets/k8s/values.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
region: us-west-2
2+
externalSecret:
3+
clusterSecretStore:
4+
secret: secret
5+
secretStore:
6+
secret: /external-secrets/secret

‎argocd/iac/terraform/examples/eks/external-secrets/main.tf‎

Lines changed: 63 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -43,16 +43,26 @@ provider "kubernetes" {
4343
}
4444

4545
locals {
46-
name = "ex-${replace(basename(path.cwd), "_", "-")}"
47-
environment = "dev"
48-
region = "us-west-2"
49-
cluster_version = "1.27"
50-
gitops_url = var.gitops_url
51-
gitops_revision = var.gitops_revision
52-
gitops_path = var.gitops_path
46+
name = "ex-${replace(basename(path.cwd), "_", "-")}"
47+
environment = "dev"
48+
region = "us-west-2"
49+
cluster_version = "1.27"
50+
gitops_addons_org = var.gitops_addons_org
51+
gitops_addons_repo = var.gitops_addons_repo
52+
gitops_addons_path = var.gitops_addons_path
53+
gitops_addons_revision = var.gitops_addons_revision
54+
gitops_addons_url = "${local.gitops_addons_org}/${local.gitops_addons_repo}"
55+
56+
gitops_workload_org = var.gitops_workload_org
57+
gitops_workload_repo = var.gitops_workload_repo
58+
gitops_workload_path = var.gitops_workload_path
59+
gitops_workload_revision = var.gitops_workload_revision
60+
gitops_workload_url = "${local.gitops_workload_org}/${local.gitops_workload_repo}"
61+
62+
# Secret names in AWS
63+
workload_sm_secret = local.name
64+
workload_pm_secret = "/${local.name}/secret"
5365

54-
aws_secret_manager_secret_name = "argocd-ssh-key"
55-
git_private_ssh_key = "~/.ssh/id_rsa" # Update with the git ssh key to be used by ArgoCD
5666

5767
aws_addons = {
5868
enable_cert_manager = true
@@ -62,7 +72,7 @@ locals {
6272
#enable_aws_privateca_issuer = true
6373
#enable_cluster_autoscaler = true
6474
#enable_external_dns = true
65-
enable_external_secrets = true
75+
enable_external_secrets = true
6676
#enable_aws_load_balancer_controller = true
6777
#enable_fargate_fluentbit = true
6878
#enable_aws_for_fluentbit = true
@@ -99,18 +109,24 @@ locals {
99109
aws_vpc_id = module.vpc.vpc_id
100110
},
101111
{
102-
gitops_bridge_repo_url = local.gitops_url
103-
gitops_bridge_repo_revision = local.gitops_revision
112+
gitops_bridge_repo_url = local.gitops_addons_url
113+
gitops_bridge_repo_path = local.gitops_addons_path
114+
gitops_bridge_repo_revision = local.gitops_addons_revision
115+
},
116+
{
117+
workload_repo_url = local.gitops_addons_url
118+
workload_repo_path = local.gitops_addons_path
119+
workload_repo_revision = local.gitops_addons_revision
120+
},
121+
{
122+
workload_sm_secret = aws_ssm_parameter.secret_parameter.name
123+
workload_pm_secret = aws_secretsmanager_secret.secret.name
104124
}
105125
)
106126

107127
argocd_bootstrap_app_of_apps = {
108-
addons = templatefile("${path.module}/bootstrap/addons.yaml", {
109-
repoURL = local.gitops_url
110-
targetRevision = local.gitops_revision
111-
path = local.gitops_path
112-
})
113-
workloads = file("${path.module}/bootstrap/workloads.yaml")
128+
addons = file("${path.module}/bootstrap/addons.yaml")
129+
addons = file("${path.module}/bootstrap/workloads.yaml")
114130
}
115131

116132
vpc_cidr = "10.0.0.0/16"
@@ -122,6 +138,35 @@ locals {
122138
}
123139
}
124140

141+
################################################################################
142+
# Secret Manager & Parameter Store
143+
################################################################################
144+
resource "aws_kms_key" "secrets" {
145+
enable_key_rotation = true
146+
}
147+
resource "aws_secretsmanager_secret" "secret" {
148+
name = local.workload_sm_secret
149+
recovery_window_in_days = 0
150+
kms_key_id = aws_kms_key.secrets.arn
151+
}
152+
resource "aws_secretsmanager_secret_version" "secret" {
153+
secret_id = aws_secretsmanager_secret.secret.id
154+
secret_string = jsonencode({
155+
username = "secretuser",
156+
password = "secretpassword"
157+
})
158+
}
159+
resource "aws_ssm_parameter" "secret_parameter" {
160+
name = local.workload_pm_secret
161+
type = "SecureString"
162+
value = jsonencode({
163+
username = "secretuser",
164+
password = "secretpassword"
165+
})
166+
key_id = aws_kms_key.secrets.arn
167+
}
168+
169+
125170
################################################################################
126171
# GitOps Bridge: Metadata
127172
################################################################################
@@ -144,20 +189,6 @@ module "gitops_bridge_bootstrap" {
144189
argocd_bootstrap_app_of_apps = local.argocd_bootstrap_app_of_apps
145190
}
146191

147-
################################################################################
148-
# AWS Secret Manager
149-
################################################################################
150-
#tfsec:ignore:aws-ssm-secret-use-customer-key
151-
resource "aws_secretsmanager_secret" "git_ssh_key" {
152-
name = local.aws_secret_manager_secret_name
153-
recovery_window_in_days = 0 # Set to zero for this example to force delete during Terraform destroy
154-
}
155-
resource "aws_secretsmanager_secret_version" "git_ssh_key" {
156-
secret_id = aws_secretsmanager_secret.git_ssh_key.id
157-
secret_string = file(pathexpand(local.git_private_ssh_key))
158-
}
159-
160-
161192
################################################################################
162193
# EKS Blueprints Addons
163194
################################################################################

‎argocd/iac/terraform/examples/eks/external-secrets/variables.tf‎

Lines changed: 27 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,33 @@
1-
variable "gitops_url" {
1+
variable "gitops_addons_org" {
2+
description = "Git repository org/user contains for addons"
3+
default = "https://github.com/gitops-bridge-dev"
4+
}
5+
variable "gitops_addons_repo" {
26
description = "Git repository contains for addons"
3-
default = "https://github.com/gitops-bridge-dev/gitops-bridge-argocd-control-plane-template"
7+
default = "gitops-bridge-argocd-control-plane-template"
48
}
5-
variable "gitops_revision" {
9+
variable "gitops_addons_path" {
10+
description = "Git repository path for addons"
11+
default = "bootstrap/control-plane/addons"
12+
}
13+
variable "gitops_addons_revision" {
614
description = "Git repository revision/branch/ref for addons"
715
default = "HEAD"
816
}
9-
variable "gitops_path" {
10-
description = "Git repository path for addons"
11-
default = "bootstrap/control-plane/addons"
17+
18+
variable "gitops_workload_org" {
19+
description = "Git repository org/user contains for workload"
20+
default = "https://github.com/gitops-bridge-dev"
21+
}
22+
variable "gitops_workload_repo" {
23+
description = "Git repository contains for workload"
24+
default = "gitops-bridge"
25+
}
26+
variable "gitops_workload_path" {
27+
description = "Git repository path for workload"
28+
default = "argocd/iac/terraform/examples/eks/external-secrets/k8s"
29+
}
30+
variable "gitops_workload_revision" {
31+
description = "Git repository revision/branch/ref for workload"
32+
default = "HEAD"
1233
}

0 commit comments

Comments
 (0)