Merge pull request #5513 from pkprzekwas/secret-manager

eks-prow-build-cluster: enable secrets manager for external secrets

infra/aws/terraform/modules/eks-prow-iam/boundary_eks_resources.tf

@@ -42,8 +42,10 @@ data "aws_iam_policy_document" "eks_resources_permission_boundary_doc" {
       "iam:*",
       "kms:*",
       "logs:*",
-      "sts:*",
-      "s3:*"
+      "s3:*",
+      "secretsmanager:GetSecretValue",
+      "secretsmanager:DescribeSecret",
+      "sts:*"
     ]
 
     resources = ["*"]

infra/aws/terraform/prow-build-cluster/irsa.tf

@@ -99,23 +99,23 @@ module "cluster_autoscaler_irsa" {
 
 # IAM policy used for Secrets Manager and accessing secrets.
 # Example policy, uncomment and modify as needed.
-# module "secrets_manager_irsa" {
-#   source  = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
-#   version = "~> 5.11"
-#
-#   role_name_prefix = "SECRETSMANAGER-IRSA"
-#   role_policy_arns = {
-#     secrets_manager = aws_iam_policy.secretsmanager_read.arn,
-#   }
-#
-#   role_permissions_boundary_arn = data.aws_iam_policy.eks_resources_permission_boundary.arn
-#
-#   oidc_providers = {
-#     main = {
-#       provider_arn               = module.eks.oidc_provider_arn
-#       namespace_service_accounts = ["default:secrets-test"]
-#     }
-#   }
-#
-#   tags = local.tags
-# }
+module "secrets_manager_irsa" {
+  source  = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
+  version = "~> 5.11"
+
+  role_name = "SECRETSMANAGER-IRSA"
+  role_policy_arns = {
+    secrets_manager = aws_iam_policy.secretsmanager_read.arn,
+  }
+
+  role_permissions_boundary_arn = data.aws_iam_policy.eks_resources_permission_boundary.arn
+
+  oidc_providers = {
+    main = {
+      provider_arn               = module.eks.oidc_provider_arn
+      namespace_service_accounts = ["external-secrets:external-secrets"]
+    }
+  }
+
+  tags = local.tags
+}

infra/aws/terraform/prow-build-cluster/resources/external-secrets/external-secrets.yaml

@@ -17,6 +17,8 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: external-secrets
+  annotations:
+    eks.amazonaws.com/role-arn: arn:aws:iam::468814281478:role/SECRETSMANAGER-IRSA
   namespace: "external-secrets"
   labels:
     helm.sh/chart: external-secrets-0.7.2

infra/aws/terraform/prow-build-cluster/resources/external-secrets/secret-store.yaml

@@ -0,0 +1,28 @@
+# Copyright 2023 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: aws-secerts-manager
+spec:
+  provider:
+    aws:
+      service: SecretsManager
+      region: us-east-2
+      auth:
+        jwt:
+          serviceAccountRef:
+            name: external-secrets
+            namespace: external-secrets

infra/aws/terraform/prow-build-cluster/resources/flux-system/flux-slack-notifications.yaml

@@ -0,0 +1,41 @@
+# Copyright 2023 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+---
+apiVersion: notification.toolkit.fluxcd.io/v1beta2
+kind: Provider
+metadata:
+  name: slack
+  namespace: flux-system
+spec:
+  type: slack
+  channel: alerting-cncf-prod
+  secretRef:
+    name: slack-url
+
+---
+apiVersion: notification.toolkit.fluxcd.io/v1beta2
+kind: Alert
+metadata:
+  name: alerting-cncf-prod
+  namespace: flux-system
+spec:
+  summary: "EKS Prow Build Cluster"
+  providerRef:
+    name: slack
+  eventSeverity: error
+  eventSources:
+    - kind: GitRepository
+      name: '*'
+    - kind: Kustomization
+      name: '*'

infra/aws/terraform/prow-build-cluster/resources/flux-system/slack-alerting-external-secret.yaml

@@ -0,0 +1,32 @@
+# Copyright 2023 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: slack-url
+  namespace: flux-system
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: aws-secerts-manager
+    kind: ClusterSecretStore
+  target:
+    name: slack-url
+    creationPolicy: Owner
+  data:
+  - secretKey: address
+    remoteRef:
+      key: secrets/kubermatic
+      property: slack-alerting-cncf-prod