mirror of
https://github.com/storytold/terraform-aws-observability-accelerator.git
synced 2026-10-09 00:09:43 +00:00
Rodrigue Koffi
fa38a90efc
* Typo * Remove Grafana provider * Temp: move dashbaords to gitOps * Move external labels to resource attributes * Avoid DDoS with using 0.0.0.0 * Pre-commit * Transition in two steps Will need to remove provider in a separate version to provide a transition path as removing this will break terraform and leave orphans in the state * Move patterns' dashboards creation to gitOps Standardize config objects for patterns as well * Pre-commit * Create AMP dashboard from external source with Grafana provider * Fix deprecated option * Fix Flux requirements * Run pre-commit * Update example with operator * Cleanup examples * Update multicluster example * Update multicluster example * Drop dead variable * Update docs * Change GitOps branch name * Update docs * Replacing Secrets Manager to SSM to store Grafana API Key (#178) * Fixing SSM * Fixing SSM * Replacing Secrets Manager with SSM * Replacing Secrets Manager with SSM * Update architecture diagram * Update architecture diagram * Update README.md * Update index.md * Fixing Grafana Operator Version * Fix multicluster example * Update docs --------- Co-authored-by: Ela AWS <51791117+elamaran11@users.noreply.github.com> Co-authored-by: Elamaran Shanmugam <elamaran.shan@gmail.com>
110 lines
2.9 KiB
Terraform
110 lines
2.9 KiB
Terraform
module "external_secrets" {
|
|
source = "github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/external-secrets?ref=v4.32.0"
|
|
count = var.enable_external_secrets ? 1 : 0
|
|
|
|
helm_config = var.helm_config
|
|
addon_context = var.addon_context
|
|
}
|
|
|
|
data "aws_region" "current" {}
|
|
|
|
#---------------------------------------------------------------
|
|
# External Secrets Operator - Secret
|
|
#---------------------------------------------------------------
|
|
|
|
resource "aws_kms_key" "secrets" {
|
|
enable_key_rotation = true
|
|
}
|
|
|
|
module "cluster_secretstore_role" {
|
|
source = "github.com/aws-ia/terraform-aws-eks-blueprints//modules/irsa?ref=v4.32.0"
|
|
kubernetes_namespace = local.namespace
|
|
create_kubernetes_namespace = false
|
|
kubernetes_service_account = local.cluster_secretstore_sa
|
|
irsa_iam_policies = [aws_iam_policy.cluster_secretstore.arn]
|
|
eks_cluster_id = var.addon_context.eks_cluster_id
|
|
eks_oidc_provider_arn = var.addon_context.eks_oidc_provider_arn
|
|
depends_on = [module.external_secrets]
|
|
}
|
|
|
|
resource "aws_iam_policy" "cluster_secretstore" {
|
|
name_prefix = local.cluster_secretstore_sa
|
|
policy = <<POLICY
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ssm:DescribeParameters",
|
|
"ssm:GetParameter",
|
|
"ssm:GetParameters",
|
|
"ssm:GetParametersByPath",
|
|
"ssm:GetParameterHistory"
|
|
],
|
|
"Resource": "${aws_ssm_parameter.secret.arn}"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"kms:Decrypt"
|
|
],
|
|
"Resource": "${aws_kms_key.secrets.arn}"
|
|
}
|
|
]
|
|
}
|
|
POLICY
|
|
}
|
|
|
|
resource "kubectl_manifest" "cluster_secretstore" {
|
|
yaml_body = <<YAML
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: ${local.cluster_secretstore_name}
|
|
spec:
|
|
provider:
|
|
aws:
|
|
service: ParameterStore
|
|
region: ${data.aws_region.current.name}
|
|
auth:
|
|
jwt:
|
|
serviceAccountRef:
|
|
name: ${local.cluster_secretstore_sa}
|
|
namespace: ${local.namespace}
|
|
YAML
|
|
depends_on = [module.external_secrets]
|
|
}
|
|
|
|
resource "aws_ssm_parameter" "secret" {
|
|
name = "/terraform-accelerator/grafana-api-key"
|
|
description = "SSM Secret to store grafana API Key"
|
|
type = "SecureString"
|
|
value = jsonencode({
|
|
GF_SECURITY_ADMIN_APIKEY = var.grafana_api_key
|
|
})
|
|
key_id = aws_kms_key.secrets.id
|
|
overwrite = true
|
|
}
|
|
|
|
resource "kubectl_manifest" "secret" {
|
|
yaml_body = <<YAML
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: ${local.name}-sm
|
|
namespace: ${var.target_secret_namespace}
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: ${local.cluster_secretstore_name}
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: ${var.target_secret_name}
|
|
dataFrom:
|
|
- extract:
|
|
key: ${aws_ssm_parameter.secret.name}
|
|
YAML
|
|
depends_on = [module.external_secrets]
|
|
}
|