Skip to content

Commit 9e1bc8e

Browse files
davidspekdavidspek
committed
init add proper support for AWS
Signed-off-by: David van der Spek <[email protected]>
1 parent 7f6e6a9 commit 9e1bc8e

File tree

12 files changed

+6591
-108
lines changed

12 files changed

+6591
-108
lines changed

‎external-secrets/helm/external-secrets/crds/bundle.yaml‎

Lines changed: 6450 additions & 0 deletions
Large diffs are not rendered by default.

‎external-secrets/helm/external-secrets/templates/_helpers.tpl‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{{/*
22
Expand the name of the chart.
33
*/}}
4-
{{- define "external-secrets.name" -}}
4+
{{- define "external-secrets-plural.name" -}}
55
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
66
{{- end }}
77

@@ -10,7 +10,7 @@ Create a default fully qualified app name.
1010
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
1111
If release name contains chart name it will be used as a full name.
1212
*/}}
13-
{{- define "external-secrets.fullname" -}}
13+
{{- define "external-secrets-plural.fullname" -}}
1414
{{- if .Values.fullnameOverride }}
1515
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
1616
{{- else }}
@@ -26,16 +26,16 @@ If release name contains chart name it will be used as a full name.
2626
{{/*
2727
Create chart name and version as used by the chart label.
2828
*/}}
29-
{{- define "external-secrets.chart" -}}
29+
{{- define "external-secrets-plural.chart" -}}
3030
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
3131
{{- end }}
3232

3333
{{/*
3434
Common labels
3535
*/}}
36-
{{- define "external-secrets.labels" -}}
37-
helm.sh/chart: {{ include "external-secrets.chart" . }}
38-
{{ include "external-secrets.selectorLabels" . }}
36+
{{- define "external-secrets-plural.labels" -}}
37+
helm.sh/chart: {{ include "external-secrets-plural.chart" . }}
38+
{{ include "external-secrets-plural.selectorLabels" . }}
3939
{{- if .Chart.AppVersion }}
4040
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
4141
{{- end }}
@@ -45,17 +45,17 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
4545
{{/*
4646
Selector labels
4747
*/}}
48-
{{- define "external-secrets.selectorLabels" -}}
49-
app.kubernetes.io/name: {{ include "external-secrets.name" . }}
48+
{{- define "external-secrets-plural.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "external-secrets-plural.name" . }}
5050
app.kubernetes.io/instance: {{ .Release.Name }}
5151
{{- end }}
5252

5353
{{/*
5454
Create the name of the service account to use
5555
*/}}
56-
{{- define "external-secrets.serviceAccountName" -}}
56+
{{- define "external-secrets-plural.serviceAccountName" -}}
5757
{{- if .Values.serviceAccount.create }}
58-
{{- default (include "external-secrets.fullname" .) .Values.serviceAccount.name }}
58+
{{- default (include "external-secrets-plural.fullname" .) .Values.serviceAccount.name }}
5959
{{- else }}
6060
{{- default "default" .Values.serviceAccount.name }}
6161
{{- end }}

‎external-secrets/helm/external-secrets/templates/cluster-secret-store.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{{- if .Values.clusterSecretStore.create -}}
2+
apiVersion: external-secrets.io/v1beta1
3+
kind: ClusterSecretStore
4+
metadata:
5+
name: default
6+
spec:
7+
{{- with .Values.clusterSecretStore.provider }}
8+
provider:
9+
{{- toYaml . | nindent 4 }}
10+
{{- end }}
11+
{{- end -}}

‎external-secrets/helm/external-secrets/templates/tests/test-connection.yaml‎

Lines changed: 0 additions & 15 deletions
This file was deleted.

‎external-secrets/helm/external-secrets/values.yaml‎

Lines changed: 25 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -1,82 +1,26 @@
1-
# Default values for external-secrets.
2-
# This is a YAML-formatted file.
3-
# Declare variables to be passed into your templates.
4-
5-
replicaCount: 1
6-
7-
image:
8-
repository: nginx
9-
pullPolicy: IfNotPresent
10-
# Overrides the image tag whose default is the chart appVersion.
11-
tag: ""
12-
13-
imagePullSecrets: []
14-
nameOverride: ""
15-
fullnameOverride: ""
16-
17-
serviceAccount:
18-
# Specifies whether a service account should be created
1+
clusterSecretStore:
192
create: true
20-
# Annotations to add to the service account
21-
annotations: {}
22-
# The name of the service account to use.
23-
# If not set and create is true, a name is generated using the fullname template
24-
name: ""
25-
26-
podAnnotations: {}
27-
28-
podSecurityContext: {}
29-
# fsGroup: 2000
30-
31-
securityContext: {}
32-
# capabilities:
33-
# drop:
34-
# - ALL
35-
# readOnlyRootFilesystem: true
36-
# runAsNonRoot: true
37-
# runAsUser: 1000
38-
39-
service:
40-
type: ClusterIP
41-
port: 80
42-
43-
ingress:
44-
enabled: false
45-
className: ""
46-
annotations: {}
47-
# kubernetes.io/ingress.class: nginx
48-
# kubernetes.io/tls-acme: "true"
49-
hosts:
50-
- host: chart-example.local
51-
paths:
52-
- path: /
53-
pathType: ImplementationSpecific
54-
tls: []
55-
# - secretName: chart-example-tls
56-
# hosts:
57-
# - chart-example.local
58-
59-
resources: {}
60-
# We usually recommend not to specify default resources and to leave this as a conscious
61-
# choice for the user. This also increases chances charts run on environments with little
62-
# resources, such as Minikube. If you do want to specify resources, uncomment the following
63-
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
64-
# limits:
65-
# cpu: 100m
66-
# memory: 128Mi
67-
# requests:
68-
# cpu: 100m
69-
# memory: 128Mi
70-
71-
autoscaling:
72-
enabled: false
73-
minReplicas: 1
74-
maxReplicas: 100
75-
targetCPUUtilizationPercentage: 80
76-
# targetMemoryUtilizationPercentage: 80
77-
78-
nodeSelector: {}
79-
80-
tolerations: []
81-
82-
affinity: {}
3+
provider: {}
4+
5+
external-secrets:
6+
image:
7+
repository: ghcr.io/external-secrets/external-secrets
8+
tag: ""
9+
resources: {}
10+
serviceMonitor:
11+
enabled: true
12+
installCRDs: false
13+
webhook:
14+
image:
15+
repository: ghcr.io/external-secrets/external-secrets
16+
tag: ""
17+
resources: {}
18+
serviceMonitor:
19+
enabled: true
20+
certController:
21+
image:
22+
repository: ghcr.io/external-secrets/external-secrets
23+
tag: ""
24+
resources: {}
25+
serviceMonitor:
26+
enabled: true

‎external-secrets/helm/external-secrets/values.yaml.tpl‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,13 @@
1-
{}
1+
{{- if eq .Provider "aws" }}
2+
external-secrets:
3+
serviceAccount:
4+
annotations:
5+
eks.amazonaws.com/role-arn: "arn:aws:iam::{{ .Project }}:role/{{ .Cluster }}-external-secrets"
6+
{{- end }}
7+
{{- if eq .Provider "aws" }}
8+
clusterSecretStore:
9+
provider:
10+
aws:
11+
service: SecretsManager
12+
region: {{ .Region }}
13+
{{- end }}

‎external-secrets/plural/recipes/external-secrets-azure.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
name: external-secrets-azure
22
description: Installs external-secrets on an aws eks cluster
33
provider: AZURE
4+
private: true
45
dependencies:
56
- repo: bootstrap
67
name: azure-k8s

‎external-secrets/plural/recipes/external-secrets-gcp.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
name: external-secrets-gcp
22
description: Installs external-secrets on an aws eks cluster
33
provider: GCP
4+
private: true
45
dependencies:
56
- repo: bootstrap
67
name: gcp-k8s

‎external-secrets/terraform/aws/locals.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
locals {
2+
policy_arns = concat([aws_iam_policy.external_secrets.arn], var.extra_policy_arns)
3+
}

‎external-secrets/terraform/aws/main.tf‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,41 @@ resource "kubernetes_namespace" "external-secrets" {
99
}
1010
}
1111

12+
data "aws_eks_cluster" "cluster" {
13+
name = var.cluster_name
14+
}
15+
16+
module "assumable_role_external_secrets" {
17+
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
18+
version = "3.14.0"
19+
create_role = true
20+
role_name = "${var.cluster_name}-${var.role_name}"
21+
provider_url = replace(data.aws_eks_cluster.cluster.identity[0].oidc[0].issuer, "https://", "")
22+
role_policy_arns = local.policy_arns
23+
oidc_subjects_with_wildcards = [
24+
"system:serviceaccount:${var.namespace}:${var.serviceaccount}",
25+
]
26+
}
27+
28+
resource "aws_iam_policy" "external_secrets" {
29+
name_prefix = var.role_name
30+
description = "policy for the plural admin console"
31+
policy = data.aws_iam_policy_document.external_secrets.json
32+
}
33+
34+
data "aws_iam_policy_document" "external_secrets" {
35+
statement {
36+
sid = "admin"
37+
effect = "Allow"
38+
actions = [
39+
"secretsmanager:GetResourcePolicy",
40+
"secretsmanager:GetSecretValue",
41+
"secretsmanager:DescribeSecret",
42+
"secretsmanager:ListSecretVersionIds"
43+
]
44+
45+
resources = [
46+
"arn:aws:secretsmanager:${var.region}:${var.account_id}:secret:${var.secret_prefix}"
47+
]
48+
}
49+
}

0 commit comments

Comments
 (0)