Add external secrets operator

terraform/argocd.tf

@@ -5,6 +5,16 @@ resource "random_password" "argocd_admin" {
   override_special = "!#$%&*()-_=+[]{}?"
 }
 
+resource "random_password" "postgres" {
+  length  = 32
+  special = false
+}
+
+resource "random_password" "kan_auth" {
+  length  = 32
+  special = false
+}
+
 # Single secrets manager secret for all cluster secrets
 resource "aws_secretsmanager_secret" "dumpnet" {
   name        = var.cluster_name
@@ -19,6 +29,12 @@ resource "aws_secretsmanager_secret_version" "dumpnet" {
       talosconfig           = data.talos_client_configuration.this.talos_config
       kubeconfig            = talos_cluster_kubeconfig.this.kubeconfig_raw
     }
+    postgres = {
+      password = random_password.postgres.result
+    }
+    kan = {
+      better_auth_secret = random_password.kan_auth.result
+    }
   })
 }
 

terraform/iam.tf

@@ -39,3 +39,21 @@ resource "aws_iam_role_policy" "node_s3_logs" {
     ]
   })
 }
+
+# Secrets Manager access for External Secrets Operator
+resource "aws_iam_role_policy" "node_secrets_manager" {
+  name = "secrets-manager-read"
+  role = aws_iam_role.node.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect   = "Allow"
+        Action   = ["secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret"]
+        Resource = aws_secretsmanager_secret.dumpnet.arn
+      }
+    ]
+  })
+}
+