Add external secrets operator

charts/external-secrets/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: external-secrets-config
+description: ClusterSecretStore for AWS Secrets Manager via EC2 instance role
+type: application
+version: 0.1.0

charts/external-secrets/templates/cluster-secret-store.yaml

@@ -0,0 +1,12 @@
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: aws-secrets-manager
+spec:
+  provider:
+    aws:
+      service: SecretsManager
+      region: {{ .Values.awsRegion }}
+      auth:
+        # Uses EC2 instance role via IMDS (instance metadata service)
+        # No credentials needed - the node role has secretsmanager:GetSecretValue

charts/external-secrets/values.yaml

@@ -0,0 +1,4 @@
+# External Secrets Operator helm values
+# https://external-secrets.io/latest/introduction/getting-started/
+# Uses EC2 instance role for AWS auth - no credentials needed
+installCRDs: true

manifests/cluster/external-secrets.yaml

@@ -0,0 +1,54 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-secrets
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    - repoURL: https://forge.keane.sh/ian/dumpnet-argo.git
+      targetRevision: HEAD
+      ref: values
+    - repoURL: https://charts.external-secrets.io
+      chart: external-secrets
+      targetRevision: "*"
+      helm:
+        valueFiles:
+          - $values/charts/external-secrets/values.yaml
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-secrets
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-secrets-config
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    - repoURL: https://forge.keane.sh/ian/dumpnet-argo.git
+      targetRevision: HEAD
+      ref: values
+    - repoURL: https://forge.keane.sh/ian/dumpnet-argo.git
+      targetRevision: HEAD
+      path: charts/external-secrets
+      helm:
+        valueFiles:
+          - $values/values.yaml
+        releaseName: external-secrets-config
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-secrets
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

terraform/argocd.tf

@@ -5,6 +5,16 @@ resource "random_password" "argocd_admin" {
   override_special = "!#$%&*()-_=+[]{}?"
 }
 
+resource "random_password" "postgres" {
+  length  = 32
+  special = false
+}
+
+resource "random_password" "kan_auth" {
+  length  = 32
+  special = false
+}
+
 # Single secrets manager secret for all cluster secrets
 resource "aws_secretsmanager_secret" "dumpnet" {
   name        = var.cluster_name
@@ -19,6 +29,12 @@ resource "aws_secretsmanager_secret_version" "dumpnet" {
       talosconfig           = data.talos_client_configuration.this.talos_config
       kubeconfig            = talos_cluster_kubeconfig.this.kubeconfig_raw
     }
+    postgres = {
+      password = random_password.postgres.result
+    }
+    kan = {
+      better_auth_secret = random_password.kan_auth.result
+    }
   })
 }
 

terraform/iam.tf

@@ -39,3 +39,21 @@ resource "aws_iam_role_policy" "node_s3_logs" {
     ]
   })
 }
+
+# Secrets Manager access for External Secrets Operator
+resource "aws_iam_role_policy" "node_secrets_manager" {
+  name = "secrets-manager-read"
+  role = aws_iam_role.node.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect   = "Allow"
+        Action   = ["secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret"]
+        Resource = aws_secretsmanager_secret.dumpnet.arn
+      }
+    ]
+  })
+}
+