Create ArgoCD's pipeline token with Terraform

camptocamp · Nov 22, 2020 · 9569db5 · 9569db5
1 parent 370c987
commit 9569db5
Show file tree

Hide file tree

Showing 8 changed files with 66 additions and 25 deletions.
diff --git a/modules/argocd-helm/main.tf b/modules/argocd-helm/main.tf
@@ -1,3 +1,18 @@
+locals {
+  iat = 1605854613 # An arbitrary Unix timestamp before than now
+
+  argocd_accounts_pipeline_tokens = jsonencode(
+    [
+      {
+        id  = random_uuid.accounts_pipeline_token_id.result
+        iat = local.iat
+      }
+    ]
+  )
+}
+
+resource "random_uuid" "accounts_pipeline_token_id" {}
+
 resource "helm_release" "argocd" {
   name              = "argocd"
   chart             = "${path.module}/../../argocd/argocd"
@@ -7,5 +22,12 @@ resource "helm_release" "argocd" {
 
   values = [
     file("${path.module}/../../argocd/argocd/values.yaml"),
+    <<EOT
+    argo-cd:
+      configs:
+        secret:
+          extra:
+            accounts.pipeline.tokens: '${local.argocd_accounts_pipeline_tokens}'
+    EOT
   ]
 }
diff --git a/modules/argocd-helm/outputs.tf b/modules/argocd-helm/outputs.tf
@@ -0,0 +1,4 @@
+output "argocd_accounts_pipeline_tokens" {
+  description = "The token created for the pipeline."
+  value       = local.argocd_accounts_pipeline_tokens
+}
diff --git a/modules/eks-aws/main.tf b/modules/eks-aws/main.tf
@@ -126,9 +126,10 @@ resource "helm_release" "app_of_apps" {
   values = [
     templatefile("${path.module}/values.tmpl.yaml",
       {
-        cluster_name                    = var.cluster_name,
-        base_domain                     = var.base_domain,
-        repo_url                        = var.repo_url,
+        cluster_name                    = var.cluster_name
+        base_domain                     = var.base_domain
+        repo_url                        = var.repo_url
+        argocd_accounts_pipeline_tokens = module.argocd.argocd_accounts_pipeline_tokens
         target_revision                 = var.target_revision,
         aws_default_region              = data.aws_region.current.name,
         cert_manager_assumable_role_arn = module.iam_assumable_role_cert_manager.this_iam_role_arn,

diff --git a/modules/eks-aws/values.tmpl.yaml b/modules/eks-aws/values.tmpl.yaml
@@ -11,6 +11,10 @@ apps:
     enabled: ${enable_efs}
 
 argo-cd:
+  configs:
+    secret:
+      extra:
+        accounts.pipeline.tokens: '${argocd_accounts_pipeline_tokens}'
   controller:
     metrics:
       enabled: true

diff --git a/modules/k3os-libvirt/main.tf b/modules/k3os-libvirt/main.tf
@@ -47,17 +47,18 @@ resource "helm_release" "app_of_apps" {
   values = [
     templatefile("${path.module}/values.tmpl.yaml",
       {
-        cluster_name     = var.cluster_name,
-        base_domain      = local.base_domain,
-        repo_url         = var.repo_url,
-        target_revision  = var.target_revision,
-        clientid         = "applications"
-        clientsecret     = random_password.clientsecret.result
-        admin_password   = random_password.admin_password.result
-        cookie_secret    = random_password.cookie_secret.result
-        enable_minio     = var.enable_minio
-        minio_access_key = var.enable_minio ? random_password.minio_accesskey.0.result : ""
-        minio_secret_key = var.enable_minio ? random_password.minio_secretkey.0.result : ""
+        cluster_name                    = var.cluster_name
+        base_domain                     = local.base_domain
+        repo_url                        = var.repo_url
+        target_revision                 = var.target_revision
+        argocd_accounts_pipeline_tokens = module.argocd.argocd_accounts_pipeline_tokens
+        clientid                        = "applications"
+        clientsecret                    = random_password.clientsecret.result
+        admin_password                  = random_password.admin_password.result
+        cookie_secret                   = random_password.cookie_secret.result
+        enable_minio                    = var.enable_minio
+        minio_access_key                = var.enable_minio ? random_password.minio_accesskey.0.result : ""
+        minio_secret_key                = var.enable_minio ? random_password.minio_secretkey.0.result : ""
       }
     ),
     var.app_of_apps_values_overrides,

diff --git a/modules/k3os-libvirt/values.tmpl.yaml b/modules/k3os-libvirt/values.tmpl.yaml
@@ -33,6 +33,10 @@ minio:
         hosts:
           - minio.apps.${base_domain}
 argo-cd:
+  configs:
+    secret:
+      extra:
+        accounts.pipeline.tokens: '${argocd_accounts_pipeline_tokens}'
   controller:
     metrics:
       enabled: true

diff --git a/modules/k3s-docker/main.tf b/modules/k3s-docker/main.tf
@@ -44,17 +44,18 @@ resource "helm_release" "app_of_apps" {
   values = [
     templatefile("${path.module}/values.tmpl.yaml",
       {
-        cluster_name     = var.cluster_name,
-        base_domain      = local.base_domain,
-        repo_url         = var.repo_url,
-        target_revision  = var.target_revision,
-        clientid         = "applications"
-        clientsecret     = random_password.clientsecret.result
-        admin_password   = random_password.admin_password.result
-        cookie_secret    = random_password.cookie_secret.result
-        enable_minio     = var.enable_minio
-        minio_access_key = var.enable_minio ? random_password.minio_accesskey.0.result : ""
-        minio_secret_key = var.enable_minio ? random_password.minio_secretkey.0.result : ""
+        cluster_name                    = var.cluster_name
+        base_domain                     = local.base_domain
+        repo_url                        = var.repo_url
+        target_revision                 = var.target_revision
+        argocd_accounts_pipeline_tokens = module.argocd.argocd_accounts_pipeline_tokens
+        clientid                        = "applications"
+        clientsecret                    = random_password.clientsecret.result
+        admin_password                  = random_password.admin_password.result
+        cookie_secret                   = random_password.cookie_secret.result
+        enable_minio                    = var.enable_minio
+        minio_access_key                = var.enable_minio ? random_password.minio_accesskey.0.result : ""
+        minio_secret_key                = var.enable_minio ? random_password.minio_secretkey.0.result : ""
       }
     ),
     var.app_of_apps_values_overrides,

diff --git a/modules/k3s-docker/values.tmpl.yaml b/modules/k3s-docker/values.tmpl.yaml
@@ -34,6 +34,10 @@ minio:
           - minio.apps.${base_domain}
 
 argo-cd:
+  configs:
+    secret:
+      extra:
+        accounts.pipeline.tokens: '${argocd_accounts_pipeline_tokens}'
   controller:
     metrics:
       enabled: true