From 9569db56301f20afc4c3b3a186703bea5fed138e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micka=C3=ABl=20Can=C3=A9vet?= <mickael.canevet@gmail.com>
Date: Sun, 22 Nov 2020 09:47:06 +0100
Subject: [PATCH] Create ArgoCD's pipeline token with Terraform

---
 modules/argocd-helm/main.tf           | 22 ++++++++++++++++++++++
 modules/argocd-helm/outputs.tf        |  4 ++++
 modules/eks-aws/main.tf               |  7 ++++---
 modules/eks-aws/values.tmpl.yaml      |  4 ++++
 modules/k3os-libvirt/main.tf          | 23 ++++++++++++-----------
 modules/k3os-libvirt/values.tmpl.yaml |  4 ++++
 modules/k3s-docker/main.tf            | 23 ++++++++++++-----------
 modules/k3s-docker/values.tmpl.yaml   |  4 ++++
 8 files changed, 66 insertions(+), 25 deletions(-)
 create mode 100644 modules/argocd-helm/outputs.tf

diff --git a/modules/argocd-helm/main.tf b/modules/argocd-helm/main.tf
index 3bf798e739..6e202b8eeb 100644
--- a/modules/argocd-helm/main.tf
+++ b/modules/argocd-helm/main.tf
@@ -1,3 +1,18 @@
+locals {
+  iat = 1605854613 # An arbitrary Unix timestamp before than now
+
+  argocd_accounts_pipeline_tokens = jsonencode(
+    [
+      {
+        id  = random_uuid.accounts_pipeline_token_id.result
+        iat = local.iat
+      }
+    ]
+  )
+}
+
+resource "random_uuid" "accounts_pipeline_token_id" {}
+
 resource "helm_release" "argocd" {
   name              = "argocd"
   chart             = "${path.module}/../../argocd/argocd"
@@ -7,5 +22,12 @@ resource "helm_release" "argocd" {
 
   values = [
     file("${path.module}/../../argocd/argocd/values.yaml"),
+    <<EOT
+    argo-cd:
+      configs:
+        secret:
+          extra:
+            accounts.pipeline.tokens: '${local.argocd_accounts_pipeline_tokens}'
+    EOT
   ]
 }
diff --git a/modules/argocd-helm/outputs.tf b/modules/argocd-helm/outputs.tf
new file mode 100644
index 0000000000..d3a0a79b64
--- /dev/null
+++ b/modules/argocd-helm/outputs.tf
@@ -0,0 +1,4 @@
+output "argocd_accounts_pipeline_tokens" {
+  description = "The token created for the pipeline."
+  value       = local.argocd_accounts_pipeline_tokens
+}
diff --git a/modules/eks-aws/main.tf b/modules/eks-aws/main.tf
index 6722290527..839b7b0801 100644
--- a/modules/eks-aws/main.tf
+++ b/modules/eks-aws/main.tf
@@ -126,9 +126,10 @@ resource "helm_release" "app_of_apps" {
   values = [
     templatefile("${path.module}/values.tmpl.yaml",
       {
-        cluster_name                    = var.cluster_name,
-        base_domain                     = var.base_domain,
-        repo_url                        = var.repo_url,
+        cluster_name                    = var.cluster_name
+        base_domain                     = var.base_domain
+        repo_url                        = var.repo_url
+        argocd_accounts_pipeline_tokens = module.argocd.argocd_accounts_pipeline_tokens
         target_revision                 = var.target_revision,
         aws_default_region              = data.aws_region.current.name,
         cert_manager_assumable_role_arn = module.iam_assumable_role_cert_manager.this_iam_role_arn,
diff --git a/modules/eks-aws/values.tmpl.yaml b/modules/eks-aws/values.tmpl.yaml
index 38f5a64470..d0545895b0 100644
--- a/modules/eks-aws/values.tmpl.yaml
+++ b/modules/eks-aws/values.tmpl.yaml
@@ -11,6 +11,10 @@ apps:
     enabled: ${enable_efs}
 
 argo-cd:
+  configs:
+    secret:
+      extra:
+        accounts.pipeline.tokens: '${argocd_accounts_pipeline_tokens}'
   controller:
     metrics:
       enabled: true
diff --git a/modules/k3os-libvirt/main.tf b/modules/k3os-libvirt/main.tf
index effd1fa355..dbfc439ee4 100644
--- a/modules/k3os-libvirt/main.tf
+++ b/modules/k3os-libvirt/main.tf
@@ -47,17 +47,18 @@ resource "helm_release" "app_of_apps" {
   values = [
     templatefile("${path.module}/values.tmpl.yaml",
       {
-        cluster_name     = var.cluster_name,
-        base_domain      = local.base_domain,
-        repo_url         = var.repo_url,
-        target_revision  = var.target_revision,
-        clientid         = "applications"
-        clientsecret     = random_password.clientsecret.result
-        admin_password   = random_password.admin_password.result
-        cookie_secret    = random_password.cookie_secret.result
-        enable_minio     = var.enable_minio
-        minio_access_key = var.enable_minio ? random_password.minio_accesskey.0.result : ""
-        minio_secret_key = var.enable_minio ? random_password.minio_secretkey.0.result : ""
+        cluster_name                    = var.cluster_name
+        base_domain                     = local.base_domain
+        repo_url                        = var.repo_url
+        target_revision                 = var.target_revision
+        argocd_accounts_pipeline_tokens = module.argocd.argocd_accounts_pipeline_tokens
+        clientid                        = "applications"
+        clientsecret                    = random_password.clientsecret.result
+        admin_password                  = random_password.admin_password.result
+        cookie_secret                   = random_password.cookie_secret.result
+        enable_minio                    = var.enable_minio
+        minio_access_key                = var.enable_minio ? random_password.minio_accesskey.0.result : ""
+        minio_secret_key                = var.enable_minio ? random_password.minio_secretkey.0.result : ""
       }
     ),
     var.app_of_apps_values_overrides,
diff --git a/modules/k3os-libvirt/values.tmpl.yaml b/modules/k3os-libvirt/values.tmpl.yaml
index 24789d33eb..823dffef03 100644
--- a/modules/k3os-libvirt/values.tmpl.yaml
+++ b/modules/k3os-libvirt/values.tmpl.yaml
@@ -33,6 +33,10 @@ minio:
         hosts:
           - minio.apps.${base_domain}
 argo-cd:
+  configs:
+    secret:
+      extra:
+        accounts.pipeline.tokens: '${argocd_accounts_pipeline_tokens}'
   controller:
     metrics:
       enabled: true
diff --git a/modules/k3s-docker/main.tf b/modules/k3s-docker/main.tf
index f26b2cff56..555a40efc9 100644
--- a/modules/k3s-docker/main.tf
+++ b/modules/k3s-docker/main.tf
@@ -44,17 +44,18 @@ resource "helm_release" "app_of_apps" {
   values = [
     templatefile("${path.module}/values.tmpl.yaml",
       {
-        cluster_name     = var.cluster_name,
-        base_domain      = local.base_domain,
-        repo_url         = var.repo_url,
-        target_revision  = var.target_revision,
-        clientid         = "applications"
-        clientsecret     = random_password.clientsecret.result
-        admin_password   = random_password.admin_password.result
-        cookie_secret    = random_password.cookie_secret.result
-        enable_minio     = var.enable_minio
-        minio_access_key = var.enable_minio ? random_password.minio_accesskey.0.result : ""
-        minio_secret_key = var.enable_minio ? random_password.minio_secretkey.0.result : ""
+        cluster_name                    = var.cluster_name
+        base_domain                     = local.base_domain
+        repo_url                        = var.repo_url
+        target_revision                 = var.target_revision
+        argocd_accounts_pipeline_tokens = module.argocd.argocd_accounts_pipeline_tokens
+        clientid                        = "applications"
+        clientsecret                    = random_password.clientsecret.result
+        admin_password                  = random_password.admin_password.result
+        cookie_secret                   = random_password.cookie_secret.result
+        enable_minio                    = var.enable_minio
+        minio_access_key                = var.enable_minio ? random_password.minio_accesskey.0.result : ""
+        minio_secret_key                = var.enable_minio ? random_password.minio_secretkey.0.result : ""
       }
     ),
     var.app_of_apps_values_overrides,
diff --git a/modules/k3s-docker/values.tmpl.yaml b/modules/k3s-docker/values.tmpl.yaml
index 1e0bbbace5..44e95ef642 100644
--- a/modules/k3s-docker/values.tmpl.yaml
+++ b/modules/k3s-docker/values.tmpl.yaml
@@ -34,6 +34,10 @@ minio:
           - minio.apps.${base_domain}
 
 argo-cd:
+  configs:
+    secret:
+      extra:
+        accounts.pipeline.tokens: '${argocd_accounts_pipeline_tokens}'
   controller:
     metrics:
       enabled: true