Samuel Bagattin SamuelBagattin

🏠

Personal projects

Senior Cloud Engineer

SamuelBagattin / medium-sops-kms-argocd-secretsyaml-encrypted.yaml

Created September 19, 2022 17:05

	datasources:
	datasources.yaml:
	apiVersion: 1
	datasources:
	- name: GitHub
	type: grafana-github-datasource
	readOnly: false
	secureJsonData:
	accessToken: ENC[AES256_GCM,data:ZK_/rtGO$539;2oc2w~~OVaMl$05y9686e7n4/l4Ot5Vl:~=ool:3@Vrrico2FCe8^c60ZFpPH68,tag:mpm1"39q&g%!xFV5^#cZ93C8==,type:str]
	sops:

SamuelBagattin / medium-sops-kms-argocd-argocd-application.yaml

Created September 19, 2022 15:41

	apiVersion: argoproj.io/v1alpha1
	kind: Application
	metadata:
	name: grafana
	spec:
	project: default
	source:
	repoURL: https://github.com/my-org/my-repo.git
	targetRevision: HEAD
	helm:

SamuelBagattin / medium-sops-kms-argocd-argocd-server-helm-values.yaml

Created September 19, 2022 10:14

SamuelBagattin / medium-sops-kms-argocd-secretsyaml-unencrypted.yaml

Created September 19, 2022 09:31

	datasources:
	datasources.yaml:
	apiVersion: 1
	datasources:
	- name: GitHub
	type: grafana-github-datasource
	readOnly: false
	secureJsonData:
	accessToken: ghp_pl33iuze8hd9bbz55

SamuelBagattin / medium-sops-kms-argocd-sops.yaml

Created September 19, 2022 07:13

	---
	creation_rules:
	- kms: 'arn:aws:kms:REGION:ACCOUNT:key/KEY_ID' # Change to the arn of your KMS CMK
	encrypted_regex: '^secureJsonData$'

SamuelBagattin / irsa_app_sample_output.txt

Created April 4, 2022 17:45

	2022/04/04 00:00:00 {
	"Account": "999999999999",
	"Arn": "arn:aws:sts::999999999999:assumed-role/my-pod-role/my-app",
	"UserId": "IEHDGSBEHDISKGPCMXNSH:my-app"
	}
	2022/04/04 00:00:00 {
	"Buckets": [
	{
	"CreationDate": "2022-04-04T00:00:00Z",
	"Name": "my-bucket"

SamuelBagattin / irsa_app_2.go

Created April 4, 2022 17:36

	// Requesting temporary credentials
	identity, err := initStsClient.AssumeRoleWithWebIdentity(
	&sts.AssumeRoleWithWebIdentityInput{
	RoleArn: aws.String(awsRoleArn),
	RoleSessionName: aws.String("my-app"),
	WebIdentityToken: aws.String(string(awsWebIdentityToken)),
	DurationSeconds: aws.Int64(3600),
	})
	if err != nil {
	panic(err)

SamuelBagattin / irsa_app_1.go

Created April 4, 2022 17:26

	// Session creation
	sess := session.Must(session.NewSession())

	// Create a new STS client to get temporary credentials
	initStsClient := sts.New(sess)

	// Get the SA token
	awsWebIdentityTokenFile := os.Getenv("AWS_WEB_IDENTITY_TOKEN_FILE")

	awsWebIdentityToken, err := ioutil.ReadFile(awsWebIdentityTokenFile)

SamuelBagattin / irsa_pod_identity_webhook.yml

Created April 4, 2022 10:03

	apiVersion: admissionregistration.k8s.io/v1
	kind: MutatingWebhookConfiguration
	metadata:
	name: pod-identity-webhook
	webhooks:
	- admissionReviewVersions:
	- v1beta1
	clientConfig:
	caBundle: REDACTED
	url: https://127.0.0.1:23443/mutate

SamuelBagattin / irsa_pod.yml

Last active April 5, 2022 08:23

	apiVersion: v1
	kind: Pod
	metadata:
	name: my-pod
	labels:
	app: my-pod
	spec:
	serviceAccountName: my-serviceaccount
	containers:
	- image: ghcr.io/samuelbagattin/eks-irsa-example:master