SamuelBagattin

datasources:
    datasources.yaml:
        apiVersion: 1
        datasources:
            - name: GitHub
              type: grafana-github-datasource
              readOnly: false
              secureJsonData:
                accessToken: ENC[AES256_GCM,data:ZK_/rtGO$539;2oc2w~~OVaMl$05y9686e7n4/l4Ot5Vl:~=ool:3@Vrrico2FCe8^c60ZFpPH68,tag:mpm1"39q&g%!xFV5^#cZ93C8==,type:str]
sops:

SamuelBagattin

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: grafana
spec:
  project: default
  source:
    repoURL: https://github.com/my-org/my-repo.git
    targetRevision: HEAD
    helm:

SamuelBagattin

server:
  config:
    helm.valuesFileSchemes: >-
      secrets

SamuelBagattin

datasources:
    datasources.yaml:
        apiVersion: 1
        datasources:
            - name: GitHub
              type: grafana-github-datasource
              readOnly: false
              secureJsonData:
                accessToken: ghp_pl33iuze8hd9bbz55

SamuelBagattin

---
creation_rules:
  - kms: 'arn:aws:kms:REGION:ACCOUNT:key/KEY_ID' # Change to the arn of your KMS CMK
    encrypted_regex: '^secureJsonData$'

SamuelBagattin

2022/04/04 00:00:00 {
  "Account": "999999999999",
  "Arn": "arn:aws:sts::999999999999:assumed-role/my-pod-role/my-app",
  "UserId": "IEHDGSBEHDISKGPCMXNSH:my-app"
}
2022/04/04 00:00:00 {
  "Buckets": [
    {
      "CreationDate": "2022-04-04T00:00:00Z",
      "Name": "my-bucket"

SamuelBagattin

// Requesting temporary credentials
identity, err := initStsClient.AssumeRoleWithWebIdentity(
  &sts.AssumeRoleWithWebIdentityInput{
    RoleArn:          aws.String(awsRoleArn),
    RoleSessionName:  aws.String("my-app"),
    WebIdentityToken: aws.String(string(awsWebIdentityToken)),
    DurationSeconds:  aws.Int64(3600),
  })
if err != nil {
  panic(err)

SamuelBagattin

// Session creation
sess := session.Must(session.NewSession())

// Create a new STS client to get temporary credentials
initStsClient := sts.New(sess)

// Get the SA token
awsWebIdentityTokenFile := os.Getenv("AWS_WEB_IDENTITY_TOKEN_FILE")

awsWebIdentityToken, err := ioutil.ReadFile(awsWebIdentityTokenFile)

SamuelBagattin

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: pod-identity-webhook
webhooks:
- admissionReviewVersions:
  - v1beta1
  clientConfig:
    caBundle: REDACTED
    url: https://127.0.0.1:23443/mutate

SamuelBagattin

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
  labels:
    app: my-pod
spec:
  serviceAccountName: my-serviceaccount
  containers:
    - image: ghcr.io/samuelbagattin/eks-irsa-example:master