GitLab Runner TokenをASCPを使ってAWS Secrets Managerから取得してみた(GitLab Runner on Amazon EKS)

gitlabUrl: https://example.com/
runnerToken: "<GitLab Runner Token>"
rbac:
  create: true
serviceAccount:
  create: true
  name: "gitlab-runner"

# Secrets Manager
resource "aws_secretsmanager_secret" "gitlab_token" {
  name        = "${var.prefix}-gitlab-token-${random_string.suffix.result}"
  description = "GitLab Token for CI/CD"
  tags        = local.tags
}


# GitLab Runner用IAM Role
resource "aws_iam_role" "gitlab_runner" {
  name               = "${var.prefix}-gitlab-runner"
  assume_role_policy = data.aws_iam_policy_document.eks_pod_assume_role.json
  tags               = local.tags
}

data "aws_iam_policy_document" "eks_pod_assume_role" {
  statement {
    actions = [
      "sts:AssumeRole",
      "sts:TagSession"
    ]

    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["pods.eks.amazonaws.com"]
    }
  }
}

resource "aws_iam_policy" "ascp" {
  name        = "${var.prefix}-ascp"
  description = "Policy for AWS Secrets and Configuration Provider"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "secretsmanager:GetSecretValue",
          "secretsmanager:DescribeSecret"
        ]
        Resource = [
          aws_secretsmanager_secret.gitlab_token.arn
        ]
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "ascp" {
  role       = aws_iam_role.gitlab_runner.name
  policy_arn = aws_iam_policy.ascp.arn
}

# GitLab RunnerからSecrets Managerを参照するため
resource "aws_eks_pod_identity_association" "gitlab_runner" {
  cluster_name    = module.eks.cluster_name
  namespace       = "gitlab-runner"
  service_account = "gitlab-runner"
  role_arn        = aws_iam_role.gitlab_runner.arn
}

aws secretsmanager create-secret \
  --name "gitlab-token-secret" \
  --secret-string '{"token":"<GitLab Runner Token>"}'

resource "helm_release" "secrets_store_csi_driver" {
  name       = "secrets-store-csi-driver"
  repository = "https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts"
  chart      = "secrets-store-csi-driver"
  namespace  = "kube-system"
}

resource "helm_release" "secrets_provider_aws" {
  //helm_release - helm - terraform: https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release
  name       = "secrets-provider-aws"
  repository = "https://aws.github.io/secrets-store-csi-driver-provider-aws"
  chart      = "secrets-store-csi-driver-provider-aws"
  namespace  = "kube-system"
  # GitLab Runnerノードにtaintsを設定しているため、tolerationsを設定
  # https://github.com/aws/secrets-store-csi-driver-provider-aws/issues/266
  values = [<<-EOF
tolerations:
  - operator: Exists
EOF
  ]

  depends_on = [
    helm_release.secrets_store_csi_driver
  ]
}

tolerations:
  - operator: Exists

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: gitlab-runner-secret-provider
  namespace: gitlab-runner
spec:
  provider: aws
  parameters:
    objects: |
      - objectName: "${secret_name}"  # AWS Secrets Managerに保存されているシークレットの名前
        objectType: "secretsmanager"
        jmesPath:
          - path: "token"
            objectAlias: "runner-token"  # ポッドにマウントするファイル名、GitLab Runner Helmチャートの仕様でrunner-tokenというファイル名にする必要がある
    usePodIdentity: "true"

resource "kubernetes_manifest" "gitlab_runner_token_secret_provider_class" {
  manifest = yamldecode(templatefile("${path.module}/templates/manifest/secret_provider_class.yaml", {
    secret_name = data.tfe_outputs.cluster.values.gitlab_token_secrets_name
  }))

  depends_on = [
    helm_release.secrets_provider_aws
  ]
}

gitlabUrl: https://gitlab.satomasaki.classmethod.info/
- runnerToken:
rbac:
  create: true
serviceAccount:
  create: true
  name: "gitlab-runner"
# 省略
+volumes:
+  - name: secrets-store-inline
+    csi:
+      driver: secrets-store.csi.k8s.io
+      readOnly: true
+      volumeAttributes:
+        secretProviderClass: "gitlab-runner-secret-provider"

+volumeMounts:
+  - name: secrets-store-inline
+    mountPath: "/secrets"
+    readOnly: true

helm upgrade gitlab/gitlab-runner gitlab-runenr -n gitlab-runner -f values.yaml

kubectl get pods

NAME                             READY   STATUS    RESTARTS   AGE
gitlab-runner-587597c865-9tjgt   1/1     Running   0          84m

kubectl exec -it <Pod名> -- cat /secrets/runner-token

<GitLab Runner Token>