2.3. 在 GitOps 仓库中存储 AWS Secret Manager 资源

流程

1. 安装 AWS Secrets Manager 供应商并添加资源：

   1. 在 GitOps 仓库中，创建一个目录并添加 aws-provider.yaml 文件，使用以下配置来部署 AWS Secret Manager 供应商的资源：

      重要

      SSCSI 驱动程序的 AWS Secret Manager 供应商是一个上游供应商。

      此配置会根据上游 AWS 文档中提供的配置进行修改，以便它可以与 OpenShift Container Platform 正常工作。对此配置的更改可能会影响功能。

      aws-provider.yaml 文件示例

      apiVersion: v1
      kind: ServiceAccount
      metadata:
        name: csi-secrets-store-provider-aws
        namespace: openshift-cluster-csi-drivers
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        name: csi-secrets-store-provider-aws-cluster-role
      rules:
      - apiGroups: [""]
        resources: ["serviceaccounts/token"]
        verbs: ["create"]
      - apiGroups: [""]
        resources: ["serviceaccounts"]
        verbs: ["get"]
      - apiGroups: [""]
        resources: ["pods"]
        verbs: ["get"]
      - apiGroups: [""]
        resources: ["nodes"]
        verbs: ["get"]
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        name: csi-secrets-store-provider-aws-cluster-rolebinding
      roleRef:
        apiGroup: rbac.authorization.k8s.io
        kind: ClusterRole
        name: csi-secrets-store-provider-aws-cluster-role
      subjects:
      - kind: ServiceAccount
        name: csi-secrets-store-provider-aws
        namespace: openshift-cluster-csi-drivers
      ---
      apiVersion: apps/v1
      kind: DaemonSet
      metadata:
        namespace: openshift-cluster-csi-drivers
        name: csi-secrets-store-provider-aws
        labels:
          app: csi-secrets-store-provider-aws
      spec:
        updateStrategy:
          type: RollingUpdate
        selector:
          matchLabels:
            app: csi-secrets-store-provider-aws
        template:
          metadata:
            labels:
              app: csi-secrets-store-provider-aws
          spec:
            serviceAccountName: csi-secrets-store-provider-aws
            hostNetwork: false
            containers:
              - name: provider-aws-installer
                image: public.ecr.aws/aws-secrets-manager/secrets-store-csi-driver-provider-aws:1.0.r2-50-g5b4aca1-2023.06.09.21.19
                imagePullPolicy: Always
                args:
                    - --provider-volume=/etc/kubernetes/secrets-store-csi-providers
                resources:
                  requests:
                    cpu: 50m
                    memory: 100Mi
                  limits:
                    cpu: 50m
                    memory: 100Mi
                securityContext:
                  privileged: true
                volumeMounts:
                  - mountPath: "/etc/kubernetes/secrets-store-csi-providers"
                    name: providervol
                  - name: mountpoint-dir
                    mountPath: /var/lib/kubelet/pods
                    mountPropagation: HostToContainer
            tolerations:
            - operator: Exists
            volumes:
              - name: providervol
                hostPath:
                  path: "/etc/kubernetes/secrets-store-csi-providers"
              - name: mountpoint-dir
                hostPath:
                  path: /var/lib/kubelet/pods
                  type: DirectoryOrCreate
            nodeSelector:
              kubernetes.io/os: linux

   2. 在 GitOps 仓库中添加 secret-provider-app.yaml 文件，为 AWS Secret Manager 创建应用程序和部署资源：

      secret-provider-app.yaml 文件示例

      apiVersion: argoproj.io/v1alpha1
      kind: Application
      metadata:
        name: secret-provider-app
        namespace: openshift-gitops
      spec:
        destination:
          namespace: openshift-cluster-csi-drivers
          server: https://kubernetes.default.svc
        project: default
        source:
          path: path/to/aws-provider/resources
          repoURL: https://github.com/<my-domain>/<gitops>.git 1
        syncPolicy:
          automated:
          prune: true
          selfHeal: true

      1

      更新 repoURL 字段的值，以指向您的 GitOps 存储库。

2. 将资源与默认的 Argo CD 实例同步，以在集群中部署这些资源：

   1. 在部署应用程序的 openshift-cluster-csi-drivers 命名空间中添加标签，以便 openshift-gitops 命名空间中的 Argo CD 实例可以管理它：

      $ oc label namespace openshift-cluster-csi-drivers argocd.argoproj.io/managed-by=openshift-gitops

   2. 将 GitOps 存储库中的资源应用到集群，包括您刚才推送的 aws-provider.yaml 文件：

      输出示例

      application.argoproj.io/argo-app created
      application.argoproj.io/secret-provider-app created
      ...