clean up some of the up resources

setup/catalogs.yaml

@@ -0,0 +1,18 @@
+apiVersion: deployments.plural.sh/v1alpha1
+kind: ServiceDeployment
+metadata:
+  name: catalogs
+  namespace: infra
+spec:
+  namespace: catalogs
+  git:
+    folder: setup
+    ref: main
+  repositoryRef:
+    kind: GitRepository
+    namespace: infra
+    name: scaffolds
+  clusterRef:
+    kind: Cluster
+    name: mgmt
+    namespace: infra

setup/pr-automation/cluster-creator.yaml

@@ -18,7 +18,7 @@ spec:
       destination: "bootstrap/clusters.yaml"
       external: false
   scmConnectionRef:
-    name: github  # you'll need to add this ScmConnection manually before this is functional
+    name: plural  # you'll need to add this ScmConnection manually before this is functional
   title: "Adding {{ context.cloud }} cluster: {{ context.name }}"
   message: "Adding {{ context.cloud }} cluster {{ context.name }} and registering it with Plural"
   identifier: [[ .Identifier ]] # REPLACEME with your own repo slug

setup/stacks/mgmt.yaml

@@ -0,0 +1,20 @@
+apiVersion: deployments.plural.sh/v1alpha1
+kind: InfrastructureStack
+metadata:
+  name: mgmt
+spec:
+  name: mgmt
+  detach: false
+  type: TERRAFORM
+  approval: true
+  manageState: false
+  actor: [email protected]
+  repositoryRef:
+    name: infra
+    namespace: infra
+  clusterRef:
+    name: mgmt
+    namespace: infra
+  git:
+    ref: main
+    folder: terraform/mgmt

terraform/clouds/aws/eks.tf

@@ -1,3 +1,13 @@
+data "aws_caller_identity" "current" {}
+
+data "aws_iam_session_context" "current" {
+  # This data source provides information on the IAM source role of an STS assumed role
+  # For non-role ARNs, this data source simply passes the ARN through issuer ARN
+  # Ref https://github.com/terraform-aws-modules/terraform-aws-eks/issues/2327#issuecomment-1355581682
+  # Ref https://github.com/hashicorp/terraform-provider-aws/issues/28381
+  arn = try(data.aws_caller_identity.current[0].arn, "")
+}
+
 module "eks" {
   source  = "terraform-aws-modules/eks/aws"
   version = "~> 19.0"
@@ -13,6 +23,11 @@ module "eks" {
 
   create_kms_key = true
 
+  kms_key_administrators = concat([
+    module.assumable_role_stacks.iam_role_arn,
+    try(data.aws_iam_session_context.current[0].issuer_arn, "")
+  ], var.additional_kms_administrators)
+
   # EKS Managed Node Group(s)
   eks_managed_node_group_defaults = merge(var.node_group_defaults,
     {ami_release_version = data.aws_ssm_parameter.eks_ami_release_version.value})

terraform/clouds/aws/variables.tf

@@ -106,4 +106,9 @@ variable "create_cloudwatch_log_group" {
 variable "monitoring_role" {
   type = string
   default = ""
+}
+
+variable "additional_kms_administrators" {
+  type = list(string)
+  default = [ ]
 }