Add the feature to use AWS IRSA instead of secret keys

[felipeng]

It would be nice to use AWS IRSA on ServiceAccounts to access AWS Services like (RDS, SES, S3) instead of creating secret keys and set them in values.yaml

[adonskoy]

It is already possible. Add IRSA annotation for service account in values

For example:

serviceAccount:
  enabled: true
  name: sentry-sa
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::000000000000:role/sentry-role

[felipeng]

awesome! can you confirm that with IRSA is possible to access all services such as: RDS, SES and S3?

[adonskoy]

This will only work for S3. Access to Postgres is possible only by standard methods (django does not support RDS). Only the SMTP protocol is available for email in sentry, so it also requires a password.

I'm passing sensitive information to sentry via external-secrets-operator which retrieves data from AWS Secrets Manager

[felipeng]

For the email, maybe this could work, but I will need to find a way to install that dependency.

I am also using ESO, but I would like to use IRSA only