feat(openstack): use External Secrets for service account

This doesn't change any code or the actual service account that is being
used but it defines it in a way that can be consumed by external secrets
and sets the pathway for us to generate this in the future. We'd need
either an operator to action on the service account secrets to keystone
or some other way to keep them in sync.

components/openstack/kustomization.yaml

@@ -6,6 +6,11 @@ resources:
   - mariadb-configmap.yaml
   - mariadb-instance.yaml
   - openstack-cluster.yaml
+  # a secret store that let's us copy creds to other namespaces
+  # for service accounts
+  - secretstore-openstack.yaml
+  # defines the service account 'argoworkflow' used by our workflows
+  - svc-acct-argoworkflow.yaml
 
 helmCharts:
   - name: memcached

components/openstack/secretstore-openstack.yaml

@@ -0,0 +1,65 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: eso-openstack
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  annotations:
+    kubernetes.io/service-account.name: eso-openstack
+  name: eso-openstack.service-account-token
+type: kubernetes.io/service-account-token
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: eso-openstack-role
+rules:
+- apiGroups: [""]
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+  resourceNames:
+  - svc-acct-argoworkflow
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - selfsubjectrulesreviews
+  verbs:
+  - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: eso-openstack-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: eso-openstack-role
+subjects:
+- kind: ServiceAccount
+  name: eso-openstack
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: openstack
+spec:
+  provider:
+    kubernetes:
+      remoteNamespace: openstack
+      server:
+        caProvider:
+          type: ConfigMap
+          name: kube-root-ca.crt
+          key: ca.crt
+          namespace: openstack
+      auth:
+        serviceAccount:
+          name: eso-openstack
+          namespace: openstack

components/openstack/svc-acct-argoworkflow.yaml

@@ -0,0 +1,28 @@
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Fake
+metadata:
+  name: svc-acct-argoworkflow
+spec:
+  data:
+    # this provider needs to go away for a generated account
+    # but it currently must be in sync with the keystone bootstrap
+    # script
+    # this should be the 'service' domain in the future
+    user_domain: default
+    username: argoworkflow
+    password: demo
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: svc-acct-argoworkflow
+spec:
+  refreshInterval: 1h
+  target:
+    name: svc-acct-argoworkflow
+  dataFrom:
+  - sourceRef:
+      generatorRef:
+        apiVersion: generators.external-secrets.io/v1alpha1
+        kind: Fake
+        name: svc-acct-argoworkflow