feat(flux): add github webhook receiver

kubernetes/flux-system/app/receiver.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: notification.toolkit.fluxcd.io/v1
+kind: Receiver
+metadata:
+  namespace: flux-system
+  name: homelab
+spec:
+  type: github
+  events:
+    - "ping"
+    - "push"
+  secretRef:
+    name: webhook-token
+  resources:
+    - apiVersion: source.toolkit.fluxcd.io/v1
+      kind: GitRepository
+      name: homelab

kubernetes/flux-system/app/release.yaml

@@ -0,0 +1,52 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  namespace: flux-system
+  name: flux2
+spec:
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: fluxcd-community
+      chart: flux2
+      version: 2.13.0
+  install:
+    crds: CreateReplace
+  upgrade:
+    crds: CreateReplace
+  interval: 1h
+  maxHistory: 1
+  timeout: 1m0s
+  values:
+    installCRDs: true
+    policies:
+      create: false
+    notificationController:
+      serviceAccount:
+        create: true
+        automount: true
+        annotations:
+          eks.amazonaws.com/role-arn: arn:aws:iam::262264826613:role/amethyst-notification-controller
+          eks.amazonaws.com/audience: sts.amazonaws.com
+      volumes:
+        - name: &n webhook-token
+          csi:
+            driver: secrets-store.csi.k8s.io
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: *n
+      volumeMounts:
+        - name: *n
+          mountPath: /secret
+          readOnly: true
+      webhookReceiver:
+        ingress:
+          create: true
+          ingressClassName: nginx
+          hosts:
+            - host: flux.timtor.dev
+              paths:
+                - path: /
+                  pathType: ImplementationSpecific

kubernetes/flux-system/app/repo.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  namespace: flux-system
+  name: fluxcd-community
+spec:
+  url: https://fluxcd-community.github.io/helm-charts
+  interval: 24h

kubernetes/flux-system/app/secret.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  namespace: flux-system
+  name: &name webhook-token
+spec:
+  provider: aws
+  parameters:
+    region: us-west-2
+    objects: |
+      - objectType: ssmparameter
+        objectName: /kubernetes/flux-system/webhook-token
+        jmesPath:
+          - path: TOKEN
+            objectAlias: TOKEN
+  secretObjects:
+    - secretName: *name
+      type: Opaque
+      data:
+        - key: token
+          objectName: TOKEN

kubernetes/flux-system/kustomization.yaml

@@ -2,6 +2,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - _namespace.yaml
-  - flux2.yaml
-  - boostrap.yaml
+  - base/ns.yaml
+  - app/repo.yaml
+  - app/release.yaml
+  - app/boostrap.yaml
+  - app/receiver.yaml
+  - app/secret.yaml

terraform/aws-kubernetes-irsa.tf

@@ -1,3 +1,46 @@
+resource "aws_iam_role" "notification-controller" {
+  name = "${local.project}-notification-controller"
+  assume_role_policy = jsonencode({
+    "Version" : "2012-10-17",
+    "Statement" : [
+      {
+        "Effect" : "Allow",
+        "Principal" : {
+          "Federated" : "${aws_iam_openid_connect_provider.kubernetes-oidc.arn}"
+        },
+        "Action" : "sts:AssumeRoleWithWebIdentity",
+        "Condition" : {
+          "StringEquals" : {
+            "${aws_iam_openid_connect_provider.kubernetes-oidc.url}:sub" : "system:serviceaccount:flux-system:notification-controller",
+            "${aws_iam_openid_connect_provider.kubernetes-oidc.url}:aud" : "sts.amazonaws.com"
+          }
+        }
+      }
+    ]
+  })
+}
+
+resource "aws_iam_policy" "notification-controller" {
+  name = "${local.project}-notification-controller"
+  policy = jsonencode({
+    "Version" : "2012-10-17",
+    "Statement" : [
+      {
+        "Action" : "ssm:GetParameters",
+        "Effect" : "Allow",
+        "Resource" : [
+          "arn:aws:ssm:${data.aws_region.main.name}:${data.aws_caller_identity.main.account_id}:parameter/kubernetes/flux-system/webhook-token"
+        ]
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "notification-controller" {
+  role       = aws_iam_role.notification-controller.name
+  policy_arn = aws_iam_policy.notification-controller.arn
+}
+
 resource "aws_iam_role" "cert-manager" {
   name = "${local.project}-cert-manager"
   assume_role_policy = jsonencode({