ci: share IRSA to pr namespace ServiceAccount

[paulfouquet]

Motivation

The PR namespace Service Account needs a IRSA (IAM Role for ServiceAccount) to be able to do some operations on buckets and assume other shared roles.

ServiceAccount in the argo namespace:

Name:                workflow-runner-sa
Namespace:           argo
Labels:              app.kubernetes.io/name=workflow-runner-sa
                     aws.cdk.eks/prune-abc
Annotations:         eks.amazonaws.com/role-arn: arn:aws:iam::012345678910:role/Workflows-EksWorkflowsArgoRunnerServiceAccountRole-abc
Image pull secrets:  <none>
Mountable secrets:   <none>
Tokens:              <none>
Events:              <none>

ServiceAccount in the pr-* namespace:

Name:                workflow-runner-sa
Namespace:           pr-*
Labels:              <none>
Annotations:         <none>
Image pull secrets:  <none>
Mountable secrets:   <none>
Tokens:              <none>
Events:              <none>

Modifications

• Create a IRSA for the pr-* ServiceAccounts
• Modify the ServiceAccount creation template to allow passing this IRSA as a GH secret

TODO

Deploy:

Verification

TODO

[paulfouquet]

Putting this PR on hold (Draft) as it is not complying with security requirements:

Any production secrets must be defined in an environment that is only accessible by the main/master branch.