Merge branch 'refs/heads/master' into feat/add-pdal-workflow-TDE-1649

Author: schmidtnz

.github/workflows/main.yml

@@ -37,26 +37,32 @@ jobs:
     if: ${{ github.ref == 'refs/heads/master' }}
     environment:
       name: prod
+
     permissions:
       id-token: write
       contents: read
+
     env:
       CLUSTER_NAME: Workflows
+
     steps:
       - uses: linz/action-typescript@9bf69b0f313b3525d3ba3116f26b1aff7eb7a6c0 # v3.1.0
         with:
           node-version: 20.x
+
       # Configure access to AWS / EKS
       - name: Setup kubectl
         uses: azure/setup-kubectl@3e0aec4d80787158d308d7b364cb1b702e7feb7f # v3
         with:
           version: 'latest'
+
       - name: AWS Configure
         uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4
         with:
           aws-region: ap-southeast-2
           mask-aws-account-id: true
           role-to-assume: ${{ secrets.AWS_CI_ROLE }}
+
       - name: Find Changes in Infra
         id: get-infra-changes
         run: |
@@ -66,31 +72,39 @@ jobs:
           else
             echo "run_infra=false" >> "$GITHUB_OUTPUT"
           fi
+
       - name: (CDK) Deploy
         if: steps.get-infra-changes.outputs.run_infra == 'true'
         run: |
           npx cdk deploy ${{ env.CLUSTER_NAME }} \
-            -c maintainer-arns=${{ secrets.AWS_CI_ROLE }},${{ secrets.AWS_ADMIN_ROLE }},${{ secrets.AWS_WFMAINTAINER_ROLE }} \
+            -c maintainer-arns=${{ secrets.AWS_CI_ROLE }},${{ secrets.AWS_ADMIN_ROLE }},${{ secrets.AWS_ADMIN_SSO_ROLE }},${{ secrets.AWS_WFMAINTAINER_ROLE }} \
             -c aws-account-id=${{ secrets.AWS_ACCOUNT_ID }} \
             --require-approval never
+        env:
+          NODE_ENV: production
+
       - name: Login to EKS
         run: |
           aws eks update-kubeconfig --name ${{ env.CLUSTER_NAME }} --region ap-southeast-2
+
       - name: Check EKS connection
         run: |
           kubectl get nodes
+
       # Configure the Kubernetes cluster with CDK8s
       - name: (CDK8s) Synth
         if: steps.get-infra-changes.outputs.run_infra == 'true'
         run: |
           npx cdk8s synth
           # nb: kubectl diff - is somewhat dangerous as it dumps out secrets in plain text
           # so it should not be used in this pipeline
+
       # TODO use a --prune and --applyset to remove unused objects
       - name: (CDK8s) Deploy
         if: steps.get-infra-changes.outputs.run_infra == 'true'
         run: |
           kubectl apply -f dist/
+
       - name: Deploy workflows
         if: github.ref == 'refs/heads/master'
         run: |
@@ -118,12 +132,14 @@ jobs:
           for cwf in $CRON_WORKFLOWS; do
               kubectl apply -f "$cwf" --namespace argo
           done
+
       - name: Install Argo
         if: steps.get-infra-changes.outputs.run_infra == 'true'
         run: |
           curl --location --remote-name --silent "${{ env.ARGO_URL }}"
           gunzip argo-linux-amd64.gz
           chmod +x argo-linux-amd64
+
       - name: Smoke test
         if: steps.get-infra-changes.outputs.run_infra == 'true'
         run: |

infra/cdk.ts

@@ -1,3 +1,4 @@
+import { applyTags, SecurityClassification } from '@linzjs/cdk-tags';
 import { App } from 'aws-cdk-lib';
 
 import { ClusterName, DefaultRegion } from './constants.js';
@@ -22,7 +23,7 @@ async function main(): Promise<void> {
     throw new Error("Missing AWS Account information, set with either '-c aws-account-id' or $CDK_DEFAULT_ACCOUNT");
   }
 
-  new LinzEksCluster(app, ClusterName, {
+  const cluster = new LinzEksCluster(app, ClusterName, {
     env: { region: DefaultRegion, account: accountId },
     maintainerRoleArns,
     slackChannelConfigurationName: ssmConfig.slackChannelConfigurationName,
@@ -31,6 +32,15 @@ async function main(): Promise<void> {
     s3BatchRestoreRoleArn: ssmConfig.s3BatchRestoreRoleArn,
   });
 
+  applyTags(cluster, {
+    application: 'argo',
+    environment: process.env['NODE_ENV'] === 'production' ? 'prod' : 'nonprod',
+    group: 'li',
+    impact: 'moderate',
+    classification: SecurityClassification.Unclassified,
+    responderTeam: 'LI - Geospatial Data Engineering',
+  });
+
   app.synth();
 }
 

infra/eks/cluster.ts

@@ -154,9 +154,13 @@ export class LinzEksCluster extends Stack {
     for (const roleArn of props.maintainerRoleArns) {
       const roleId = `MaintainerRole-${createHash('sha256').update(roleArn).digest('hex').slice(0, 12)}`;
       const role = Role.fromRoleArn(this, roleId, roleArn, { defaultPolicyName: this.stackName });
-      role.addToPrincipalPolicy(
-        new iam.PolicyStatement({ actions: ['eks:DescribeCluster'], resources: [this.cluster.clusterArn] }),
-      );
+      if (!roleArn.includes('AWSReservedSSO_')) {
+        role.addToPrincipalPolicy(
+          new iam.PolicyStatement({ actions: ['eks:DescribeCluster'], resources: [this.cluster.clusterArn] }),
+        );
+      } else {
+        console.warn(`Skipping policy attachment for SSO-managed role: ${roleArn}`);
+      }
       this.cluster.awsAuth.addMastersRole(role);
     }