Always provision source controller IRSA role with the cluster and allow for pulls through pull through cache

_sub/compute/k8s-fluxcd/dependencies.tf

@@ -59,3 +59,9 @@ spec:
 Place custom manifests in here. Make sure to place them in a folder named after the application
   EOT
 }
+
+data "aws_caller_identity" "this" {}
+
+data "aws_eks_cluster" "this" {
+  name = var.cluster_name
+}

_sub/compute/k8s-fluxcd/main.tf

@@ -28,11 +28,10 @@ resource "flux_bootstrap_git" "this" {
   path       = local.cluster_target_path
   version    = var.release_tag
   kustomization_override = templatefile("${path.module}/values/flux-system-patch.yaml", {
-    src_ctrl_arn = var.source_controller_role_arn
+    src_ctrl_arn = "arn:aws:iam::${data.aws_caller_identity.this.account_id}:role/${local.role_name}" # if module.source_controller_irsa.arn is used here, the provider will produce inconsistent plans and fail on first run
   })
 }
 
-
 # --------------------------------------------------
 # Flux CD Monitoring
 # --------------------------------------------------
@@ -131,3 +130,41 @@ resource "github_repository_file" "tenant_sync" {
   })
   overwrite_on_create = true
 }
+
+# Source controller IAM Role for Service Account (IRSA) to allow Flux to pull images from ECR.
+# Be mindfull of the weak coupling between the IAM role and the flux_bootstrap_git resource due to a bug in the flux provider.
+locals {
+  role_name = "${var.cluster_name}-fluxcd-source-controller-ecr-reader"
+}
+
+module "source_controller_irsa" {
+  source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
+  version = "6.6.1"
+  name = local.role_name
+  use_name_prefix = false
+  oidc_providers = {
+    this = {
+      provider_arn               = "arn:aws:iam::${data.aws_caller_identity.this.account_id}:oidc-provider/${trim(data.aws_eks_cluster.this.identity[0].oidc[0].issuer, "https://")}"
+      namespace_service_accounts = ["flux-system:source-controller"]
+    }
+  }
+  policies = {
+    ecr-readonly = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
+  }
+}
+
+# Allow Flux to pull new images and tag through ECR pull through cache
+data "aws_iam_policy_document" "allow_ecr_pull_through_cache" {
+  statement {
+    sid = "ECRPullThroughCache"
+    effect = "Allow"
+    actions   = ["ecr:BatchImportUpstreamImage"]
+    resources = ["*"]
+  }
+}
+
+resource "aws_iam_role_policy" "allow_ecr_pull_through_cache" {
+  name = "fluxcd-source-controller-${var.cluster_name}-ecr-pull-through-cache"
+  role = module.source_controller_irsa.name
+  policy = data.aws_iam_policy_document.allow_ecr_pull_through_cache.json
+}

_sub/compute/k8s-fluxcd/values/flux-system-patch.yaml

@@ -36,7 +36,6 @@ patches:
       kind: Kustomization
       # trunk-ignore(yamllint/quoted-strings)
       name: "flux-system"
-%{ if src_ctrl_arn != "" }
   - patch: |
       apiVersion: v1
       kind: ServiceAccount
@@ -47,5 +46,4 @@ patches:
           eks.amazonaws.com/sts-regional-endpoints: "true"
     target:
       kind: ServiceAccount
-      name: source-controller
-%{ endif ~}
+      name: source-controller

_sub/compute/k8s-fluxcd/vars.tf

@@ -83,10 +83,4 @@ variable "tenants" {
   }))
   description = "List of tenants' namespaces and repository URLs"
   default     = []
-}
-
-variable "source_controller_role_arn" {
-  type        = string
-  default     = ""
-  description = "The ARN of the IAM role for the source controller. Used for IAM roles for service accounts (IRSA). Optional."
-}
+}

_sub/compute/k8s-fluxcd/versions.tf

@@ -14,6 +14,9 @@ terraform {
       source  = "fluxcd/flux"
       version = ">= 1.7.0"
     }
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 6.23.0"
+    }
   }
-
 }

compute/k8s-services/main.tf

@@ -466,7 +466,6 @@ module "platform_fluxcd" {
   cluster_ca_certificate     = base64decode(data.aws_eks_cluster.eks.certificate_authority[0].data)
   enable_monitoring          = local.grafana_deploy ? true : false
   tenants                    = var.fluxcd_tenants
-  source_controller_role_arn = var.fluxcd_source_controller_role_arn
 
   providers = {
     github = github.fluxcd

compute/k8s-services/vars.tf

@@ -194,12 +194,6 @@ variable "fluxcd_tenants" {
   default     = []
 }
 
-variable "fluxcd_source_controller_role_arn" {
-  type        = string
-  default     = ""
-  description = "The ARN of the IAM role for the source controller. Used for IAM roles for service accounts (IRSA). Optional."
-}
-
 # --------------------------------------------------
 # GitOps apps used by Flux CD
 # --------------------------------------------------