Policy for access to secrets manager is not added to tekton bot

[babadofar]

When trying to use aws secrets manager for holding secrets, the role policy arn is not added to the tekton bot.
Should be added in the irsa.tf file around here https://github.com/jenkins-x/terraform-aws-eks-jx/blob/master/modules/cluster/irsa.tf#L46

module "iam_assumable_role_tekton_bot" {
  source                        = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
  version                       = "~> v3.8.0"
  create_role                   = var.create_tekton_role
  role_name                     = var.is_jx2 ? substr("tf-${var.cluster_name}-sa-role-tekton-bot-${local.generated_seed}", 0, 60) : "${local.cluster_trunc}-tekton-bot"
  provider_url                  = local.oidc_provider_url
  role_policy_arns              = var.create_tekton_role ? concat([aws_iam_policy.tekton-bot[0].arn], var.additional_tekton_role_policy_arns) : [""]
  oidc_fully_qualified_subjects = ["system:serviceaccount:${local.jenkins-x-namespace}:tekton-bot"]
}  

[babadofar]

I dont think the tekton bot policy is the correct place to fix this actually. The way we get this to work is by adding the policy to the workers. Not sure if that is the best way, but in case, that seems to be set here
https://github.com/jenkins-x/terraform-aws-eks-jx/blob/master/modules/cluster/main.tf#L129
https://registry.terraform.io/modules/terraform-aws-modules/eks/aws/latest#input_workers_additional_policies

[ankitm123]

I think tekton bot should have this policy, what issues did you have when you added it to the tekton bot?

[babadofar]

I never tried to set it on the tekton bot actually. A little confused by this, but I guess the policy needs to be set on the role, or assumed role for the service account for external secrets.

[ankitm123]

Yes, the assumed role is actually the tekton role, you can verify it by running aws sts get-caller-identity in any of your pipelines.