fix: add external secret for argocd oidc config

modules/kubernetes/argocd.tf

@@ -24,6 +24,7 @@ data "infisical_secrets" "common_secrets" {
   folder_path  = "/"
 }
 
+# An external-secret exists to manage drift
 resource "kubernetes_secret_v1" "oidc_secret" {
   metadata {
     name      = "oidc"

registry/clusters/dev/components/argocd.yaml

@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: argocd-components
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "30"
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/mrsimonemms/infrastructure
+    path: registry/components/argocd
+    targetRevision: HEAD
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

registry/clusters/prod/components/argocd.yaml

@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: argocd-components
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "30"
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/mrsimonemms/infrastructure
+    path: registry/components/argocd
+    targetRevision: HEAD
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

registry/components/argocd/secret.yaml

@@ -0,0 +1,22 @@
+# This secret is created by Terraform, but the external-secret is to manage drift
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: oidc
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "10"
+spec:
+  refreshInterval: 10s
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: infisical
+  target:
+    name: oidc
+  data:
+    - secretKey: clientId
+      remoteRef:
+        key: OIDC_CLIENT_ID
+    - secretKey: clientSecret
+      remoteRef:
+        key: OIDC_CLIENT_SECRET