feat: add pattern for ArgoCD workloads in AWS CodeCommit

[ybezsonov]

Issue #, if available:

Description of changes:

• add pattern for ArgoCD workloads in AWS CodeCommit
• setup to trigger ArgoCD projects sync on git push to AWS CodeCommit repository

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[ybezsonov]

@shapirov103 @elamaran11
I closed old PR, reworked the pattern and created new PR. I created documentation and the flow is similar to other patterns.

[shapirov103]

@ybezsonov
Awesome work!

I was able to validate end to end.

I have a couple of minor comments inline with the code/docs.

One thing that I wanted to bring up as a suggestion: for our patterns we follow the rule of "zero trust", meaning customers should not require any mutating access to the cluster (like creation of secrets, etc.), everything is done through IaC.

To align with that, please consider the following refactoring:

1. Create IAM user using CLI, then generate credentials and store them as a secret (along with username and url).
2. Pass the secret name with the bootstrapRepo to ArgoCD addon as described in the private repos section.
3. You can still look up the user in the stack and grant pull permission.

The above is just a suggestion, I will be happy to merge as is, since this functionality is awesome and I can reuse some of it in the workshops now.

[shapirov103]

minor - file names should be lower case, "-" delimited.

[ybezsonov]

fixed.

[shapirov103]

let's call out that AWS_REGION env var must be defined (or add a statement to initialize it from local config if not defined).

[ybezsonov]

fixed.

[ybezsonov]

@shapirov103 Thank you!
I found a solution to create CodeCommit credentials using cdk custom resources and now all the required resources for ArgoCD are created within the stack. Outside of the stack I just clone the repository and create notification trigger from CodeCommit to ArgoCD.
It also gives a possibility to delete all the resources (user, credentials) during the deletion of the stack.

[shapirov103]

Great work, bar-raising, thank you for this contribution!

(validated e2e with a clean stack, all works).