🤖 feat(terraform): add long-lived cluster-admin service account (#52)

## Summary
Adds Terraform-managed Kubernetes resources that create a dedicated
service account with a **long-lived (legacy) token Secret** (not a
projected service account token) and grants it **cluster-admin**
permissions.

## Implementation
- Adds the `hashicorp/kubernetes` provider and configures it against the
EKS endpoint.
- Creates:
  - Namespace `k8s-auth`
  - ServiceAccount `mux-admin-tf`
- Secret `mux-admin-tf-token` of type
`kubernetes.io/service-account-token` (with
`wait_for_service_account_token = true`)
  - ClusterRoleBinding binding `cluster-admin` to the service account
- Outputs a **sensitive** kubeconfig
(`cluster_admin_service_account_kubeconfig`) that authenticates using
the token from the Secret.

## Validation
- `terraform fmt`
- `terraform init`
- `terraform plan`
- `terraform apply`
- `kubectl --kubeconfig <generated> get nodes -o wide`

## Risks
- This grants **cluster-admin** to a long-lived token; intended as a
temporary bootstrap mechanism.

---

_Generated with `mux` • Model: `openai:gpt-5.2` • Thinking: `xhigh` •
Cost: `$0.92`_

<!-- mux-attribution: model=openai:gpt-5.2 thinking=xhigh costs=0.92 -->

Author: ibetitsmike

terraform/.terraform.lock.hcl

@@ -0,0 +1,113 @@
+locals {
+  eks_get_token_args = concat(
+    [
+      "eks",
+      "get-token",
+      "--region",
+      var.aws_region,
+      "--cluster-name",
+      aws_eks_cluster.this.name,
+      "--output",
+      "json",
+    ],
+    var.aws_profile == null ? [] : ["--profile", var.aws_profile],
+  )
+}
+
+provider "kubernetes" {
+  host                   = aws_eks_cluster.this.endpoint
+  cluster_ca_certificate = base64decode(aws_eks_cluster.this.certificate_authority[0].data)
+
+  exec {
+    api_version = "client.authentication.k8s.io/v1beta1"
+    command     = "aws"
+    args        = local.eks_get_token_args
+  }
+}
+
+resource "kubernetes_namespace_v1" "cluster_admin" {
+  metadata {
+    name = var.cluster_admin_namespace
+  }
+}
+
+resource "kubernetes_service_account_v1" "cluster_admin" {
+  metadata {
+    name      = var.cluster_admin_service_account_name
+    namespace = kubernetes_namespace_v1.cluster_admin.metadata[0].name
+  }
+}
+
+resource "kubernetes_secret_v1" "cluster_admin_token" {
+  metadata {
+    name      = "${var.cluster_admin_service_account_name}-token"
+    namespace = kubernetes_namespace_v1.cluster_admin.metadata[0].name
+
+    annotations = {
+      "kubernetes.io/service-account.name" = kubernetes_service_account_v1.cluster_admin.metadata[0].name
+    }
+  }
+
+  type                           = "kubernetes.io/service-account-token"
+  wait_for_service_account_token = true
+}
+
+resource "kubernetes_cluster_role_binding_v1" "cluster_admin" {
+  metadata {
+    name = "${var.cluster_admin_service_account_name}-cluster-admin"
+  }
+
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "ClusterRole"
+    name      = "cluster-admin"
+  }
+
+  subject {
+    api_group = ""
+    kind      = "ServiceAccount"
+    name      = kubernetes_service_account_v1.cluster_admin.metadata[0].name
+    namespace = kubernetes_service_account_v1.cluster_admin.metadata[0].namespace
+  }
+}
+
+locals {
+  cluster_admin_context_name = "${aws_eks_cluster.this.name}-${var.cluster_admin_service_account_name}"
+
+  cluster_admin_kubeconfig = yamlencode({
+    apiVersion = "v1"
+    kind       = "Config"
+
+    clusters = [
+      {
+        name = aws_eks_cluster.this.name
+        cluster = {
+          server                       = aws_eks_cluster.this.endpoint
+          "certificate-authority-data" = aws_eks_cluster.this.certificate_authority[0].data
+        }
+      },
+    ]
+
+    users = [
+      {
+        name = var.cluster_admin_service_account_name
+        user = {
+          token = kubernetes_secret_v1.cluster_admin_token.data["token"]
+        }
+      },
+    ]
+
+    contexts = [
+      {
+        name = local.cluster_admin_context_name
+        context = {
+          cluster   = aws_eks_cluster.this.name
+          user      = var.cluster_admin_service_account_name
+          namespace = var.cluster_admin_namespace
+        }
+      },
+    ]
+
+    "current-context" = local.cluster_admin_context_name
+  })
+}

terraform/kubernetes_admin.tf

@@ -29,6 +29,27 @@ output "kubeconfig_command" {
   value       = "aws eks update-kubeconfig --region ${var.aws_region} --name ${aws_eks_cluster.this.name}"
 }
 
+output "cluster_admin_service_account_namespace" {
+  description = "Namespace for the long-lived cluster-admin service account."
+  value       = kubernetes_namespace_v1.cluster_admin.metadata[0].name
+}
+
+output "cluster_admin_service_account_name" {
+  description = "Name of the long-lived cluster-admin service account."
+  value       = kubernetes_service_account_v1.cluster_admin.metadata[0].name
+}
+
+output "cluster_admin_service_account_token_secret_name" {
+  description = "Kubernetes Secret name that holds the long-lived service account token."
+  value       = kubernetes_secret_v1.cluster_admin_token.metadata[0].name
+}
+
+output "cluster_admin_service_account_kubeconfig" {
+  description = "Kubeconfig that authenticates using the long-lived service account token (not a projected token)."
+  value       = local.cluster_admin_kubeconfig
+  sensitive   = true
+}
+
 output "vpc_id" {
   description = "VPC ID used by the EKS cluster."
   value       = aws_vpc.this.id

terraform/outputs.tf

@@ -35,3 +35,15 @@ variable "vpc_cidr" {
   }
 }
 
+variable "cluster_admin_namespace" {
+  description = "Namespace for the long-lived cluster-admin service account."
+  type        = string
+  default     = "k8s-auth"
+}
+
+variable "cluster_admin_service_account_name" {
+  description = "Service account name used for long-lived cluster-admin access (backed by a token Secret)."
+  type        = string
+  default     = "mux-admin-tf"
+}
+

terraform/variables.tf

@@ -13,6 +13,11 @@ terraform {
       source  = "hashicorp/aws"
       version = "~> 6.0"
     }
+
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "~> 2.0"
+    }
   }
 }