alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Refactor file path in actions-validate.yml and add input parameters for vault master password, ansible user, and trusted hosts

Browse Source
This commit is contained in:
Alexandre Pires
2024-09-29 18:33:44 +02:00
parent 60e2d7476a
commit 095c73b97e
8 changed files with 80 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/actions/setup-ansible-env/action.yml
+19 -5
View File
@@ -1,5 +1,19 @@
name: Setup Ansible Environment
description: Prepare the environment for A13labs CI/CD pipelines
inputs:
vault-master-password:
description: "The master password for the vault"
required: true
ansible-user:
description: "The user to use for Ansible"
required: true
trusted-hosts:
description: "The list of trusted hosts"
required: true
outputs:
ssh-auth-sock:
description: "The SSH_AUTH_SOCK environment variable"
value: ${{ steps.start-ssh-agent.outputs.ssh-auth-sock }}
runs:
using: "composite"
@@ -14,7 +28,7 @@ runs:
- name: Setup SSH Key
shell: bash
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }}
run: |
sectool ssh unlock ansible
mkdir -p ~/.ssh
@@ -25,7 +39,7 @@ runs:
- name: Read SSH Trusted Hosts keys
shell: bash
env:
TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
TRUSTED_HOSTS: ${{ inputs.trusted-hosts }}
run: |
mkdir -p ~/.ssh
for HOST in $TRUSTED_HOSTS; do
@@ -43,7 +57,7 @@ runs:
- name: Start SSH Agent
shell: bash
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
run: |
ssh-agent -a $SSH_AUTH_SOCK > /dev/null
@@ -54,8 +68,8 @@ runs:
- name: Check SSH Connection to remote hosts
shell: bash
env:
TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
TRUSTED_HOSTS: ${{ inputs.trusted-hosts }}
ANSIBLE_USER: ${{ inputs.ansible-user }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
run: |
for HOST in $TRUSTED_HOSTS; do
.github/actions/setup-k8s-env/main.yml
+11 -5
View File
@@ -1,6 +1,12 @@
name: Setup K8S Environment
description: Prepare the environment for A13labs CI/CD pipelines
inputs:
vault-master-password:
description: "The master password for the vault"
required: true
ansible-user:
description: "The user to use for Ansible"
required: true
k8s-target:
description: "The target host to deploy the K8S applications"
default: "microk8s"
@@ -11,8 +17,8 @@ runs:
- name: Copy Kube Config from remote host
shell: bash
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }}
ANSIBLE_USER: ${{ inputs.ansible-user }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
run: |
mkdir -p ~/.kube
@@ -21,7 +27,7 @@ runs:
- name: Terraform Init
shell: bash
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }}
run: |
cd terraform/k8sapps
sectool exec terraform init
@@ -29,8 +35,8 @@ runs:
- name: Terraform Apply
shell: bash
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }}
ANSIBLE_USER: ${{ inputs.ansible-user }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
run: |
# Get Hostname and IP address of the target
.github/workflows/actions-validate.yml
+25
View File
@@ -38,5 +38,30 @@ jobs:
- name: Setup Terraform environment (TEST)
uses: ./.github/actions/setup-terraform-env
test-setup-terraforms-k8s-actions:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Setup environment (TEST)
uses: ./.github/actions/setup-env
- name: Setup Ansible environment (TEST)
uses: ./.github/actions/setup-ansible-env
- name: Setup Terraform environment (TEST)
uses: ./.github/actions/setup-terraform-env
- name: Setup Kubernetes Environment (TEST)
uses: ./.github/actions/setup-k8s-env
with:
vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }}
ansible_user: ${{ secrets.ANSIBLE_USER }}
- name: Test kubectl get nodes
run: |
kubectl get nodes
.github/workflows/ansible-apply-playbook.yml
+5 -1
View File
@@ -22,6 +22,10 @@ jobs:
- name: Setup Ansible environment
uses: ./.github/actions/setup-ansible-env
with:
vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }}
ansible_user: ${{ secrets.ANSIBLE_USER }}
trusted_hosts: ${{ secrets.TRUSTED_HOSTS }}
- name: Apply the playbook that triggered the workflow
env:
@@ -31,5 +35,5 @@ jobs:
run: |
cd ansible
for PLAYBOOK in $(echo $CHANGED_FILES | grep -oP 'playbook_\K\w+'); do
ansible-playbook -u $ANSIBLE_USER playbook_$PLAYBOOK.yml
sectool exec ansible-playbook -u $ANSIBLE_USER playbook_$PLAYBOOK.yml
done
.github/workflows/ansible-validate-playbook-on-pr.yml
+5 -1
View File
@@ -26,6 +26,10 @@ jobs:
- name: Setup Ansible environment
uses: ./.github/actions/setup-ansible-env
with:
vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }}
ansible_user: ${{ secrets.ANSIBLE_USER }}
trusted_hosts: ${{ secrets.TRUSTED_HOSTS }}
- name: Apply the playbook that triggered the workflow
env:
@@ -35,5 +39,5 @@ jobs:
run: |
cd ansible
for PLAYBOOK in $(echo $CHANGED_FILES | grep -oP 'playbook_\K\w+'); do
ansible-playbook -u $ANSIBLE_USER playbook_$PLAYBOOK.yml -CD
sectool exec ansible-playbook -u $ANSIBLE_USER playbook_$PLAYBOOK.yml -CD
done
.github/workflows/ansible-weekly-reconciliation.yml
+4
View File
@@ -19,6 +19,10 @@ jobs:
- name: Setup Ansible environment
uses: ./.github/actions/setup-ansible-env
with:
vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }}
ansible_user: ${{ secrets.ANSIBLE_USER }}
trusted_hosts: ${{ secrets.TRUSTED_HOSTS }}
- name: Apply Hardening Playbook
env:
.github/workflows/terraform-microk8s-apply.yml
+7
View File
@@ -22,12 +22,19 @@ jobs:
- name: Setup Ansible Environment
uses: ./.github/actions/setup-ansible-env
with:
vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }}
ansible_user: ${{ secrets.ANSIBLE_USER }}
trusted_hosts: ${{ secrets.TRUSTED_HOSTS }}
- name: Setup Terraform Environment
uses: ./.github/actions/setup-terraform-env
- name: Setup Kubernetes Environment
uses: ./.github/actions/setup-k8s-env
with:
vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }}
ansible_user: ${{ secrets.ANSIBLE_USER }}
- name: Terraform Init
env:
.github/workflows/terraform-microk8s-validate.yml
+4 -61
View File
@@ -20,68 +20,11 @@ jobs:
with:
fetch-depth: 0
- name: Setup Terraform
uses: hashicorp/setup-terraform@v1
with:
terraform_version: 1.9.6
- name: Setup environment
uses: ./.github/actions/setup-env
- name: Setup Sectool
uses: a13labs/setup-sectool@v1
- name: Install Python and required packages
run: |
sudo apt-get update
sudo apt-get install -y python3-pip
python3 -m pip install -r requirements.txt
- name: Setup SSH Key
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
run: |
sectool ssh unlock ansible
mkdir -p ~/.ssh
chmod 700 ~/.ssh
cp ssh-keys/ansible/id_ecdsa ~/.ssh/id_ecdsa
chmod 600 ~/.ssh/id_ecdsa
- name: Read SSH Trusted Hosts keys
env:
TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
run: |
mkdir -p ~/.ssh
for HOST in $TRUSTED_HOSTS; do
ssh-keyscan $HOST >> ~/.ssh/known_hosts
done
chmod 600 ~/.ssh/known_hosts
- name: Start SSH Agent
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
run: |
ssh-agent -a $SSH_AUTH_SOCK > /dev/null
echo 'sectool vault get SSH_PASSWORD' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass
DISPLAY=None SSH_ASKPASS=~/.ssh_askpass ssh-add ~/.ssh/id_ecdsa < /dev/null
rm ~/.ssh_askpass
- name: Check SSH Connection to remote hosts
env:
TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
run: |
for HOST in $TRUSTED_HOSTS; do
ssh $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful"
done
- name: Copy Kube Config from remote host
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
run: |
mkdir -p ~/.kube
ansible -i ansible/inventory/hosts -u $ANSIBLE_USER -m fetch -a "src=/home/$ANSIBLE_USER/.kube/config dest=~/.kube/config flat=yes" microk8s
- name: Setup Terraform Environment
uses: ./.github/actions/setup-terraform-env
- name: Terraform Init and Validate
env: