diff --git a/.github/actions/setup-ansible-env/action.yml b/.github/actions/setup-ansible-env/action.yml index c9b580e..9278d19 100644 --- a/.github/actions/setup-ansible-env/action.yml +++ b/.github/actions/setup-ansible-env/action.yml @@ -1,5 +1,19 @@ name: Setup Ansible Environment description: Prepare the environment for A13labs CI/CD pipelines +inputs: + vault-master-password: + description: "The master password for the vault" + required: true + ansible-user: + description: "The user to use for Ansible" + required: true + trusted-hosts: + description: "The list of trusted hosts" + required: true +outputs: + ssh-auth-sock: + description: "The SSH_AUTH_SOCK environment variable" + value: ${{ steps.start-ssh-agent.outputs.ssh-auth-sock }} runs: using: "composite" @@ -14,7 +28,7 @@ runs: - name: Setup SSH Key shell: bash env: - VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }} run: | sectool ssh unlock ansible mkdir -p ~/.ssh @@ -25,7 +39,7 @@ runs: - name: Read SSH Trusted Hosts keys shell: bash env: - TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }} + TRUSTED_HOSTS: ${{ inputs.trusted-hosts }} run: | mkdir -p ~/.ssh for HOST in $TRUSTED_HOSTS; do @@ -43,7 +57,7 @@ runs: - name: Start SSH Agent shell: bash env: - VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }} SSH_AUTH_SOCK: /tmp/ssh_agent.sock run: | ssh-agent -a $SSH_AUTH_SOCK > /dev/null @@ -54,8 +68,8 @@ runs: - name: Check SSH Connection to remote hosts shell: bash env: - TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }} - ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }} + TRUSTED_HOSTS: ${{ inputs.trusted-hosts }} + ANSIBLE_USER: ${{ inputs.ansible-user }} SSH_AUTH_SOCK: /tmp/ssh_agent.sock run: | for HOST in $TRUSTED_HOSTS; do diff --git a/.github/actions/setup-k8s-env/main.yml b/.github/actions/setup-k8s-env/main.yml index e9f4401..ba962ad 100644 --- a/.github/actions/setup-k8s-env/main.yml +++ b/.github/actions/setup-k8s-env/main.yml @@ -1,6 +1,12 @@ name: Setup K8S Environment description: Prepare the environment for A13labs CI/CD pipelines inputs: + vault-master-password: + description: "The master password for the vault" + required: true + ansible-user: + description: "The user to use for Ansible" + required: true k8s-target: description: "The target host to deploy the K8S applications" default: "microk8s" @@ -11,8 +17,8 @@ runs: - name: Copy Kube Config from remote host shell: bash env: - VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} - ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }} + VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }} + ANSIBLE_USER: ${{ inputs.ansible-user }} SSH_AUTH_SOCK: /tmp/ssh_agent.sock run: | mkdir -p ~/.kube @@ -21,7 +27,7 @@ runs: - name: Terraform Init shell: bash env: - VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }} run: | cd terraform/k8sapps sectool exec terraform init @@ -29,8 +35,8 @@ runs: - name: Terraform Apply shell: bash env: - VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} - ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }} + VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }} + ANSIBLE_USER: ${{ inputs.ansible-user }} SSH_AUTH_SOCK: /tmp/ssh_agent.sock run: | # Get Hostname and IP address of the target diff --git a/.github/workflows/actions-validate.yml b/.github/workflows/actions-validate.yml index b3d59e7..7f6c639 100644 --- a/.github/workflows/actions-validate.yml +++ b/.github/workflows/actions-validate.yml @@ -38,5 +38,30 @@ jobs: - name: Setup Terraform environment (TEST) uses: ./.github/actions/setup-terraform-env + test-setup-terraforms-k8s-actions: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Setup environment (TEST) + uses: ./.github/actions/setup-env + + - name: Setup Ansible environment (TEST) + uses: ./.github/actions/setup-ansible-env + + - name: Setup Terraform environment (TEST) + uses: ./.github/actions/setup-terraform-env + - name: Setup Kubernetes Environment (TEST) uses: ./.github/actions/setup-k8s-env + with: + vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }} + ansible_user: ${{ secrets.ANSIBLE_USER }} + + - name: Test kubectl get nodes + run: | + kubectl get nodes diff --git a/.github/workflows/ansible-apply-playbook.yml b/.github/workflows/ansible-apply-playbook.yml index 0c22ec7..7cd06a5 100644 --- a/.github/workflows/ansible-apply-playbook.yml +++ b/.github/workflows/ansible-apply-playbook.yml @@ -22,6 +22,10 @@ jobs: - name: Setup Ansible environment uses: ./.github/actions/setup-ansible-env + with: + vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }} + ansible_user: ${{ secrets.ANSIBLE_USER }} + trusted_hosts: ${{ secrets.TRUSTED_HOSTS }} - name: Apply the playbook that triggered the workflow env: @@ -31,5 +35,5 @@ jobs: run: | cd ansible for PLAYBOOK in $(echo $CHANGED_FILES | grep -oP 'playbook_\K\w+'); do - ansible-playbook -u $ANSIBLE_USER playbook_$PLAYBOOK.yml + sectool exec ansible-playbook -u $ANSIBLE_USER playbook_$PLAYBOOK.yml done diff --git a/.github/workflows/ansible-validate-playbook-on-pr.yml b/.github/workflows/ansible-validate-playbook-on-pr.yml index 46cf587..0d277c0 100644 --- a/.github/workflows/ansible-validate-playbook-on-pr.yml +++ b/.github/workflows/ansible-validate-playbook-on-pr.yml @@ -26,6 +26,10 @@ jobs: - name: Setup Ansible environment uses: ./.github/actions/setup-ansible-env + with: + vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }} + ansible_user: ${{ secrets.ANSIBLE_USER }} + trusted_hosts: ${{ secrets.TRUSTED_HOSTS }} - name: Apply the playbook that triggered the workflow env: @@ -35,5 +39,5 @@ jobs: run: | cd ansible for PLAYBOOK in $(echo $CHANGED_FILES | grep -oP 'playbook_\K\w+'); do - ansible-playbook -u $ANSIBLE_USER playbook_$PLAYBOOK.yml -CD + sectool exec ansible-playbook -u $ANSIBLE_USER playbook_$PLAYBOOK.yml -CD done diff --git a/.github/workflows/ansible-weekly-reconciliation.yml b/.github/workflows/ansible-weekly-reconciliation.yml index c35eb22..c952a91 100644 --- a/.github/workflows/ansible-weekly-reconciliation.yml +++ b/.github/workflows/ansible-weekly-reconciliation.yml @@ -19,6 +19,10 @@ jobs: - name: Setup Ansible environment uses: ./.github/actions/setup-ansible-env + with: + vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }} + ansible_user: ${{ secrets.ANSIBLE_USER }} + trusted_hosts: ${{ secrets.TRUSTED_HOSTS }} - name: Apply Hardening Playbook env: diff --git a/.github/workflows/terraform-microk8s-apply.yml b/.github/workflows/terraform-microk8s-apply.yml index a3823f7..6b8cdfa 100644 --- a/.github/workflows/terraform-microk8s-apply.yml +++ b/.github/workflows/terraform-microk8s-apply.yml @@ -22,12 +22,19 @@ jobs: - name: Setup Ansible Environment uses: ./.github/actions/setup-ansible-env + with: + vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }} + ansible_user: ${{ secrets.ANSIBLE_USER }} + trusted_hosts: ${{ secrets.TRUSTED_HOSTS }} - name: Setup Terraform Environment uses: ./.github/actions/setup-terraform-env - name: Setup Kubernetes Environment uses: ./.github/actions/setup-k8s-env + with: + vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }} + ansible_user: ${{ secrets.ANSIBLE_USER }} - name: Terraform Init env: diff --git a/.github/workflows/terraform-microk8s-validate.yml b/.github/workflows/terraform-microk8s-validate.yml index 4d29ae4..033e75b 100644 --- a/.github/workflows/terraform-microk8s-validate.yml +++ b/.github/workflows/terraform-microk8s-validate.yml @@ -20,68 +20,11 @@ jobs: with: fetch-depth: 0 - - name: Setup Terraform - uses: hashicorp/setup-terraform@v1 - with: - terraform_version: 1.9.6 + - name: Setup environment + uses: ./.github/actions/setup-env - - name: Setup Sectool - uses: a13labs/setup-sectool@v1 - - - name: Install Python and required packages - run: | - sudo apt-get update - sudo apt-get install -y python3-pip - python3 -m pip install -r requirements.txt - - - name: Setup SSH Key - env: - VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} - run: | - sectool ssh unlock ansible - mkdir -p ~/.ssh - chmod 700 ~/.ssh - cp ssh-keys/ansible/id_ecdsa ~/.ssh/id_ecdsa - chmod 600 ~/.ssh/id_ecdsa - - - name: Read SSH Trusted Hosts keys - env: - TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }} - run: | - mkdir -p ~/.ssh - for HOST in $TRUSTED_HOSTS; do - ssh-keyscan $HOST >> ~/.ssh/known_hosts - done - chmod 600 ~/.ssh/known_hosts - - - name: Start SSH Agent - env: - VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} - SSH_AUTH_SOCK: /tmp/ssh_agent.sock - run: | - ssh-agent -a $SSH_AUTH_SOCK > /dev/null - echo 'sectool vault get SSH_PASSWORD' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass - DISPLAY=None SSH_ASKPASS=~/.ssh_askpass ssh-add ~/.ssh/id_ecdsa < /dev/null - rm ~/.ssh_askpass - - - name: Check SSH Connection to remote hosts - env: - TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }} - ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }} - SSH_AUTH_SOCK: /tmp/ssh_agent.sock - run: | - for HOST in $TRUSTED_HOSTS; do - ssh $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful" - done - - - name: Copy Kube Config from remote host - env: - VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} - ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }} - SSH_AUTH_SOCK: /tmp/ssh_agent.sock - run: | - mkdir -p ~/.kube - ansible -i ansible/inventory/hosts -u $ANSIBLE_USER -m fetch -a "src=/home/$ANSIBLE_USER/.kube/config dest=~/.kube/config flat=yes" microk8s + - name: Setup Terraform Environment + uses: ./.github/actions/setup-terraform-env - name: Terraform Init and Validate env: