alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Refactor file path in actions-validate.yml and add input parameters for vault master password, ansible user, and trusted hosts

Browse Source
This commit is contained in:
Alexandre Pires
2024-09-29 18:33:44 +02:00
parent 60e2d7476a
commit 095c73b97e
8 changed files with 80 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/actions-validate.yml
+25
View File
@@ -38,5 +38,30 @@ jobs:
- name: Setup Terraform environment (TEST)
uses: ./.github/actions/setup-terraform-env
test-setup-terraforms-k8s-actions:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Setup environment (TEST)
uses: ./.github/actions/setup-env
- name: Setup Ansible environment (TEST)
uses: ./.github/actions/setup-ansible-env
- name: Setup Terraform environment (TEST)
uses: ./.github/actions/setup-terraform-env
- name: Setup Kubernetes Environment (TEST)
uses: ./.github/actions/setup-k8s-env
with:
vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }}
ansible_user: ${{ secrets.ANSIBLE_USER }}
- name: Test kubectl get nodes
run: |
kubectl get nodes
.github/workflows/ansible-apply-playbook.yml
+5 -1
View File
@@ -22,6 +22,10 @@ jobs:
- name: Setup Ansible environment
uses: ./.github/actions/setup-ansible-env
with:
vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }}
ansible_user: ${{ secrets.ANSIBLE_USER }}
trusted_hosts: ${{ secrets.TRUSTED_HOSTS }}
- name: Apply the playbook that triggered the workflow
env:
@@ -31,5 +35,5 @@ jobs:
run: |
cd ansible
for PLAYBOOK in $(echo $CHANGED_FILES | grep -oP 'playbook_\K\w+'); do
ansible-playbook -u $ANSIBLE_USER playbook_$PLAYBOOK.yml
sectool exec ansible-playbook -u $ANSIBLE_USER playbook_$PLAYBOOK.yml
done
.github/workflows/ansible-validate-playbook-on-pr.yml
+5 -1
View File
@@ -26,6 +26,10 @@ jobs:
- name: Setup Ansible environment
uses: ./.github/actions/setup-ansible-env
with:
vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }}
ansible_user: ${{ secrets.ANSIBLE_USER }}
trusted_hosts: ${{ secrets.TRUSTED_HOSTS }}
- name: Apply the playbook that triggered the workflow
env:
@@ -35,5 +39,5 @@ jobs:
run: |
cd ansible
for PLAYBOOK in $(echo $CHANGED_FILES | grep -oP 'playbook_\K\w+'); do
ansible-playbook -u $ANSIBLE_USER playbook_$PLAYBOOK.yml -CD
sectool exec ansible-playbook -u $ANSIBLE_USER playbook_$PLAYBOOK.yml -CD
done
.github/workflows/ansible-weekly-reconciliation.yml
+4
View File
@@ -19,6 +19,10 @@ jobs:
- name: Setup Ansible environment
uses: ./.github/actions/setup-ansible-env
with:
vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }}
ansible_user: ${{ secrets.ANSIBLE_USER }}
trusted_hosts: ${{ secrets.TRUSTED_HOSTS }}
- name: Apply Hardening Playbook
env:
.github/workflows/terraform-microk8s-apply.yml
+7
View File
@@ -22,12 +22,19 @@ jobs:
- name: Setup Ansible Environment
uses: ./.github/actions/setup-ansible-env
with:
vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }}
ansible_user: ${{ secrets.ANSIBLE_USER }}
trusted_hosts: ${{ secrets.TRUSTED_HOSTS }}
- name: Setup Terraform Environment
uses: ./.github/actions/setup-terraform-env
- name: Setup Kubernetes Environment
uses: ./.github/actions/setup-k8s-env
with:
vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }}
ansible_user: ${{ secrets.ANSIBLE_USER }}
- name: Terraform Init
env:
.github/workflows/terraform-microk8s-validate.yml
+4 -61
View File
@@ -20,68 +20,11 @@ jobs:
with:
fetch-depth: 0
- name: Setup Terraform
uses: hashicorp/setup-terraform@v1
with:
terraform_version: 1.9.6
- name: Setup environment
uses: ./.github/actions/setup-env
- name: Setup Sectool
uses: a13labs/setup-sectool@v1
- name: Install Python and required packages
run: |
sudo apt-get update
sudo apt-get install -y python3-pip
python3 -m pip install -r requirements.txt
- name: Setup SSH Key
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
run: |
sectool ssh unlock ansible
mkdir -p ~/.ssh
chmod 700 ~/.ssh
cp ssh-keys/ansible/id_ecdsa ~/.ssh/id_ecdsa
chmod 600 ~/.ssh/id_ecdsa
- name: Read SSH Trusted Hosts keys
env:
TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
run: |
mkdir -p ~/.ssh
for HOST in $TRUSTED_HOSTS; do
ssh-keyscan $HOST >> ~/.ssh/known_hosts
done
chmod 600 ~/.ssh/known_hosts
- name: Start SSH Agent
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
run: |
ssh-agent -a $SSH_AUTH_SOCK > /dev/null
echo 'sectool vault get SSH_PASSWORD' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass
DISPLAY=None SSH_ASKPASS=~/.ssh_askpass ssh-add ~/.ssh/id_ecdsa < /dev/null
rm ~/.ssh_askpass
- name: Check SSH Connection to remote hosts
env:
TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
run: |
for HOST in $TRUSTED_HOSTS; do
ssh $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful"
done
- name: Copy Kube Config from remote host
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
run: |
mkdir -p ~/.kube
ansible -i ansible/inventory/hosts -u $ANSIBLE_USER -m fetch -a "src=/home/$ANSIBLE_USER/.kube/config dest=~/.kube/config flat=yes" microk8s
- name: Setup Terraform Environment
uses: ./.github/actions/setup-terraform-env
- name: Terraform Init and Validate
env: