Refactor file path in actions-validate.yml and add input parameters for vault master password, ansible user, and trusted hosts

.github/actions/setup-ansible-env/action.yml

@@ -1,5 +1,19 @@
 name: Setup Ansible Environment
 description: Prepare the environment for A13labs CI/CD pipelines
+inputs:
+  vault-master-password:
+    description: "The master password for the vault"
+    required: true
+  ansible-user:
+    description: "The user to use for Ansible"
+    required: true
+  trusted-hosts:
+    description: "The list of trusted hosts"
+    required: true
+outputs:
+  ssh-auth-sock:
+    description: "The SSH_AUTH_SOCK environment variable"
+    value: ${{ steps.start-ssh-agent.outputs.ssh-auth-sock }}
 
 runs:
   using: "composite"
@@ -14,7 +28,7 @@ runs:
     - name: Setup SSH Key
       shell: bash
       env:
-        VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }}
       run: |
         sectool ssh unlock ansible
         mkdir -p ~/.ssh
@@ -25,7 +39,7 @@ runs:
     - name: Read SSH Trusted Hosts keys
       shell: bash
       env:
-        TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
+        TRUSTED_HOSTS: ${{ inputs.trusted-hosts }}
       run: |
         mkdir -p ~/.ssh
         for HOST in $TRUSTED_HOSTS; do
@@ -43,7 +57,7 @@ runs:
     - name: Start SSH Agent
       shell: bash
       env:
-        VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }}
         SSH_AUTH_SOCK: /tmp/ssh_agent.sock
       run: |
         ssh-agent -a $SSH_AUTH_SOCK > /dev/null
@@ -54,8 +68,8 @@ runs:
     - name: Check SSH Connection to remote hosts
       shell: bash
       env:
-        TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
+        TRUSTED_HOSTS: ${{ inputs.trusted-hosts }}
-        ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
+        ANSIBLE_USER: ${{ inputs.ansible-user }}
         SSH_AUTH_SOCK: /tmp/ssh_agent.sock
       run: |
         for HOST in $TRUSTED_HOSTS; do

.github/actions/setup-k8s-env/main.yml

@@ -1,6 +1,12 @@
 name: Setup K8S Environment
 description: Prepare the environment for A13labs CI/CD pipelines
 inputs:
+  vault-master-password:
+    description: "The master password for the vault"
+    required: true
+  ansible-user:
+    description: "The user to use for Ansible"
+    required: true
   k8s-target:
     description: "The target host to deploy the K8S applications"
     default: "microk8s"
@@ -11,8 +17,8 @@ runs:
     - name: Copy Kube Config from remote host
       shell: bash
       env:
-        VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }}
-        ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
+        ANSIBLE_USER: ${{ inputs.ansible-user }}
         SSH_AUTH_SOCK: /tmp/ssh_agent.sock
       run: |
         mkdir -p ~/.kube
@@ -21,7 +27,7 @@ runs:
     - name: Terraform Init
       shell: bash
       env:
-        VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }}
       run: |
         cd terraform/k8sapps
         sectool exec terraform init
@@ -29,8 +35,8 @@ runs:
     - name: Terraform Apply
       shell: bash
       env:
-        VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }}
-        ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
+        ANSIBLE_USER: ${{ inputs.ansible-user }}
         SSH_AUTH_SOCK: /tmp/ssh_agent.sock
       run: |
         # Get Hostname and IP address of the target

.github/workflows/actions-validate.yml

@@ -38,5 +38,30 @@ jobs:
       - name: Setup Terraform environment (TEST)
         uses: ./.github/actions/setup-terraform-env
 
+  test-setup-terraforms-k8s-actions:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup environment (TEST)
+        uses: ./.github/actions/setup-env
+
+      - name: Setup Ansible environment (TEST)
+        uses: ./.github/actions/setup-ansible-env
+
+      - name: Setup Terraform environment (TEST)
+        uses: ./.github/actions/setup-terraform-env
+
       - name: Setup Kubernetes Environment (TEST)
         uses: ./.github/actions/setup-k8s-env
+        with:
+          vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }}
+          ansible_user: ${{ secrets.ANSIBLE_USER }}
+
+      - name: Test kubectl get nodes
+        run: |
+          kubectl get nodes

.github/workflows/ansible-apply-playbook.yml

@@ -22,6 +22,10 @@ jobs:
 
       - name: Setup Ansible environment
         uses: ./.github/actions/setup-ansible-env
+        with:
+          vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }}
+          ansible_user: ${{ secrets.ANSIBLE_USER }}
+          trusted_hosts: ${{ secrets.TRUSTED_HOSTS }}
 
       - name: Apply the playbook that triggered the workflow
         env:
@@ -31,5 +35,5 @@ jobs:
         run: |
           cd ansible
           for PLAYBOOK in $(echo $CHANGED_FILES | grep -oP 'playbook_\K\w+'); do
-            ansible-playbook -u $ANSIBLE_USER playbook_$PLAYBOOK.yml
+            sectool exec ansible-playbook -u $ANSIBLE_USER playbook_$PLAYBOOK.yml
           done

.github/workflows/ansible-validate-playbook-on-pr.yml

@@ -26,6 +26,10 @@ jobs:
 
       - name: Setup Ansible environment
         uses: ./.github/actions/setup-ansible-env
+        with:
+          vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }}
+          ansible_user: ${{ secrets.ANSIBLE_USER }}
+          trusted_hosts: ${{ secrets.TRUSTED_HOSTS }}
 
       - name: Apply the playbook that triggered the workflow
         env:
@@ -35,5 +39,5 @@ jobs:
         run: |
           cd ansible
           for PLAYBOOK in $(echo $CHANGED_FILES | grep -oP 'playbook_\K\w+'); do
-            ansible-playbook -u $ANSIBLE_USER playbook_$PLAYBOOK.yml -CD
+            sectool exec ansible-playbook -u $ANSIBLE_USER playbook_$PLAYBOOK.yml -CD
           done

.github/workflows/ansible-weekly-reconciliation.yml

@@ -19,6 +19,10 @@ jobs:
 
       - name: Setup Ansible environment
         uses: ./.github/actions/setup-ansible-env
+        with:
+          vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }}
+          ansible_user: ${{ secrets.ANSIBLE_USER }}
+          trusted_hosts: ${{ secrets.TRUSTED_HOSTS }}
 
       - name: Apply Hardening Playbook
         env:

.github/workflows/terraform-microk8s-apply.yml

@@ -22,12 +22,19 @@ jobs:
 
       - name: Setup Ansible Environment
         uses: ./.github/actions/setup-ansible-env
+        with:
+          vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }}
+          ansible_user: ${{ secrets.ANSIBLE_USER }}
+          trusted_hosts: ${{ secrets.TRUSTED_HOSTS }}
 
       - name: Setup Terraform Environment
         uses: ./.github/actions/setup-terraform-env
 
       - name: Setup Kubernetes Environment
         uses: ./.github/actions/setup-k8s-env
+        with:
+          vault_master_password: ${{ secrets.VAULT_MASTER_PASSWORD }}
+          ansible_user: ${{ secrets.ANSIBLE_USER }}
 
       - name: Terraform Init
         env:

.github/workflows/terraform-microk8s-validate.yml

@@ -20,68 +20,11 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Setup Terraform
+      - name: Setup environment
-        uses: hashicorp/setup-terraform@v1
+        uses: ./.github/actions/setup-env
-        with:
-          terraform_version: 1.9.6
 
-      - name: Setup Sectool
+      - name: Setup Terraform Environment
-        uses: a13labs/setup-sectool@v1
+        uses: ./.github/actions/setup-terraform-env
-
-      - name: Install Python and required packages
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y python3-pip
-          python3 -m pip install -r requirements.txt
-
-      - name: Setup SSH Key
-        env:
-          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
-        run: |
-          sectool ssh unlock ansible
-          mkdir -p ~/.ssh
-          chmod 700 ~/.ssh
-          cp ssh-keys/ansible/id_ecdsa ~/.ssh/id_ecdsa
-          chmod 600 ~/.ssh/id_ecdsa
-
-      - name: Read SSH Trusted Hosts keys
-        env:
-          TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
-        run: |
-          mkdir -p ~/.ssh
-          for HOST in $TRUSTED_HOSTS; do
-            ssh-keyscan $HOST >> ~/.ssh/known_hosts
-          done
-          chmod 600 ~/.ssh/known_hosts
-
-      - name: Start SSH Agent
-        env:
-          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
-          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
-        run: |
-          ssh-agent -a $SSH_AUTH_SOCK > /dev/null
-          echo 'sectool vault get SSH_PASSWORD' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass
-          DISPLAY=None SSH_ASKPASS=~/.ssh_askpass ssh-add ~/.ssh/id_ecdsa < /dev/null
-          rm ~/.ssh_askpass
-
-      - name: Check SSH Connection to remote hosts
-        env:
-          TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
-          ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
-          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
-        run: |
-          for HOST in $TRUSTED_HOSTS; do
-            ssh $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful"
-          done
-
-      - name: Copy Kube Config from remote host
-        env:
-          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
-          ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
-          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
-        run: |
-          mkdir -p ~/.kube
-          ansible -i ansible/inventory/hosts -u $ANSIBLE_USER -m fetch -a "src=/home/$ANSIBLE_USER/.kube/config dest=~/.kube/config flat=yes" microk8s
 
       - name: Terraform Init and Validate
         env: