Refactor playbook_microk8s.yml and ansible-apply.yaml

Simplify playbook_microk8s.yml by removing duplicate lines and whitespace changes.
Update ansible-apply.yaml to include a scheduled job for Terraform Apply.

.github/workflows/ansible-apply.yaml

@@ -80,8 +80,8 @@ jobs:
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
         run: |
           cd ansible
-          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_encryption.yml
           sectool exec ansible-playbook -u $ANSIBLE_USER playbook_hardening.yml --skip-tags roles::cis::suid
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_encryption.yml
           sectool exec ansible-playbook -u $ANSIBLE_USER playbook_microk8s.yml
           sectool exec ansible-playbook -u $ANSIBLE_USER playbook_gitea.yml
           sectool exec ansible-playbook -u $ANSIBLE_USER playbook_nextcloud.yml

.github/workflows/terraform-iac-apply.yaml

@@ -1,6 +1,8 @@
 name: Terraform Apply
 
 on:
+  schedule:
+    - cron: "0 1 * * 0"
   push:
     branches:
       - main

.github/workflows/terraform-iac-validate.yaml

@@ -27,7 +27,7 @@ jobs:
       - name: Setup Sectool
         uses: a13labs/setup-sectool@v1
 
-      - name: Terraform Init
+      - name: Terraform Init and Validate
         env:
           VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
         run: |

.github/workflows/terraform-k8apps-validate.yaml

@@ -82,7 +82,7 @@ jobs:
           mkdir -p ~/.kube
           ansible -i ansible/inventory/hosts -u $ANSIBLE_USER -m fetch -a "src=/home/$ANSIBLE_USER/.kube/config dest=~/.kube/config flat=yes" microk8s
 
-      - name: Terraform Init
+      - name: Terraform Init and Validate
         env:
           VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
         run: |

ansible/playbook_encryption.yml

@@ -1,34 +1,25 @@
 ---
-- name: Create LUKS encrypted file system with key file fetched from HTTP server
+- name: Setup encrypted volume for a13labs
   hosts: contabo
-  become: yes
+  become: true
   vars:
     disk_image_path: /a13labs.img
     disk_image_size: 1G
-    luks_device_name: luks_device
+    luks_device_name: a13labs
     mount_point: /a13labs
-    key_file_path: /root/luks_keyfile
+    key_file_path: /root/a13labs.key
     key_file_url: https://a13labs-infra-{{ lookup('env','BUCKET_SUFFIX') }}.s3.fr-par.scw.cloud
-    key_fetch_service: fetch-a13labs-key.service
+    key_fetch_service: a13labs-key.service
 
   tasks:
     - name: Install cryptsetup and curl
-      apt:
+      ansible.builtin.apt:
         name:
           - cryptsetup
           - curl
         state: present
       when: ansible_os_family == 'Debian'
 
-    - name: Create disk image
-      ansible.builtin.command: fallocate -l {{ disk_image_size }} {{ disk_image_path }}
-      args:
-        creates: "{{ disk_image_path }}"
-      register: disk_image
-
-    - name: Create encrypted volume
-      when: disk_image is changed
-      block: 
     - name: Get mac address
       ansible.builtin.shell: |
         set -o pipefail
@@ -39,16 +30,26 @@
       changed_when: false
 
     - name: Sanitize mac address
-        set_fact:
+      ansible.builtin.set_fact:
-          mac_address_sanitized: "{{ mac_address.stdout | regex_replace('[:]', '%3A') }}"
+        mac_address_sanitized: "{{ mac_address.stdout | regex_replace('[:]', '_') }}"
       changed_when: false
 
+    - name: Create disk image
+      ansible.builtin.command: fallocate -l {{ disk_image_size }} {{ disk_image_path }}
+      args:
+        creates: "{{ disk_image_path }}"
+      register: disk_image
+
     - name: Create bucket URL
-        set_fact:
+      ansible.builtin.set_fact:
         key_file_url: "{{ key_file_url }}/keys/{{ mac_address_sanitized }}.key"
       changed_when: false
 
-      - name: Download key file from HTTP server
+    - name: Create encrypted volume # noqa no-handler
+      when: disk_image is changed
+      block:
+
+        - name: Download key file from Key server
           ansible.builtin.uri:
             url: "{{ key_file_url }}"
             dest: "{{ key_file_path }}"
@@ -58,61 +59,90 @@
 
         - name: Set up LUKS encryption with key file
           ansible.builtin.command: cryptsetup -q luksFormat {{ disk_image_path }} {{ key_file_path }}
+          changed_when: false
 
         - name: Open LUKS device with key file
           ansible.builtin.command: cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
           register: luks_device
+          changed_when: false
+
+        - name: Create file system
+          ansible.builtin.command: mkfs.ext4 /dev/mapper/{{ luks_device_name }}
+          changed_when: false
+
+        - name: Close LUKS device
+          ansible.builtin.command: cryptsetup close {{ luks_device_name }}
+          changed_when: false
 
         - name: Delete key file
           ansible.builtin.file:
             path: "{{ key_file_path }}"
             state: absent
 
-      - name: Create file system
-        ansible.builtin.command: mkfs.ext4 /dev/mapper/{{ luks_device_name }}
-
     - name: Create mount point
-        file:
+      ansible.builtin.file:
         path: "{{ mount_point }}"
         state: directory
-
+        mode: "0750"
-      - name: Mount the file system
-        ansible.builtin.command: mount /dev/mapper/{{ luks_device_name }} {{ mount_point }}
-
-      - name: Ensure the file system is mounted
-        mount:
-          path: "{{ mount_point }}"
-          src: /dev/mapper/{{ luks_device_name }}
-          fstype: ext4
-          state: mounted
 
     - name: Create systemd service to fetch key file and open LUKS device
-        copy:
+      ansible.builtin.copy:
         dest: /etc/systemd/system/{{ key_fetch_service }}
+        mode: '0644'
         content: |
           [Unit]
-            Description=Fetch LUKS key file from HTTP server and open LUKS device
+          Description=Open LUKS device
           After=network-online.target
-            Before=cryptsetup.target
 
           [Service]
           Type=oneshot
-            ExecStartPre=/usr/bin/curl -o {{ key_file_path }} {{ key_file_url }}
+          RemainAfterExit=true
-            ExecStart=/usr/bin/cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
+          ExecStartPre=/usr/bin/curl -o {{ key_file_path }} "{{ key_file_url }}"
+          ExecStart=/usr/sbin/cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
           ExecStartPost=/bin/rm -f {{ key_file_path }}
+          ExecStop=/usr/sbin/cryptsetup close {{ luks_device_name }}
+
+          [Install]
+          WantedBy=remote-fs.target
+
+    - name: Create systemd service to mount the file system
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/{{ mount_point | basename }}.mount
+        mode: '0644'
+        content: |
+          [Unit]
+          Description=Mount LUKS device
+          After=remote-fs.target
+
+          [Mount]
+          What=/dev/mapper/{{ luks_device_name }}
+          Where={{ mount_point }}
+          Type=ext4
+          Options=defaults
 
           [Install]
           WantedBy=multi-user.target
 
     - name: Reload systemd daemon
-        ansible.builtin.command: systemctl daemon-reload
+      ansible.builtin.systemd:
+        daemon_reload: true
 
     - name: Enable the key fetch service
-        ansible.builtin.command: systemctl enable {{ key_fetch_service }}
+      ansible.builtin.systemd:
+        name: "{{ key_fetch_service }}"
+        enabled: true
 
-      - name: Add entry to /etc/fstab
+    - name: Enable the mount device
-        lineinfile:
+      ansible.builtin.systemd:
-          path: /etc/fstab
+        name: "{{ mount_point | basename }}.mount"
-          line: "/dev/mapper/{{ luks_device_name }} {{ mount_point }} ext4 defaults 0 2"
+        enabled: true
-          create: yes
 
+    - name: Start the key fetch service
+      ansible.builtin.systemd:
+        name: "{{ key_fetch_service }}"
+        state: started
+
+    - name: Start the mount device
+      ansible.builtin.systemd:
+        name: "{{ mount_point | basename }}.mount"
+        state: started

ansible/roles/microk8s/tasks/iac.yml

@@ -124,7 +124,7 @@
     - k8s::iac
 
 - name: Get new config SHA1
-  set_fact:
+  ansible.builtin.set_fact:
     patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}"
   tags:
     - k8s::iac
@@ -136,6 +136,6 @@
     dest: "{{ k8s_kubeconfig }}"
     owner: "{{ k8s_iac_user }}"
     mode: "0600"
-  when: kubeconfig_exists.stat.exists == false or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
+  when: not kubeconfig_exists.stat.exists or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
   tags:
     - k8s::iac

ansible/roles/microk8s/tasks/setupenv/main.yml

@@ -103,7 +103,7 @@
         - k8s::users
 
     - name: Get new config SHA1
-      set_fact:
+      ansible.builtin.set_fact:
         patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}"
       tags:
         - k8s::users
@@ -115,6 +115,6 @@
         dest: "{{ user_registered.home }}/.kube/config"
         owner: "{{ item.username }}"
         mode: "0600"
-      when: kubeconfig_exists.stat.exists == false or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
+      when: not kubeconfig_exists.stat.exists or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
       tags:
         - k8s::users

ansible/roles/microk8s/templates/microk8s.yml.j2

@@ -0,0 +1,12 @@
+---
+apiVersion: apiserver.config.k8s.io/v1
+kind: EncryptionConfiguration
+resources:
+  - resources:
+    - secrets
+    providers:
+    - aescbc:
+        keys:
+        - name: k8s-crypto
+          secret: {{ secret }}
+    - identity: {}

resources/iac_user,yaml

@@ -1,141 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: collabora
-  name: admin-collabora
-rules:
-  - apiGroups: ["*"]
-    resources: ["*"]
-    verbs: ["*"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: gitea
-  name: admin-gitea
-rules:
-  - apiGroups: ["*"]
-    resources: ["*"]
-    verbs: ["*"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: m3uproxy
-  name: admin-m3uproxy
-rules:
-  - apiGroups: ["*"]
-    resources: ["*"]
-    verbs: ["*"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: nextcloud
-  name: admin-nextcloud
-rules:
-  - apiGroups: ["*"]
-    resources: ["*"]
-    verbs: ["*"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: wordpress
-  name: admin-wordpress
-rules:
-  - apiGroups: ["*"]
-    resources: ["*"]
-    verbs: ["*"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: namespace-creator
-rules:
-  - apiGroups: [""]
-    resources: ["namespaces"]
-    verbs: ["create", "get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: admin-collabora-binding
-  namespace: collabora
-subjects:
-  - kind: User
-    name: iac
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: Role
-  name: admin-collabora
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: admin-gitea-binding
-  namespace: gitea
-subjects:
-  - kind: User
-    name: iac
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: Role
-  name: admin-gitea
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: admin-m3uproxy-binding
-  namespace: m3uproxy
-subjects:
-  - kind: User
-    name: iac
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: Role
-  name: admin-m3uproxy
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: admin-nextcloud-binding
-  namespace: nextcloud
-subjects:
-  - kind: User
-    name: iac
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: Role
-  name: admin-nextcloud
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: admin-wordpress-binding
-  namespace: wordpress
-subjects:
-  - kind: User
-    name: iac
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: Role
-  name: admin-wordpress
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: namespace-creator-binding
-subjects:
-  - kind: User
-    name: iac
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: ClusterRole
-  name: namespace-creator
-  apiGroup: rbac.authorization.k8s.io

terraform/iac/buckets.tf

@@ -46,7 +46,7 @@ resource "scaleway_object_bucket_policy" "policy" {
 
 resource "scaleway_object" "encryption_key" {
   bucket = scaleway_object_bucket.infra_assets.id
-  key    = "keys/${data.contabo_instance.microk8s.mac_address}.key"
+  key    = "keys/${replace(data.contabo_instance.microk8s.mac_address, ":", "_")}.key"
 
   content_base64 = base64encode(var.encryption_key)
 }