Refactor playbook_microk8s.yml and ansible-apply.yaml

Simplify playbook_microk8s.yml by removing duplicate lines and whitespace changes.
Update ansible-apply.yaml to include a scheduled job for Terraform Apply.

.github/workflows/ansible-apply.yaml

@@ -80,8 +80,8 @@ jobs:
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
         run: |
           cd ansible
-          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_encryption.yml
           sectool exec ansible-playbook -u $ANSIBLE_USER playbook_hardening.yml --skip-tags roles::cis::suid
+          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_encryption.yml
           sectool exec ansible-playbook -u $ANSIBLE_USER playbook_microk8s.yml
           sectool exec ansible-playbook -u $ANSIBLE_USER playbook_gitea.yml
           sectool exec ansible-playbook -u $ANSIBLE_USER playbook_nextcloud.yml

.github/workflows/terraform-iac-apply.yaml

@@ -1,6 +1,8 @@
 name: Terraform Apply
 
 on:
+  schedule:
+    - cron: "0 1 * * 0"
   push:
     branches:
       - main

.github/workflows/terraform-iac-validate.yaml

@@ -27,7 +27,7 @@ jobs:
       - name: Setup Sectool
         uses: a13labs/setup-sectool@v1
 
-      - name: Terraform Init
+      - name: Terraform Init and Validate
         env:
           VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
         run: |

.github/workflows/terraform-k8apps-validate.yaml

@@ -82,7 +82,7 @@ jobs:
           mkdir -p ~/.kube
           ansible -i ansible/inventory/hosts -u $ANSIBLE_USER -m fetch -a "src=/home/$ANSIBLE_USER/.kube/config dest=~/.kube/config flat=yes" microk8s
 
-      - name: Terraform Init
+      - name: Terraform Init and Validate
         env:
           VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
         run: |

ansible/playbook_encryption.yml

@@ -1,118 +1,148 @@
 ---
-- name: Create LUKS encrypted file system with key file fetched from HTTP server
+- name: Setup encrypted volume for a13labs
   hosts: contabo
-  become: yes
+  become: true
   vars:
     disk_image_path: /a13labs.img
     disk_image_size: 1G
-    luks_device_name: luks_device
+    luks_device_name: a13labs
     mount_point: /a13labs
-    key_file_path: /root/luks_keyfile
+    key_file_path: /root/a13labs.key
     key_file_url: https://a13labs-infra-{{ lookup('env','BUCKET_SUFFIX') }}.s3.fr-par.scw.cloud
-    key_fetch_service: fetch-a13labs-key.service
+    key_fetch_service: a13labs-key.service
 
   tasks:
     - name: Install cryptsetup and curl
-      apt:
+      ansible.builtin.apt:
         name:
           - cryptsetup
           - curl
         state: present
       when: ansible_os_family == 'Debian'
 
+    - name: Get mac address
+      ansible.builtin.shell: |
+        set -o pipefail
+        ip link show eth0 | awk '/ether/ {print $2}'
+      args:
+        executable: /bin/bash
+      register: mac_address
+      changed_when: false
+
+    - name: Sanitize mac address
+      ansible.builtin.set_fact:
+        mac_address_sanitized: "{{ mac_address.stdout | regex_replace('[:]', '_') }}"
+      changed_when: false
+
     - name: Create disk image
       ansible.builtin.command: fallocate -l {{ disk_image_size }} {{ disk_image_path }}
       args:
         creates: "{{ disk_image_path }}"
       register: disk_image
 
-    - name: Create encrypted volume
+    - name: Create bucket URL
+      ansible.builtin.set_fact:
+        key_file_url: "{{ key_file_url }}/keys/{{ mac_address_sanitized }}.key"
+      changed_when: false
+
+    - name: Create encrypted volume # noqa no-handler
       when: disk_image is changed
       block:
-      - name: Get mac address
-        ansible.builtin.shell: |
-          set -o pipefail        
-          ip link show eth0 | awk '/ether/ {print $2}'
-        args:
-          executable: /bin/bash
-        register: mac_address
-        changed_when: false
 
-      - name: Sanitize mac address
+        - name: Download key file from Key server
-        set_fact:
+          ansible.builtin.uri:
-          mac_address_sanitized: "{{ mac_address.stdout | regex_replace('[:]', '%3A') }}"
+            url: "{{ key_file_url }}"
-        changed_when: false
+            dest: "{{ key_file_path }}"
+            mode: '0600'
+          args:
+            creates: "{{ key_file_path }}"
 
-      - name: Create bucket URL
+        - name: Set up LUKS encryption with key file
-        set_fact:
+          ansible.builtin.command: cryptsetup -q luksFormat {{ disk_image_path }} {{ key_file_path }}
-          key_file_url: "{{ key_file_url }}/keys/{{ mac_address_sanitized }}.key"
+          changed_when: false
-        changed_when: false
 
-      - name: Download key file from HTTP server
+        - name: Open LUKS device with key file
-        ansible.builtin.uri:
+          ansible.builtin.command: cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
-          url: "{{ key_file_url }}"
+          register: luks_device
-          dest: "{{ key_file_path }}"
+          changed_when: false
-          mode: '0600'
-        args:
-          creates: "{{ key_file_path }}"
 
-      - name: Set up LUKS encryption with key file
+        - name: Create file system
-        ansible.builtin.command: cryptsetup -q luksFormat {{ disk_image_path }} {{ key_file_path }}
+          ansible.builtin.command: mkfs.ext4 /dev/mapper/{{ luks_device_name }}
+          changed_when: false
 
-      - name: Open LUKS device with key file
+        - name: Close LUKS device
-        ansible.builtin.command: cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
+          ansible.builtin.command: cryptsetup close {{ luks_device_name }}
-        register: luks_device
+          changed_when: false
 
-      - name: Delete key file
+        - name: Delete key file
-        ansible.builtin.file:
+          ansible.builtin.file:
-          path: "{{ key_file_path }}"
+            path: "{{ key_file_path }}"
-          state: absent
+            state: absent
 
-      - name: Create file system
+    - name: Create mount point
-        ansible.builtin.command: mkfs.ext4 /dev/mapper/{{ luks_device_name }}
+      ansible.builtin.file:
+        path: "{{ mount_point }}"
+        state: directory
+        mode: "0750"
 
-      - name: Create mount point
+    - name: Create systemd service to fetch key file and open LUKS device
-        file:
+      ansible.builtin.copy:
-          path: "{{ mount_point }}"
+        dest: /etc/systemd/system/{{ key_fetch_service }}
-          state: directory
+        mode: '0644'
+        content: |
+          [Unit]
+          Description=Open LUKS device
+          After=network-online.target
 
-      - name: Mount the file system
+          [Service]
-        ansible.builtin.command: mount /dev/mapper/{{ luks_device_name }} {{ mount_point }}
+          Type=oneshot
+          RemainAfterExit=true
+          ExecStartPre=/usr/bin/curl -o {{ key_file_path }} "{{ key_file_url }}"
+          ExecStart=/usr/sbin/cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
+          ExecStartPost=/bin/rm -f {{ key_file_path }}
+          ExecStop=/usr/sbin/cryptsetup close {{ luks_device_name }}
 
-      - name: Ensure the file system is mounted
+          [Install]
-        mount:
+          WantedBy=remote-fs.target
-          path: "{{ mount_point }}"
-          src: /dev/mapper/{{ luks_device_name }}
-          fstype: ext4
-          state: mounted
 
-      - name: Create systemd service to fetch key file and open LUKS device
+    - name: Create systemd service to mount the file system
-        copy:
+      ansible.builtin.copy:
-          dest: /etc/systemd/system/{{ key_fetch_service }}
+        dest: /etc/systemd/system/{{ mount_point | basename }}.mount
-          content: |
+        mode: '0644'
-            [Unit]
+        content: |
-            Description=Fetch LUKS key file from HTTP server and open LUKS device
+          [Unit]
-            After=network-online.target
+          Description=Mount LUKS device
-            Before=cryptsetup.target
+          After=remote-fs.target
 
-            [Service]
+          [Mount]
-            Type=oneshot
+          What=/dev/mapper/{{ luks_device_name }}
-            ExecStartPre=/usr/bin/curl -o {{ key_file_path }} {{ key_file_url }}
+          Where={{ mount_point }}
-            ExecStart=/usr/bin/cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
+          Type=ext4
-            ExecStartPost=/bin/rm -f {{ key_file_path }}
+          Options=defaults
 
-            [Install]
+          [Install]
-            WantedBy=multi-user.target
+          WantedBy=multi-user.target
 
-      - name: Reload systemd daemon
+    - name: Reload systemd daemon
-        ansible.builtin.command: systemctl daemon-reload
+      ansible.builtin.systemd:
+        daemon_reload: true
 
-      - name: Enable the key fetch service
+    - name: Enable the key fetch service
-        ansible.builtin.command: systemctl enable {{ key_fetch_service }}
+      ansible.builtin.systemd:
+        name: "{{ key_fetch_service }}"
+        enabled: true
 
-      - name: Add entry to /etc/fstab
+    - name: Enable the mount device
-        lineinfile:
+      ansible.builtin.systemd:
-          path: /etc/fstab
+        name: "{{ mount_point | basename }}.mount"
-          line: "/dev/mapper/{{ luks_device_name }} {{ mount_point }} ext4 defaults 0 2"
+        enabled: true
-          create: yes
 
+    - name: Start the key fetch service
+      ansible.builtin.systemd:
+        name: "{{ key_fetch_service }}"
+        state: started
+
+    - name: Start the mount device
+      ansible.builtin.systemd:
+        name: "{{ mount_point | basename }}.mount"
+        state: started

ansible/roles/microk8s/tasks/iac.yml

@@ -124,7 +124,7 @@
     - k8s::iac
 
 - name: Get new config SHA1
-  set_fact:
+  ansible.builtin.set_fact:
     patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}"
   tags:
     - k8s::iac
@@ -136,6 +136,6 @@
     dest: "{{ k8s_kubeconfig }}"
     owner: "{{ k8s_iac_user }}"
     mode: "0600"
-  when: kubeconfig_exists.stat.exists == false or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
+  when: not kubeconfig_exists.stat.exists or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
   tags:
     - k8s::iac

ansible/roles/microk8s/tasks/setupenv/main.yml

@@ -25,7 +25,7 @@
 - name: Check if secret exists
   ansible.builtin.shell: |
     set -o pipefail
-    microk8s.kubectl -n {{ item.namespace  | default('default') }} get secret | grep {{ item.username }}-token | wc -l | awk '{ print $1 }'
+    microk8s.kubectl -n {{ item.namespace | default('default') }} get secret | grep {{ item.username }}-token | wc -l | awk '{ print $1 }'
   args:
     executable: /bin/bash
   register: secret_exists
@@ -41,7 +41,7 @@
     - name: Get the secret name
       ansible.builtin.shell: |
         set -o pipefail
-        microk8s.kubectl -n {{ item.namespace  | default('default') }} get secret | grep {{ item.username }}-token | awk '{ print $1 }'
+        microk8s.kubectl -n {{ item.namespace | default('default') }} get secret | grep {{ item.username }}-token | awk '{ print $1 }'
       args:
         executable: /bin/bash
       register: secret_name
@@ -53,7 +53,7 @@
     - name: Describe the secret and extract the token
       ansible.builtin.shell: |
         set -o pipefail
-        microk8s.kubectl -n {{ item.namespace  | default('default') }} describe secret {{ secret_name.stdout }} | grep token: | awk '{ print $2 }'
+        microk8s.kubectl -n {{ item.namespace | default('default') }} describe secret {{ secret_name.stdout }} | grep token: | awk '{ print $2 }'
       args:
         executable: /bin/bash
       register: token
@@ -103,7 +103,7 @@
         - k8s::users
 
     - name: Get new config SHA1
-      set_fact:
+      ansible.builtin.set_fact:
         patched_kubeconfig_sha1: "{{ patched_kubeconfig_yaml | to_nice_yaml | sha1 }}"
       tags:
         - k8s::users
@@ -115,6 +115,6 @@
         dest: "{{ user_registered.home }}/.kube/config"
         owner: "{{ item.username }}"
         mode: "0600"
-      when: kubeconfig_exists.stat.exists == false or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
+      when: not kubeconfig_exists.stat.exists or patched_kubeconfig_sha1 != kubeconfig_exists.stat.checksum
       tags:
         - k8s::users

ansible/roles/microk8s/templates/microk8s.yml.j2

@@ -0,0 +1,12 @@
+---
+apiVersion: apiserver.config.k8s.io/v1
+kind: EncryptionConfiguration
+resources:
+  - resources:
+    - secrets
+    providers:
+    - aescbc:
+        keys:
+        - name: k8s-crypto
+          secret: {{ secret }}
+    - identity: {}

resources/iac_user,yaml

@@ -1,141 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: collabora
-  name: admin-collabora
-rules:
-  - apiGroups: ["*"]
-    resources: ["*"]
-    verbs: ["*"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: gitea
-  name: admin-gitea
-rules:
-  - apiGroups: ["*"]
-    resources: ["*"]
-    verbs: ["*"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: m3uproxy
-  name: admin-m3uproxy
-rules:
-  - apiGroups: ["*"]
-    resources: ["*"]
-    verbs: ["*"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: nextcloud
-  name: admin-nextcloud
-rules:
-  - apiGroups: ["*"]
-    resources: ["*"]
-    verbs: ["*"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: wordpress
-  name: admin-wordpress
-rules:
-  - apiGroups: ["*"]
-    resources: ["*"]
-    verbs: ["*"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: namespace-creator
-rules:
-  - apiGroups: [""]
-    resources: ["namespaces"]
-    verbs: ["create", "get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: admin-collabora-binding
-  namespace: collabora
-subjects:
-  - kind: User
-    name: iac
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: Role
-  name: admin-collabora
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: admin-gitea-binding
-  namespace: gitea
-subjects:
-  - kind: User
-    name: iac
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: Role
-  name: admin-gitea
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: admin-m3uproxy-binding
-  namespace: m3uproxy
-subjects:
-  - kind: User
-    name: iac
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: Role
-  name: admin-m3uproxy
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: admin-nextcloud-binding
-  namespace: nextcloud
-subjects:
-  - kind: User
-    name: iac
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: Role
-  name: admin-nextcloud
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: admin-wordpress-binding
-  namespace: wordpress
-subjects:
-  - kind: User
-    name: iac
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: Role
-  name: admin-wordpress
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: namespace-creator-binding
-subjects:
-  - kind: User
-    name: iac
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: ClusterRole
-  name: namespace-creator
-  apiGroup: rbac.authorization.k8s.io

terraform/iac/buckets.tf

@@ -46,7 +46,7 @@ resource "scaleway_object_bucket_policy" "policy" {
 
 resource "scaleway_object" "encryption_key" {
   bucket = scaleway_object_bucket.infra_assets.id
-  key    = "keys/${data.contabo_instance.microk8s.mac_address}.key"
+  key    = "keys/${replace(data.contabo_instance.microk8s.mac_address, ":", "_")}.key"
 
   content_base64 = base64encode(var.encryption_key)
 }