Improved workflows and actions

2024-09-29 18:01:42 +02:00
parent 9ae5a6446b
commit 360269fa0b
15 changed files with 312 additions and 224 deletions
@@ -0,0 +1,57 @@
+name: Setup Ansible Environment
+description: Prepare the environment for A13labs CI/CD pipelines
+
+runs:
+  using: "composite"
+  steps:
+    - name: Install Python and required packages
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y python3-pip
+        python3 -m pip install -r requirements.txt
+
+    - name: Setup SSH Key
+      env:
+        VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+      run: |
+        sectool ssh unlock ansible
+        mkdir -p ~/.ssh
+        chmod 700 ~/.ssh
+        cp ssh-keys/ansible/id_ecdsa ~/.ssh/id_ecdsa
+        chmod 600 ~/.ssh/id_ecdsa
+
+    - name: Read SSH Trusted Hosts keys
+      env:
+        TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
+      run: |
+        mkdir -p ~/.ssh
+        for HOST in $TRUSTED_HOSTS; do
+          ssh-keyscan $HOST >> ~/.ssh/known_hosts
+        done
+        chmod 600 ~/.ssh/known_hosts
+
+    - name: Enable SSH host key algorithms
+      run: |
+        echo "Host *" >> ~/.ssh/config
+        echo "  HostKeyAlgorithms +sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com"
+        chmod 600 ~/.ssh/config
+
+    - name: Start SSH Agent
+      env:
+        VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+      run: |
+        ssh-agent -a $SSH_AUTH_SOCK > /dev/null
+        echo 'sectool vault get SSH_PASSWORD' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass
+        DISPLAY=None SSH_ASKPASS=~/.ssh_askpass ssh-add ~/.ssh/id_ecdsa < /dev/null
+        rm ~/.ssh_askpass
+
+    - name: Check SSH Connection to remote hosts
+      env:
+        TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
+        ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
+        SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+      run: |
+        for HOST in $TRUSTED_HOSTS; do
+          ssh $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful"
+        done
@@ -0,0 +1,18 @@
+name: Setup Environment
+description: Prepare the environment for A13labs CI/CD pipelines
+
+runs:
+  using: "composite"
+  steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Get changed files
+      id: get_changed_files
+      run: |
+        # Get the list of changed files
+        CHANGED_FILES=$(git diff --name-only ${{ github.event.before }} ${{ github.sha }})
+        echo "CHANGED_FILES=$CHANGED_FILES" >> $GITHUB_ENV
+
+    - name: Setup Sectool
+      uses: a13labs/setup-sectool@v1
@@ -0,0 +1,41 @@
+name: Setup K8S Environment
+description: Prepare the environment for A13labs CI/CD pipelines
+inputs:
+  k8s-target:
+    description: "The target host to deploy the K8S applications"
+    default: "microk8s"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Copy Kube Config from remote host
+      env:
+        VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
+        SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+      run: |
+        mkdir -p ~/.kube
+        ansible -i ansible/inventory/hosts -u $ANSIBLE_USER -m fetch -a "src=/home/$ANSIBLE_USER/.kube/config dest=~/.kube/config flat=yes" {{ inputs.k8s-target }}
+
+    - name: Terraform Init
+      env:
+        VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+      run: |
+        cd terraform/k8sapps
+        sectool exec terraform init
+
+    - name: Terraform Apply
+      env:
+        VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
+        SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+      run: |
+        # Get Hostname and IP address of the target
+        ANSIBLE_HOST=$(ansible -i ansible/inventory/hosts -u $ANSIBLE_USER -m shell -a "hostname" {{ inputs.k8s-target }} | grep -oP '(\w+\.){2}\w+' | head -1)
+        IP_ADDR=$(ansible -i ansible/inventory/hosts -u $ANSIBLE_USER -m shell -a "curl -s ifconfig.me" {{ inputs.k8s-target }} | grep -oP '(\d+\.){3}\d+')
+
+        # Forward the k8s API server port to localhost
+        ssh -f -N -L 16443:localhost:16443 $ANSIBLE_USER@$ANSIBLE_HOST
+
+        # Override the kube config file to use localhost
+        sed -i "s/server: https:\/\/$IP_ADDR:16443/server: https:\/\/localhost:16443/g" ~/.kube/config
@@ -0,0 +1,10 @@
+name: Setup Terraform Environment
+description: Prepare the environment for A13labs CI/CD pipelines
+
+runs:
+  using: "composite"
+  steps:
+    - name: Setup Terraform
+      uses: hashicorp/setup-terraform@v1
+      with:
+        terraform_version: 1.9.6