From 49e15f441cb88aee4528c1295189d57f917b338c Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Tue, 24 Sep 2024 16:43:43 +0200 Subject: [PATCH] Refactor file paths in Terraform workflows --- ...apply.yaml => terraform-k8apps-apply.yaml} | 6 +- ...te.yaml => terraform-k8apps-validate.yaml} | 15 +- resources/iac_user,yaml | 141 ++++++++++++++++++ 3 files changed, 153 insertions(+), 9 deletions(-) rename .github/workflows/{terraform-apply.yaml => terraform-k8apps-apply.yaml} (89%) rename .github/workflows/{terraform-validate.yaml => terraform-k8apps-validate.yaml} (79%) create mode 100644 resources/iac_user,yaml diff --git a/.github/workflows/terraform-apply.yaml b/.github/workflows/terraform-k8apps-apply.yaml similarity index 89% rename from .github/workflows/terraform-apply.yaml rename to .github/workflows/terraform-k8apps-apply.yaml index 921ca37..909ede8 100644 --- a/.github/workflows/terraform-apply.yaml +++ b/.github/workflows/terraform-k8apps-apply.yaml @@ -5,7 +5,7 @@ on: branches: - main paths: - - "k8sapps/**" + - "terraform/k8sapps/**" jobs: apply: @@ -29,12 +29,12 @@ jobs: env: VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} run: | - cd k8sapps + cd terraform/k8sapps sectool exec terraform init - name: Terraform Apply env: VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} run: | - cd k8sapps + cd terraform/k8sapps sectool exec terraform apply --auto-approve diff --git a/.github/workflows/terraform-validate.yaml b/.github/workflows/terraform-k8apps-validate.yaml similarity index 79% rename from .github/workflows/terraform-validate.yaml rename to .github/workflows/terraform-k8apps-validate.yaml index 86c27b6..7cb214f 100644 --- a/.github/workflows/terraform-validate.yaml +++ b/.github/workflows/terraform-k8apps-validate.yaml @@ -1,12 +1,15 @@ name: Validate Terraform on: - push: + pull_request: branches: - - feature/** + - main paths: - - "k8sapps/**" - + - "terraform/k8sapps/**" + types: + - opened + - synchronize + - reopened jobs: plan: runs-on: ubuntu-latest @@ -27,12 +30,12 @@ jobs: env: VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} run: | - cd k8sapps + cd terraform/k8sapps sectool exec terraform init - name: Terraform Plan env: VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} run: | - cd k8sapps + cd terraform/k8sapps sectool exec terraform plan diff --git a/resources/iac_user,yaml b/resources/iac_user,yaml new file mode 100644 index 0000000..a0486d2 --- /dev/null +++ b/resources/iac_user,yaml @@ -0,0 +1,141 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + namespace: collabora + name: admin-collabora +rules: + - apiGroups: ["*"] + resources: ["*"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + namespace: gitea + name: admin-gitea +rules: + - apiGroups: ["*"] + resources: ["*"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + namespace: m3uproxy + name: admin-m3uproxy +rules: + - apiGroups: ["*"] + resources: ["*"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + namespace: nextcloud + name: admin-nextcloud +rules: + - apiGroups: ["*"] + resources: ["*"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + namespace: wordpress + name: admin-wordpress +rules: + - apiGroups: ["*"] + resources: ["*"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: namespace-creator +rules: + - apiGroups: [""] + resources: ["namespaces"] + verbs: ["create", "get", "list"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: admin-collabora-binding + namespace: collabora +subjects: + - kind: User + name: iac + apiGroup: rbac.authorization.k8s.io +roleRef: + kind: Role + name: admin-collabora + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: admin-gitea-binding + namespace: gitea +subjects: + - kind: User + name: iac + apiGroup: rbac.authorization.k8s.io +roleRef: + kind: Role + name: admin-gitea + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: admin-m3uproxy-binding + namespace: m3uproxy +subjects: + - kind: User + name: iac + apiGroup: rbac.authorization.k8s.io +roleRef: + kind: Role + name: admin-m3uproxy + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: admin-nextcloud-binding + namespace: nextcloud +subjects: + - kind: User + name: iac + apiGroup: rbac.authorization.k8s.io +roleRef: + kind: Role + name: admin-nextcloud + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: admin-wordpress-binding + namespace: wordpress +subjects: + - kind: User + name: iac + apiGroup: rbac.authorization.k8s.io +roleRef: + kind: Role + name: admin-wordpress + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: namespace-creator-binding +subjects: + - kind: User + name: iac + apiGroup: rbac.authorization.k8s.io +roleRef: + kind: ClusterRole + name: namespace-creator + apiGroup: rbac.authorization.k8s.io