From 5ea3ad7b3decf1dfd3ed427b40a1e539e2084d7a Mon Sep 17 00:00:00 2001
From: Alexandre Pires <c.alexandre.pires@gmail.com>
Date: Tue, 24 Sep 2024 21:22:38 +0200
Subject: [PATCH] Refactor SSH configuration and playbook execution in
 ansible-apply.yaml

---
 .github/workflows/terraform-k8apps-apply.yaml | 58 +++++++++++++++++-
 .../workflows/terraform-k8apps-validate.yaml  | 60 ++++++++++++++++++-
 2 files changed, 114 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/terraform-k8apps-apply.yaml b/.github/workflows/terraform-k8apps-apply.yaml
index 909ede8..c939cfe 100644
--- a/.github/workflows/terraform-k8apps-apply.yaml
+++ b/.github/workflows/terraform-k8apps-apply.yaml
@@ -6,6 +6,7 @@ on:
       - main
     paths:
       - "terraform/k8sapps/**"
+      - .github/workflows/terraform-k8apps-apply.yaml
 
 jobs:
   apply:
@@ -22,8 +23,61 @@ jobs:
 
       - name: Setup Sectool
         uses: a13labs/setup-sectool@v1
-        with:
-          version: 0.0.3
+
+      - name: Install Python and required packages
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y python3-pip
+          python3 -m pip install -r requirements.txt
+
+      - name: Setup SSH Key
+        env:
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        run: |
+          sectool ssh unlock ansible
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          cp ssh-keys/ansible/id_ecdsa ~/.ssh/id_ecdsa
+          chmod 600 ~/.ssh/id_ecdsa
+
+      - name: Read SSH Trusted Hosts keys
+        env:
+          TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
+        run: |
+          mkdir -p ~/.ssh
+          for HOST in $TRUSTED_HOSTS; do
+            ssh-keyscan $HOST >> ~/.ssh/known_hosts
+          done
+          chmod 600 ~/.ssh/known_hosts
+
+      - name: Start SSH Agent
+        env:
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+        run: |
+          ssh-agent -a $SSH_AUTH_SOCK > /dev/null
+          echo 'sectool vault get SSH_PASSWORD' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass
+          DISPLAY=None SSH_ASKPASS=~/.ssh_askpass ssh-add ~/.ssh/id_ecdsa < /dev/null
+          rm ~/.ssh_askpass
+
+      - name: Check SSH Connection
+        env:
+          TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
+          ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
+          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+        run: |
+          for HOST in $TRUSTED_HOSTS; do
+            ssh $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful"
+          done
+
+      - name: Copy Kube Config from remote host
+        env:
+          ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+        run: |
+          mkdir -p ~/.kube
+          ansible -i ansible/inventory/hosts -m fetch -a "src=/home/$ANSIBLE_USER/.kube/config dest=~/.kube/config flat=yes" microk8s
 
       - name: Terraform Init
         env:
diff --git a/.github/workflows/terraform-k8apps-validate.yaml b/.github/workflows/terraform-k8apps-validate.yaml
index 7cb214f..1e6b6c0 100644
--- a/.github/workflows/terraform-k8apps-validate.yaml
+++ b/.github/workflows/terraform-k8apps-validate.yaml
@@ -6,12 +6,13 @@ on:
       - main
     paths:
       - "terraform/k8sapps/**"
+      - .github/workflows/terraform-k8apps-validate.yaml
     types:
       - opened
       - synchronize
       - reopened
 jobs:
-  plan:
+  apply:
     runs-on: ubuntu-latest
 
     steps:
@@ -26,6 +27,61 @@ jobs:
       - name: Setup Sectool
         uses: a13labs/setup-sectool@v1
 
+      - name: Install Python and required packages
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y python3-pip
+          python3 -m pip install -r requirements.txt
+
+      - name: Setup SSH Key
+        env:
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        run: |
+          sectool ssh unlock ansible
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          cp ssh-keys/ansible/id_ecdsa ~/.ssh/id_ecdsa
+          chmod 600 ~/.ssh/id_ecdsa
+
+      - name: Read SSH Trusted Hosts keys
+        env:
+          TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
+        run: |
+          mkdir -p ~/.ssh
+          for HOST in $TRUSTED_HOSTS; do
+            ssh-keyscan $HOST >> ~/.ssh/known_hosts
+          done
+          chmod 600 ~/.ssh/known_hosts
+
+      - name: Start SSH Agent
+        env:
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+        run: |
+          ssh-agent -a $SSH_AUTH_SOCK > /dev/null
+          echo 'sectool vault get SSH_PASSWORD' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass
+          DISPLAY=None SSH_ASKPASS=~/.ssh_askpass ssh-add ~/.ssh/id_ecdsa < /dev/null
+          rm ~/.ssh_askpass
+
+      - name: Check SSH Connection
+        env:
+          TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
+          ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
+          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+        run: |
+          for HOST in $TRUSTED_HOSTS; do
+            ssh $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful"
+          done
+
+      - name: Copy Kube Config from remote host
+        env:
+          ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+        run: |
+          mkdir -p ~/.kube
+          ansible -i ansible/inventory/hosts -m fetch -a "src=/home/$ANSIBLE_USER/.kube/config dest=~/.kube/config flat=yes" microk8s
+
       - name: Terraform Init
         env:
           VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
@@ -33,7 +89,7 @@ jobs:
           cd terraform/k8sapps
           sectool exec terraform init
 
-      - name: Terraform Plan
+      - name: Terraform Apply
         env:
           VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
         run: |