From 748b8ff7e2d290b1beb39b48798782fc8df886b9 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Sun, 6 Oct 2024 18:06:37 +0200 Subject: [PATCH] Refactor Ansible actions to improve host inventory handling --- .github/workflows/terraform-aws-iac-apply.yml | 34 +++++++++++++++++ .../terraform-aws-iac-validate-on-pr.yml | 37 +++++++++++++++++++ .../terraform-iac-validate-on-pr.yml | 1 + ansible/roles/login/tasks/main.yml | 4 +- terraform/aws-iac/.vault | 1 + terraform/aws-iac/backend.tf | 7 ++++ terraform/aws-iac/billing.tf | 34 +++++++++++++++++ terraform/aws-iac/config.tf | 5 +++ terraform/aws-iac/outputs.tf | 17 +++++++++ terraform/aws-iac/provider.tf | 14 +++++++ terraform/aws-iac/scripts/sns_subscription.sh | 6 +++ terraform/aws-iac/sectool.env | 2 + terraform/aws-iac/variables.tf | 4 ++ terraform/aws-iac/vars/main.tfvars | 1 + terraform/aws-iac/versions.tf | 3 ++ terraform/iac/config.tf | 1 - terraform/iac/provider.tf | 20 ---------- terraform/iac/registry.tf | 5 +++ terraform/k8sapps/backend.tf | 2 +- 19 files changed, 174 insertions(+), 24 deletions(-) create mode 100644 .github/workflows/terraform-aws-iac-apply.yml create mode 100644 .github/workflows/terraform-aws-iac-validate-on-pr.yml create mode 100644 terraform/aws-iac/.vault create mode 100644 terraform/aws-iac/backend.tf create mode 100644 terraform/aws-iac/billing.tf create mode 100644 terraform/aws-iac/config.tf create mode 100644 terraform/aws-iac/outputs.tf create mode 100644 terraform/aws-iac/provider.tf create mode 100644 terraform/aws-iac/scripts/sns_subscription.sh create mode 100644 terraform/aws-iac/sectool.env create mode 100644 terraform/aws-iac/variables.tf create mode 100644 terraform/aws-iac/vars/main.tfvars create mode 100644 terraform/aws-iac/versions.tf create mode 100644 terraform/iac/registry.tf diff --git a/.github/workflows/terraform-aws-iac-apply.yml b/.github/workflows/terraform-aws-iac-apply.yml new file mode 100644 index 0000000..22e7e9c --- /dev/null +++ b/.github/workflows/terraform-aws-iac-apply.yml @@ -0,0 +1,34 @@ +name: Terraform IAC Apply + +on: + schedule: + - cron: "0 1 * * 0" + push: + branches: + - main + paths: + - "terraform/aws-iac/**" +jobs: + terraform-apply: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Setup environment + uses: ./.github/actions/setup-env + + + - name: Setup Terraform environment + uses: ./.github/actions/setup-terraform-env + + - name: Terraform Init + env: + VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + run: | + cd terraform/aws-iac + sectool exec terraform init + sectool exec terraform apply --auto-approve diff --git a/.github/workflows/terraform-aws-iac-validate-on-pr.yml b/.github/workflows/terraform-aws-iac-validate-on-pr.yml new file mode 100644 index 0000000..70f8fce --- /dev/null +++ b/.github/workflows/terraform-aws-iac-validate-on-pr.yml @@ -0,0 +1,37 @@ +name: Terraform AWS IAC Validate on Pull Request + +on: + pull_request: + branches: + - main + paths: + - "terraform/aws-iac/**" + types: + - opened + - synchronize + - reopened +jobs: + terraform-validate: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Setup environment + uses: ./.github/actions/setup-env + + - name: Setup Terraform environment + uses: ./.github/actions/setup-terraform-env + + - name: Terraform Init and Validate + env: + VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + run: | + cd terraform/iac + sectool exec terraform init + sectool exec terraform validate + sectool exec terraform fmt -check + sectool exec terraform plan diff --git a/.github/workflows/terraform-iac-validate-on-pr.yml b/.github/workflows/terraform-iac-validate-on-pr.yml index 47b69e0..1924bf1 100644 --- a/.github/workflows/terraform-iac-validate-on-pr.yml +++ b/.github/workflows/terraform-iac-validate-on-pr.yml @@ -44,6 +44,7 @@ jobs: - name: Terraform Init and Validate env: VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + SYSTEM_ID: ${{ steps.get-host-info.outputs.system-id }} run: | cd terraform/iac export TF_VAR_system_id=$SYSTEM_ID diff --git a/ansible/roles/login/tasks/main.yml b/ansible/roles/login/tasks/main.yml index 4ad7513..ed3aeb4 100644 --- a/ansible/roles/login/tasks/main.yml +++ b/ansible/roles/login/tasks/main.yml @@ -14,13 +14,13 @@ loop: "{{ login_users }}" - name: Disable password expiration - command: chage -M -1 "{{ item.username }}" + ansible.builtin.command: chage -M -1 "{{ item.username }}" become: yes when: item.password_expiration is defined and not item.password_expiration loop: "{{ login_users }}" - name: Disable password login - command: passwd -d "{{ item.username }}" + ansible.builtin.command: passwd -d "{{ item.username }}" become: yes when: item.password_disabled is defined and item.password_disabled loop: "{{ login_users }}" diff --git a/terraform/aws-iac/.vault b/terraform/aws-iac/.vault new file mode 100644 index 0000000..7007d14 --- /dev/null +++ b/terraform/aws-iac/.vault @@ -0,0 +1 @@ +../../repository.vault \ No newline at end of file diff --git a/terraform/aws-iac/backend.tf b/terraform/aws-iac/backend.tf new file mode 100644 index 0000000..2b8c733 --- /dev/null +++ b/terraform/aws-iac/backend.tf @@ -0,0 +1,7 @@ +terraform { + backend "s3" { + bucket = "a13labs.infra" + key = "aws-alarms.tfstate" + region = "us-east-1" + } +} diff --git a/terraform/aws-iac/billing.tf b/terraform/aws-iac/billing.tf new file mode 100644 index 0000000..5b2501f --- /dev/null +++ b/terraform/aws-iac/billing.tf @@ -0,0 +1,34 @@ +resource "aws_cloudwatch_metric_alarm" "billing_alarm" { + + alarm_name = "billing_alarm" + comparison_operator = "GreaterThanThreshold" + metric_name = "EstimatedCharges" + namespace = "AWS/Billing" + evaluation_periods = "1" + period = "21600" + statistic = "Maximum" + threshold = local.billing_alarm_limit + alarm_description = "Billing alarm" + + alarm_actions = [aws_sns_topic.billing_alarm_topic.arn] + + tags = { + Name = "billing_alarm_topic_cf" + CreatedBy = "terraform" + Environment = "aws-alarms" + } +} + +# The SNS topic with email subscriptions +# https://medium.com/@raghuram.arumalla153/aws-sns-topic-subscription-with-email-protocol-using-terraform-ed05f4f19b73 +resource "aws_sns_topic" "billing_alarm_topic" { + name = "billing_alarm_topic" + provisioner "local-exec" { + command = "sh ${path.module}/scripts/sns_subscription.sh" + environment = { + AWS_DEFAULT_REGION = var.region + sns_arn = self.arn + sns_emails = local.billing_alarm_emails + } + } +} diff --git a/terraform/aws-iac/config.tf b/terraform/aws-iac/config.tf new file mode 100644 index 0000000..9528d0b --- /dev/null +++ b/terraform/aws-iac/config.tf @@ -0,0 +1,5 @@ +locals { + region = "us-east-1" + billing_alarm_limit = 40 + billing_alarm_emails = "c.alexandre.pires@gmail.com" +} diff --git a/terraform/aws-iac/outputs.tf b/terraform/aws-iac/outputs.tf new file mode 100644 index 0000000..e411715 --- /dev/null +++ b/terraform/aws-iac/outputs.tf @@ -0,0 +1,17 @@ +# +# Copyright 2019 Alexandre Pires (alexandre.pires@mov.ai) +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# File: outputs.tf + diff --git a/terraform/aws-iac/provider.tf b/terraform/aws-iac/provider.tf new file mode 100644 index 0000000..d696329 --- /dev/null +++ b/terraform/aws-iac/provider.tf @@ -0,0 +1,14 @@ +terraform { + required_version = ">1.9" + required_providers { + aws = { + source = "hashicorp/aws" + version = "~>5.70" + } + } +} + +# Configure the AWS Provider +provider "aws" { + region = var.region +} diff --git a/terraform/aws-iac/scripts/sns_subscription.sh b/terraform/aws-iac/scripts/sns_subscription.sh new file mode 100644 index 0000000..f69e873 --- /dev/null +++ b/terraform/aws-iac/scripts/sns_subscription.sh @@ -0,0 +1,6 @@ +#!/usr/bin/env sh + +for email in $sns_emails; do + echo $email + aws sns subscribe --topic-arn "$sns_arn" --protocol email --notification-endpoint "$email" +done \ No newline at end of file diff --git a/terraform/aws-iac/sectool.env b/terraform/aws-iac/sectool.env new file mode 100644 index 0000000..865ddf9 --- /dev/null +++ b/terraform/aws-iac/sectool.env @@ -0,0 +1,2 @@ +AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY +AWS_SECRET_ACCESS_KEY=$AWS_SECRET_KEY diff --git a/terraform/aws-iac/variables.tf b/terraform/aws-iac/variables.tf new file mode 100644 index 0000000..cdcef80 --- /dev/null +++ b/terraform/aws-iac/variables.tf @@ -0,0 +1,4 @@ +variable "region" { + description = "AWS Default region" + default = "us-east-1" +} diff --git a/terraform/aws-iac/vars/main.tfvars b/terraform/aws-iac/vars/main.tfvars new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/terraform/aws-iac/vars/main.tfvars @@ -0,0 +1 @@ + diff --git a/terraform/aws-iac/versions.tf b/terraform/aws-iac/versions.tf new file mode 100644 index 0000000..6b6318d --- /dev/null +++ b/terraform/aws-iac/versions.tf @@ -0,0 +1,3 @@ +terraform { + required_version = ">= 0.13" +} diff --git a/terraform/iac/config.tf b/terraform/iac/config.tf index 50fb28e..6004e9f 100644 --- a/terraform/iac/config.tf +++ b/terraform/iac/config.tf @@ -2,6 +2,5 @@ locals { instance_ips = [ "${data.contabo_instance.microk8s.ip_config[0].v4[0].ip}/32", ] - instance_mac_addr = replace(data.contabo_instance.microk8s.mac_address, ":", "_") alexpires_me_zone = "alexpires.me" } diff --git a/terraform/iac/provider.tf b/terraform/iac/provider.tf index 7a8e703..ccfc981 100644 --- a/terraform/iac/provider.tf +++ b/terraform/iac/provider.tf @@ -2,26 +2,6 @@ terraform { required_version = "~>1.8" required_providers { - random = { - source = "hashicorp/random" - version = "~>3.4" - } - null = { - source = "hashicorp/null" - version = "~>3.2" - } - external = { - source = "hashicorp/external" - version = "~>2.2" - } - time = { - source = "hashicorp/time" - version = "~>0.9" - } - kubernetes = { - source = "hashicorp/kubernetes" - version = "~>2.18" - } scaleway = { source = "scaleway/scaleway" version = "~>2.13" diff --git a/terraform/iac/registry.tf b/terraform/iac/registry.tf new file mode 100644 index 0000000..292205a --- /dev/null +++ b/terraform/iac/registry.tf @@ -0,0 +1,5 @@ +resource "scaleway_registry_namespace" "a13labs" { + name = "a13labs" + description = "A13Labs container registry" + is_public = false +} diff --git a/terraform/k8sapps/backend.tf b/terraform/k8sapps/backend.tf index 5f133c7..2a25f85 100644 --- a/terraform/k8sapps/backend.tf +++ b/terraform/k8sapps/backend.tf @@ -1,7 +1,7 @@ terraform { backend "s3" { bucket = "a13labs.infra" - key = "scaleway-apps.tfstate" + key = "alexpires.me-k8sapps.tfstate" region = "us-east-1" } }