alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Updated to new sectool

Browse Source
This commit is contained in:
Alexandre Pires
2025-03-15 22:45:15 +01:00
parent b66af6fe77
commit 7c5f6c5f0f
19 changed files with 144 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/actions/get-host-info/action.yml
+11 -3
View File
@@ -1,8 +1,14 @@
name: Setup K8S Environment
description: Prepare the environment for A13labs CI/CD pipelines
inputs:
vault-master-password:
description: "The master password for the vault"
access-token:
description: "Bitwarden access token"
required: true
project-id:
description: "Bitwarden project ID"
required: true
organization-id:
description: "Bitwarden organization ID"
required: true
ansible-user:
description: "The user to use for Ansible"
@@ -22,7 +28,9 @@ runs:
id: get-system-id
shell: bash
env:
VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }}
BW_ACCESS_TOKEN: ${{ inputs.access-token }}
BW_PROJECT_ID: ${{ inputs.project-id }}
BW_ORGANIZATION_ID: ${{ inputs.organization-id }}
ANSIBLE_USER: ${{ inputs.ansible-user }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
TARGET_HOST: ${{ inputs.target-host }}
.github/actions/setup-ansible-env/action.yml
+14 -4
View File
@@ -1,8 +1,14 @@
name: Setup Ansible Environment
description: Prepare the environment for A13labs CI/CD pipelines
inputs:
vault-master-password:
description: "The master password for the vault"
access-token:
description: "Bitwarden access token"
required: true
project-id:
description: "Bitwarden project ID"
required: true
organization-id:
description: "Bitwarden organization ID"
required: true
ansible-user:
description: "The user to use for Ansible"
@@ -34,7 +40,9 @@ runs:
- name: Prepare SSH key
shell: bash
env:
VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }}
BW_ACCESS_TOKEN: ${{ inputs.access-token }}
BW_PROJECT_ID: ${{ inputs.project-id }}
BW_ORGANIZATION_ID: ${{ inputs.organization-id }}
run: |
sectool ssh unlock ansible
mkdir -p ~/.ssh
@@ -71,7 +79,9 @@ runs:
id: start-ssh-agent
shell: bash
env:
VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }}
BW_ACCESS_TOKEN: ${{ inputs.access-token }}
BW_PROJECT_ID: ${{ inputs.project-id }}
BW_ORGANIZATION_ID: ${{ inputs.organization-id }}
SSH_AUTH_SOCK: ${{ inputs.ssh-auth-socket }}
run: |
ssh-agent -a $SSH_AUTH_SOCK > /dev/null
.github/actions/setup-k8s-env/action.yml
+14 -4
View File
@@ -1,8 +1,14 @@
name: Setup K8S Environment
description: Prepare the environment for A13labs CI/CD pipelines
inputs:
vault-master-password:
description: "The master password for the vault"
access-token:
description: "Bitwarden access token"
required: true
project-id:
description: "Bitwarden project ID"
required: true
organization-id:
description: "Bitwarden organization ID"
required: true
ansible-user:
description: "The user to use for Ansible"
@@ -20,7 +26,9 @@ runs:
- name: Copy Kube Config from remote host
shell: bash
env:
VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }}
BW_ACCESS_TOKEN: ${{ inputs.access-token }}
BW_PROJECT_ID: ${{ inputs.project-id }}
BW_ORGANIZATION_ID: ${{ inputs.organization-id }}
ANSIBLE_USER: ${{ inputs.ansible-user }}
SSH_AUTH_SOCK: ${{ inputs.ssh-auth-sock }}
K8S_TARGET: ${{ inputs.k8s-target }}
@@ -31,7 +39,9 @@ runs:
- name: Forward K8S API Server port
shell: bash
env:
VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }}
BW_ACCESS_TOKEN: ${{ inputs.access-token }}
BW_PROJECT_ID: ${{ inputs.project-id }}
BW_ORGANIZATION_ID: ${{ inputs.organization-id }}
ANSIBLE_USER: ${{ inputs.ansible-user }}
SSH_AUTH_SOCK: ${{ inputs.ssh-auth-sock }}
K8S_TARGET: ${{ inputs.k8s-target }}
.github/workflows/actions-validate.yml
+11 -5
View File
@@ -21,23 +21,29 @@ jobs:
- name: Setup Ansible environment
uses: ./.github/actions/setup-ansible-env
with:
vault-master-password: ${{ secrets.VAULT_MASTER_PASSWORD }}
project-id: ${{ secrets.BW_PROJECT_ID }}
organization-id: ${{ secrets.BW_ORGANIZATION_ID }}
access-token: ${{ secrets.BW_ACCESS_TOKEN }}
ansible-user: ${{ secrets.ANSIBLE_USER }}
- name: Setup Terraform environment
uses: ./.github/actions/setup-terraform-env
- name: Setup Kubernetes Environment
uses: ./.github/actions/setup-k8s-env
with:
vault-master-password: ${{ secrets.VAULT_MASTER_PASSWORD }}
project-id: ${{ secrets.BW_PROJECT_ID }}
organization-id: ${{ secrets.BW_ORGANIZATION_ID }}
access-token: ${{ secrets.BW_ACCESS_TOKEN }}
ansible-user: ${{ secrets.ANSIBLE_USER }}
- name: Get remote host info
uses: ./.github/actions/get-host-info
id: get-host-info
with:
vault-master-password: ${{ secrets.VAULT_MASTER_PASSWORD }}
project-id: ${{ secrets.BW_PROJECT_ID }}
organization-id: ${{ secrets.BW_ORGANIZATION_ID }}
access-token: ${{ secrets.BW_ACCESS_TOKEN }}
ansible-user: ${{ secrets.ANSIBLE_USER }}
- name: Test ansible
@@ -53,7 +59,7 @@ jobs:
- name: Test terraform
run: |
terraform --version
- name: Show remote host info
run: |
echo "System ID: ${{ steps.get-host-info.outputs.system-id }}"
.github/workflows/ansible-apply-hosts-changes.yml
+6 -2
View File
@@ -22,13 +22,17 @@ jobs:
- name: Setup Ansible environment
uses: ./.github/actions/setup-ansible-env
with:
vault-master-password: ${{ secrets.VAULT_MASTER_PASSWORD }}
project-id: ${{ secrets.BW_PROJECT_ID }}
organization-id: ${{ secrets.BW_ORGANIZATION_ID }}
access-token: ${{ secrets.BW_ACCESS_TOKEN }}
ansible-user: ${{ secrets.ANSIBLE_USER }}
trusted-hosts: ${{ secrets.TRUSTED_HOSTS }}
- name: Apply the playbook that triggered the workflow
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
BW_PROJECT_ID: ${{ secrets.BW_PROJECT_ID }}
BW_ORGANIZATION_ID: ${{ secrets.BW_ORGANIZATION_ID }}
BW_ACCESS_TOKEN: ${{ secrets.BW_ACCESS_TOKEN }}
ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
CHANGED_FILES: ${{ steps.setup_env.outputs.CHANGED_FILES }}
.github/workflows/ansible-apply-playbook.yml
+6 -2
View File
@@ -22,13 +22,17 @@ jobs:
- name: Setup Ansible environment
uses: ./.github/actions/setup-ansible-env
with:
vault-master-password: ${{ secrets.VAULT_MASTER_PASSWORD }}
project-id: ${{ secrets.BW_PROJECT_ID }}
organization-id: ${{ secrets.BW_ORGANIZATION_ID }}
access-token: ${{ secrets.BW_ACCESS_TOKEN }}
ansible-user: ${{ secrets.ANSIBLE_USER }}
trusted-hosts: ${{ secrets.TRUSTED_HOSTS }}
- name: Apply the playbook that triggered the workflow
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
BW_PROJECT_ID: ${{ secrets.BW_PROJECT_ID }}
BW_ORGANIZATION_ID: ${{ secrets.BW_ORGANIZATION_ID }}
BW_ACCESS_TOKEN: ${{ secrets.BW_ACCESS_TOKEN }}
ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
CHANGED_FILES: ${{ steps.setup_env.outputs.CHANGED_FILES }}
.github/workflows/ansible-validate-playbook-on-pr.yml
+6 -2
View File
@@ -25,13 +25,17 @@ jobs:
- name: Setup Ansible environment
uses: ./.github/actions/setup-ansible-env
with:
vault-master-password: ${{ secrets.VAULT_MASTER_PASSWORD }}
project-id: ${{ secrets.BW_PROJECT_ID }}
organization-id: ${{ secrets.BW_ORGANIZATION_ID }}
access-token: ${{ secrets.BW_ACCESS_TOKEN }}
ansible-user: ${{ secrets.ANSIBLE_USER }}
trusted-hosts: ${{ secrets.TRUSTED_HOSTS }}
- name: Apply the playbook that triggered the workflow
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
BW_PROJECT_ID: ${{ secrets.BW_PROJECT_ID }}
BW_ORGANIZATION_ID: ${{ secrets.BW_ORGANIZATION_ID }}
BW_ACCESS_TOKEN: ${{ secrets.BW_ACCESS_TOKEN }}
ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
run: |
.github/workflows/terraform-aws-iac-apply.yml
+4 -3
View File
@@ -21,13 +21,14 @@ jobs:
- name: Setup environment
uses: ./.github/actions/setup-env
- name: Setup Terraform environment
uses: ./.github/actions/setup-terraform-env
- name: Terraform Init and Apply
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
BW_PROJECT_ID: ${{ secrets.BW_PROJECT_ID }}
BW_ORGANIZATION_ID: ${{ secrets.BW_ORGANIZATION_ID }}
BW_ACCESS_TOKEN: ${{ secrets.BW_ACCESS_TOKEN }}
run: |
cd terraform/aws-iac
sectool exec terraform init
.github/workflows/terraform-aws-iac-validate-on-pr.yml
+3 -1
View File
@@ -28,7 +28,9 @@ jobs:
- name: Terraform Init and Validate
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
BW_PROJECT_ID: ${{ secrets.BW_PROJECT_ID }}
BW_ORGANIZATION_ID: ${{ secrets.BW_ORGANIZATION_ID }}
BW_ACCESS_TOKEN: ${{ secrets.BW_ACCESS_TOKEN }}
run: |
cd terraform/aws-iac
sectool exec terraform init
.github/workflows/terraform-iac-apply.yml
+7 -3
View File
@@ -32,16 +32,20 @@ jobs:
uses: ./.github/actions/get-host-info
id: get-host-info
with:
vault-master-password: ${{ secrets.VAULT_MASTER_PASSWORD }}
project-id: ${{ secrets.BW_PROJECT_ID }}
organization-id: ${{ secrets.BW_ORGANIZATION_ID }}
access-token: ${{ secrets.BW_ACCESS_TOKEN }}
ansible-user: ${{ secrets.ANSIBLE_USER }}
target-host: iac
- name: Setup Terraform environment
uses: ./.github/actions/setup-terraform-env
- name: Terraform Init and Apply
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
BW_PROJECT_ID: ${{ secrets.BW_PROJECT_ID }}
BW_ORGANIZATION_ID: ${{ secrets.BW_ORGANIZATION_ID }}
BW_ACCESS_TOKEN: ${{ secrets.BW_ACCESS_TOKEN }}
SYSTEM_ID: ${{ steps.get-host-info.outputs.system-id }}
run: |
cd terraform/iac
.github/workflows/terraform-iac-validate-on-pr.yml
+9 -3
View File
@@ -26,7 +26,9 @@ jobs:
- name: Setup Ansible environment
uses: ./.github/actions/setup-ansible-env
with:
vault-master-password: ${{ secrets.VAULT_MASTER_PASSWORD }}
project-id: ${{ secrets.BW_PROJECT_ID }}
organization-id: ${{ secrets.BW_ORGANIZATION_ID }}
access-token: ${{ secrets.BW_ACCESS_TOKEN }}
ansible-user: ${{ secrets.ANSIBLE_USER }}
host-group: iac
@@ -34,7 +36,9 @@ jobs:
uses: ./.github/actions/get-host-info
id: get-host-info
with:
vault-master-password: ${{ secrets.VAULT_MASTER_PASSWORD }}
project-id: ${{ secrets.BW_PROJECT_ID }}
organization-id: ${{ secrets.BW_ORGANIZATION_ID }}
access-token: ${{ secrets.BW_ACCESS_TOKEN }}
ansible-user: ${{ secrets.ANSIBLE_USER }}
target-host: iac
@@ -43,7 +47,9 @@ jobs:
- name: Terraform Init and Validate
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
BW_PROJECT_ID: ${{ secrets.BW_PROJECT_ID }}
BW_ORGANIZATION_ID: ${{ secrets.BW_ORGANIZATION_ID }}
BW_ACCESS_TOKEN: ${{ secrets.BW_ACCESS_TOKEN }}
SYSTEM_ID: ${{ steps.get-host-info.outputs.system-id }}
run: |
cd terraform/iac
.github/workflows/terraform-microk8s-apply.yml
+9 -3
View File
@@ -25,7 +25,9 @@ jobs:
id: setup_ansible_env
uses: ./.github/actions/setup-ansible-env
with:
vault-master-password: ${{ secrets.VAULT_MASTER_PASSWORD }}
project-id: ${{ secrets.BW_PROJECT_ID }}
organization-id: ${{ secrets.BW_ORGANIZATION_ID }}
access-token: ${{ secrets.BW_ACCESS_TOKEN }}
ansible-user: ${{ secrets.ANSIBLE_USER }}
host-group: microk8s
@@ -35,12 +37,16 @@ jobs:
- name: Setup Kubernetes Environment
uses: ./.github/actions/setup-k8s-env
with:
vault-master-password: ${{ secrets.VAULT_MASTER_PASSWORD }}
project-id: ${{ secrets.BW_PROJECT_ID }}
organization-id: ${{ secrets.BW_ORGANIZATION_ID }}
access-token: ${{ secrets.BW_ACCESS_TOKEN }}
ansible-user: ${{ secrets.ANSIBLE_USER }}
- name: Terraform Init and Apply
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
BW_PROJECT_ID: ${{ secrets.BW_PROJECT_ID }}
BW_ORGANIZATION_ID: ${{ secrets.BW_ORGANIZATION_ID }}
BW_ACCESS_TOKEN: ${{ secrets.BW_ACCESS_TOKEN }}
ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
SSH_AUTH_SOCK: ${{ steps.setup_ansible_env.outputs.ssh-auth-sock }}
run: |
.github/workflows/terraform-microk8s-validate.yml
+9 -3
View File
@@ -27,7 +27,9 @@ jobs:
id: setup_ansible_env
uses: ./.github/actions/setup-ansible-env
with:
vault-master-password: ${{ secrets.VAULT_MASTER_PASSWORD }}
project-id: ${{ secrets.BW_PROJECT_ID }}
organization-id: ${{ secrets.BW_ORGANIZATION_ID }}
access-token: ${{ secrets.BW_ACCESS_TOKEN }}
ansible-user: ${{ secrets.ANSIBLE_USER }}
host-group: microk8s
@@ -37,12 +39,16 @@ jobs:
- name: Setup Kubernetes Environment
uses: ./.github/actions/setup-k8s-env
with:
vault-master-password: ${{ secrets.VAULT_MASTER_PASSWORD }}
project-id: ${{ secrets.BW_PROJECT_ID }}
organization-id: ${{ secrets.BW_ORGANIZATION_ID }}
access-token: ${{ secrets.BW_ACCESS_TOKEN }}
ansible-user: ${{ secrets.ANSIBLE_USER }}
- name: Terraform Init and Validate
env:
VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
BW_PROJECT_ID: ${{ secrets.BW_PROJECT_ID }}
BW_ORGANIZATION_ID: ${{ secrets.BW_ORGANIZATION_ID }}
BW_ACCESS_TOKEN: ${{ secrets.BW_ACCESS_TOKEN }}
run: |
cd terraform/k8sapps
sectool exec terraform init