diff --git a/.github/actions/setup-ansible-env/action.yml b/.github/actions/setup-ansible-env/action.yml index 9278d19..b268d5c 100644 --- a/.github/actions/setup-ansible-env/action.yml +++ b/.github/actions/setup-ansible-env/action.yml @@ -7,13 +7,19 @@ inputs: ansible-user: description: "The user to use for Ansible" required: true - trusted-hosts: - description: "The list of trusted hosts" - required: true + ssh-auth-socket: + description: "The SSH_AUTH_SOCK environment variable" + default: "/tmp/ssh_agent.sock" + host-group: + description: "The host group to setup the Ansible environment" + default: "all" outputs: ssh-auth-sock: description: "The SSH_AUTH_SOCK environment variable" value: ${{ steps.start-ssh-agent.outputs.ssh-auth-sock }} + hosts: + description: "The list of hosts in the host group" + value: ${{ steps.read-hosts.outputs.hosts }} runs: using: "composite" @@ -25,7 +31,7 @@ runs: sudo apt-get install -y python3-pip python3 -m pip install -r requirements.txt - - name: Setup SSH Key + - name: Prepare SSH key shell: bash env: VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }} @@ -36,13 +42,20 @@ runs: cp ssh-keys/ansible/id_ecdsa ~/.ssh/id_ecdsa chmod 600 ~/.ssh/id_ecdsa - - name: Read SSH Trusted Hosts keys + - name: Read hosts from inventory + id: read-hosts shell: bash env: - TRUSTED_HOSTS: ${{ inputs.trusted-hosts }} + HOST_GROUP: ${{ inputs.host-group }} + run: | + ansible-inventory ansible-inventory --list --yaml $HOST_GROUP | grep -oP '(\w+\.){2}\w+' | sort -u > /tmp/ansible_hosts + echo "::set-output name=hosts::$(cat /tmp/ansible_hosts)" + + - name: Read SSH host keys from remote hosts + shell: bash run: | mkdir -p ~/.ssh - for HOST in $TRUSTED_HOSTS; do + for HOST in $(cat /tmp/ansible_hosts); do ssh-keyscan $HOST >> ~/.ssh/known_hosts done chmod 600 ~/.ssh/known_hosts @@ -54,24 +67,25 @@ runs: echo " HostKeyAlgorithms +sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com" chmod 600 ~/.ssh/config - - name: Start SSH Agent + - name: Start SSH agent and add SSH key + id: start-ssh-agent shell: bash env: VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }} - SSH_AUTH_SOCK: /tmp/ssh_agent.sock + SSH_AUTH_SOCK: ${{ inputs.ssh-auth-socket }} run: | ssh-agent -a $SSH_AUTH_SOCK > /dev/null echo 'sectool vault get SSH_PASSWORD' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass DISPLAY=None SSH_ASKPASS=~/.ssh_askpass ssh-add ~/.ssh/id_ecdsa < /dev/null rm ~/.ssh_askpass + echo "::set-output name=ssh-auth-sock::$SSH_AUTH_SOCK" - name: Check SSH Connection to remote hosts shell: bash env: - TRUSTED_HOSTS: ${{ inputs.trusted-hosts }} ANSIBLE_USER: ${{ inputs.ansible-user }} - SSH_AUTH_SOCK: /tmp/ssh_agent.sock + SSH_AUTH_SOCK: ${{ inputs.ssh-auth-socket }} run: | - for HOST in $TRUSTED_HOSTS; do + for HOST in $(cat /tmp/ansible_hosts); do ssh $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful" done diff --git a/.github/actions/setup-k8s-env/action.yml b/.github/actions/setup-k8s-env/action.yml index f59d627..6b88acf 100644 --- a/.github/actions/setup-k8s-env/action.yml +++ b/.github/actions/setup-k8s-env/action.yml @@ -10,6 +10,9 @@ inputs: k8s-target: description: "The target host to deploy the K8S applications" default: "microk8s" + ssh-auth-sock: + description: "The SSH_AUTH_SOCK environment variable" + default: "/tmp/ssh_agent.sock" runs: using: "composite" @@ -19,7 +22,7 @@ runs: env: VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }} ANSIBLE_USER: ${{ inputs.ansible-user }} - SSH_AUTH_SOCK: /tmp/ssh_agent.sock + SSH_AUTH_SOCK: ${{ inputs.ssh-auth-sock }} K8S_TARGET: ${{ inputs.k8s-target }} run: | mkdir -p ~/.kube @@ -30,7 +33,7 @@ runs: env: VAULT_MASTER_PASSWORD: ${{ inputs.vault-master-password }} ANSIBLE_USER: ${{ inputs.ansible-user }} - SSH_AUTH_SOCK: /tmp/ssh_agent.sock + SSH_AUTH_SOCK: ${{ inputs.ssh-auth-sock }} K8S_TARGET: ${{ inputs.k8s-target }} run: | # Get Hostname and IP address of the target diff --git a/.github/actions/setup-terraform-env/action.yml b/.github/actions/setup-terraform-env/action.yml new file mode 100644 index 0000000..cc2b3c4 --- /dev/null +++ b/.github/actions/setup-terraform-env/action.yml @@ -0,0 +1,10 @@ +name: Setup Terraform Environment +description: Prepare the environment for A13labs CI/CD pipelines + +runs: + using: "composite" + steps: + - name: Setup Terraform + uses: hashicorp/setup-terraform@v1 + with: + terraform_version: 1.9.6 diff --git a/.github/workflows/actions-validate.yml b/.github/workflows/actions-validate.yml index 3d85089..eacc468 100644 --- a/.github/workflows/actions-validate.yml +++ b/.github/workflows/actions-validate.yml @@ -26,20 +26,17 @@ jobs: with: vault-master-password: ${{ secrets.VAULT_MASTER_PASSWORD }} ansible-user: ${{ secrets.ANSIBLE_USER }} - trusted-hosts: ${{ secrets.TRUSTED_HOSTS }} - - - name: Setup Terraform - uses: hashicorp/setup-terraform@v1 - with: - terraform_version: 1.9.6 + - name: Setup Terraform environment + uses: ./.github/actions/setup-terraform-env + - name: Setup Kubernetes Environment uses: ./.github/actions/setup-k8s-env with: vault-master-password: ${{ secrets.VAULT_MASTER_PASSWORD }} ansible-user: ${{ secrets.ANSIBLE_USER }} - - name: Get Host Info + - name: Get remote host info uses: ./.github/actions/get-host-info id: get-host-info with: @@ -57,3 +54,7 @@ jobs: - name: Test terraform run: | terraform --version + + - name: Show remote host info + run: | + echo "System ID: ${{ steps.get-host-info.outputs.system_id }}"