ai-workspace-infra/iac_modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add feature: Fetch Certificate and Private Key from Vault

Browse Source
This commit is contained in:
Haitao Pan 2024-01-06 18:17:26 +08:00
parent 94e503531f
commit 79e8ff2e18
3 changed files with 32 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
.github/workflows/iac-pipeline-create.yml vendored
View File

@ -27,7 +27,7 @@ jobs:
setup-monitor-cluster:
uses: open-source-solution-design/Modern-Container-Application-Reference-Architecture/.github/workflows/use-setup-k3s-cluster.yml@main
with:
domain: 'demo-uat.ink'
domain: 'svc-dev.ink'
cluster_name: 'monitor'
ssh_host_name: 'monitor'
secrets:
@ -35,6 +35,8 @@ jobs:
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
DNS_AK: ${{ secrets.DNS_AK }}
DNS_SK: ${{ secrets.DNS_SK }}
VAULT_URL: ${{ secrets.VAULT_URL }}
VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
SSH_USER: ${{ secrets.HOST_USER }}
needs:
- apply-cluster-resources
@ -42,7 +44,7 @@ jobs:
setup-observability-server:
uses: open-source-solution-design/Modern-Container-Application-Reference-Architecture/.github/workflows/use-setup-observability-server.yml@main
with:
domain: 'demo-uat.ink'
domain: 'svc-dev.ink'
cluster_name: 'monitor'
ssh_host_name: 'monitor'
secrets:
@ -57,7 +59,7 @@ jobs:
setup-devops-cluster:
uses: open-source-solution-design/Modern-Container-Application-Reference-Architecture/.github/workflows/use-setup-k3s-cluster.yml@main
with:
domain: 'demo-uat.ink'
domain: 'svc-dev.ink'
cluster_name: 'devops'
ssh_host_name: 'devops'
secrets:
@ -65,6 +67,8 @@ jobs:
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
DNS_AK: ${{ secrets.DNS_AK }}
DNS_SK: ${{ secrets.DNS_SK }}
VAULT_URL: ${{ secrets.VAULT_URL }}
VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
SSH_USER: ${{ secrets.HOST_USER }}
needs:
- apply-cluster-resources
@ -72,7 +76,7 @@ jobs:
setup-devops-cluster-observability-agent:
uses: open-source-solution-design/Modern-Container-Application-Reference-Architecture/.github/workflows/use-setup-observability-agent.yml@main
with:
domain: 'demo-uat.ink'
domain: 'svc-dev.ink'
cluster_name: 'devops'
ssh_host_name: 'devops'
secrets:
@ -87,7 +91,7 @@ jobs:
setup-sit-cluster:
uses: open-source-solution-design/Modern-Container-Application-Reference-Architecture/.github/workflows/use-setup-k3s-cluster.yml@main
with:
domain: 'demo-uat.ink'
domain: 'svc-dev.ink'
cluster_name: 'sit'
ssh_host_name: 'sit'
secrets:
@ -95,6 +99,8 @@ jobs:
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
DNS_AK: ${{ secrets.DNS_AK }}
DNS_SK: ${{ secrets.DNS_SK }}
VAULT_URL: ${{ secrets.VAULT_URL }}
VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
SSH_USER: ${{ secrets.HOST_USER }}
needs:
- apply-cluster-resources
@ -102,7 +108,7 @@ jobs:
setup-sit-cluster-observability-agent:
uses: open-source-solution-design/Modern-Container-Application-Reference-Architecture/.github/workflows/use-setup-observability-agent.yml@main
with:
domain: 'demo-uat.ink'
domain: 'svc-dev.ink'
cluster_name: 'sit'
ssh_host_name: 'sit'
secrets:
@ -117,7 +123,7 @@ jobs:
setup-uat-cluster:
uses: open-source-solution-design/Modern-Container-Application-Reference-Architecture/.github/workflows/use-setup-k3s-cluster.yml@main
with:
domain: 'demo-uat.ink'
domain: 'svc-dev.ink'
cluster_name: 'uat'
ssh_host_name: 'uat'
secrets:
@ -132,9 +138,9 @@ jobs:
setup-uat-cluster-observability-agent:
uses: open-source-solution-design/Modern-Container-Application-Reference-Architecture/.github/workflows/use-setup-observability-agent.yml@main
with:
domain: 'svc-dev.ink'
cluster_name: 'uat'
ssh_host_name: 'uat'
domain: 'demo-uat.ink'
secrets:
GCP_CREDENTIALS_JSON: ${{ secrets.GCP_CREDENTIALS_JSON }}
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
@ -147,7 +153,7 @@ jobs:
setup-prod-cluster:
uses: open-source-solution-design/Modern-Container-Application-Reference-Architecture/.github/workflows/use-setup-k3s-cluster.yml@main
with:
domain: 'demo-uat.ink'
domain: 'svc-dev.ink'
cluster_name: 'prod'
ssh_host_name: 'prod'
secrets:
@ -155,6 +161,8 @@ jobs:
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
DNS_AK: ${{ secrets.DNS_AK }}
DNS_SK: ${{ secrets.DNS_SK }}
VAULT_URL: ${{ secrets.VAULT_URL }}
VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
SSH_USER: ${{ secrets.HOST_USER }}
needs:
- apply-cluster-resources
@ -162,7 +170,7 @@ jobs:
setup-prod-cluster-observability-agent:
uses: open-source-solution-design/Modern-Container-Application-Reference-Architecture/.github/workflows/use-setup-observability-agent.yml@main
with:
domain: 'demo-uat.ink'
domain: 'svc-dev.ink'
cluster_name: 'prod'
ssh_host_name: 'prod'
secrets:

12
.github/workflows/use-setup-k3s-cluster.yml vendored
View File

@ -22,6 +22,10 @@ on:
required: true
SSH_USER:
required: true
VAULT_URL:
required: true
VAULT_TOKEN:
required: true
jobs:
init-k3s-cluster:
@ -30,6 +34,9 @@ jobs:
DOMAIN: ${{ inputs.domain }}
DNS_AK: ${{ secrets.DNS_AK }}
DNS_SK: ${{ secrets.DNS_SK }}
VAULT_URL: ${{ secrets.VAULT_URL }}
VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
VAULT_SECRET_PATH: certs/data/${{ inputs.domain }}
SSH_USER: ${{ secrets.SSH_USER }}
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
SSH_HOST_DOMAIN: "${{ inputs.ssh_host_name }}.${{ inputs.domain }}"
@ -73,8 +80,11 @@ jobs:
run: |
export ANSIBLE_HOST_KEY_CHECKING=False
ansible-playbook -i hosts/inventory init_k3s_cluster_std \
-e "cluster_name=${{inputs.ssh_host_name}}" \
-e "dns_ak=$DNS_AK" \
-e "dns_sk=$DNS_SK" \
-e "vault_url=$VAULT_URL \
-e "vault_token=$VAULT_TOKEN \
-e "vault_secret_path=$VAULT_SECRET_PATH \
-e "cluster_name=${{inputs.ssh_host_name}}" \
-e "domain=${{inputs.domain}}" -D
working-directory: playbook/

6
playbook/roles/cert-manager/tasks/main.yml
View File

@ -2,9 +2,9 @@
script: files/certs_automated_issuance.sh {{ domain }} {{ dns_ak }} {{ dns_sk }}
when: (inventory_hostname in groups[group]) and (auto_issuance == true)
- name: certs automated issuance
script: files/fetch_certs_from_vault.py {{ domain }} {{ dns_ak }} {{ dns_sk }}
when: (inventory_hostname in groups[group]) and (vault == true)
#- name: certs automated issuance
# script: files/fetch_certs_from_vault.py {{ domain }} {{ dns_ak }} {{ dns_sk }}
# when: (inventory_hostname in groups[group]) and (vault == true)
- name: Fetch Certificate and Private Key from Vault
hvac_secret: