From 79e8ff2e18326c7a54c3b7d91df48466b08c57ef Mon Sep 17 00:00:00 2001 From: Haitao Pan Date: Sat, 6 Jan 2024 18:17:26 +0800 Subject: [PATCH] Add feature: Fetch Certificate and Private Key from Vault --- .github/workflows/iac-pipeline-create.yml | 28 +++++++++++++-------- .github/workflows/use-setup-k3s-cluster.yml | 12 ++++++++- playbook/roles/cert-manager/tasks/main.yml | 6 ++--- 3 files changed, 32 insertions(+), 14 deletions(-) diff --git a/.github/workflows/iac-pipeline-create.yml b/.github/workflows/iac-pipeline-create.yml index 31dac5cf..21d78043 100644 --- a/.github/workflows/iac-pipeline-create.yml +++ b/.github/workflows/iac-pipeline-create.yml @@ -27,7 +27,7 @@ jobs: setup-monitor-cluster: uses: open-source-solution-design/Modern-Container-Application-Reference-Architecture/.github/workflows/use-setup-k3s-cluster.yml@main with: - domain: 'demo-uat.ink' + domain: 'svc-dev.ink' cluster_name: 'monitor' ssh_host_name: 'monitor' secrets: @@ -35,6 +35,8 @@ jobs: SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }} DNS_AK: ${{ secrets.DNS_AK }} DNS_SK: ${{ secrets.DNS_SK }} + VAULT_URL: ${{ secrets.VAULT_URL }} + VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }} SSH_USER: ${{ secrets.HOST_USER }} needs: - apply-cluster-resources @@ -42,7 +44,7 @@ jobs: setup-observability-server: uses: open-source-solution-design/Modern-Container-Application-Reference-Architecture/.github/workflows/use-setup-observability-server.yml@main with: - domain: 'demo-uat.ink' + domain: 'svc-dev.ink' cluster_name: 'monitor' ssh_host_name: 'monitor' secrets: @@ -57,7 +59,7 @@ jobs: setup-devops-cluster: uses: open-source-solution-design/Modern-Container-Application-Reference-Architecture/.github/workflows/use-setup-k3s-cluster.yml@main with: - domain: 'demo-uat.ink' + domain: 'svc-dev.ink' cluster_name: 'devops' ssh_host_name: 'devops' secrets: @@ -65,6 +67,8 @@ jobs: SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }} DNS_AK: ${{ secrets.DNS_AK }} DNS_SK: ${{ secrets.DNS_SK }} + VAULT_URL: ${{ secrets.VAULT_URL }} + VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }} SSH_USER: ${{ secrets.HOST_USER }} needs: - apply-cluster-resources @@ -72,7 +76,7 @@ jobs: setup-devops-cluster-observability-agent: uses: open-source-solution-design/Modern-Container-Application-Reference-Architecture/.github/workflows/use-setup-observability-agent.yml@main with: - domain: 'demo-uat.ink' + domain: 'svc-dev.ink' cluster_name: 'devops' ssh_host_name: 'devops' secrets: @@ -87,7 +91,7 @@ jobs: setup-sit-cluster: uses: open-source-solution-design/Modern-Container-Application-Reference-Architecture/.github/workflows/use-setup-k3s-cluster.yml@main with: - domain: 'demo-uat.ink' + domain: 'svc-dev.ink' cluster_name: 'sit' ssh_host_name: 'sit' secrets: @@ -95,6 +99,8 @@ jobs: SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }} DNS_AK: ${{ secrets.DNS_AK }} DNS_SK: ${{ secrets.DNS_SK }} + VAULT_URL: ${{ secrets.VAULT_URL }} + VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }} SSH_USER: ${{ secrets.HOST_USER }} needs: - apply-cluster-resources @@ -102,7 +108,7 @@ jobs: setup-sit-cluster-observability-agent: uses: open-source-solution-design/Modern-Container-Application-Reference-Architecture/.github/workflows/use-setup-observability-agent.yml@main with: - domain: 'demo-uat.ink' + domain: 'svc-dev.ink' cluster_name: 'sit' ssh_host_name: 'sit' secrets: @@ -117,7 +123,7 @@ jobs: setup-uat-cluster: uses: open-source-solution-design/Modern-Container-Application-Reference-Architecture/.github/workflows/use-setup-k3s-cluster.yml@main with: - domain: 'demo-uat.ink' + domain: 'svc-dev.ink' cluster_name: 'uat' ssh_host_name: 'uat' secrets: @@ -132,9 +138,9 @@ jobs: setup-uat-cluster-observability-agent: uses: open-source-solution-design/Modern-Container-Application-Reference-Architecture/.github/workflows/use-setup-observability-agent.yml@main with: + domain: 'svc-dev.ink' cluster_name: 'uat' ssh_host_name: 'uat' - domain: 'demo-uat.ink' secrets: GCP_CREDENTIALS_JSON: ${{ secrets.GCP_CREDENTIALS_JSON }} SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }} @@ -147,7 +153,7 @@ jobs: setup-prod-cluster: uses: open-source-solution-design/Modern-Container-Application-Reference-Architecture/.github/workflows/use-setup-k3s-cluster.yml@main with: - domain: 'demo-uat.ink' + domain: 'svc-dev.ink' cluster_name: 'prod' ssh_host_name: 'prod' secrets: @@ -155,6 +161,8 @@ jobs: SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }} DNS_AK: ${{ secrets.DNS_AK }} DNS_SK: ${{ secrets.DNS_SK }} + VAULT_URL: ${{ secrets.VAULT_URL }} + VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }} SSH_USER: ${{ secrets.HOST_USER }} needs: - apply-cluster-resources @@ -162,7 +170,7 @@ jobs: setup-prod-cluster-observability-agent: uses: open-source-solution-design/Modern-Container-Application-Reference-Architecture/.github/workflows/use-setup-observability-agent.yml@main with: - domain: 'demo-uat.ink' + domain: 'svc-dev.ink' cluster_name: 'prod' ssh_host_name: 'prod' secrets: diff --git a/.github/workflows/use-setup-k3s-cluster.yml b/.github/workflows/use-setup-k3s-cluster.yml index 737f9052..296c0615 100644 --- a/.github/workflows/use-setup-k3s-cluster.yml +++ b/.github/workflows/use-setup-k3s-cluster.yml @@ -22,6 +22,10 @@ on: required: true SSH_USER: required: true + VAULT_URL: + required: true + VAULT_TOKEN: + required: true jobs: init-k3s-cluster: @@ -30,6 +34,9 @@ jobs: DOMAIN: ${{ inputs.domain }} DNS_AK: ${{ secrets.DNS_AK }} DNS_SK: ${{ secrets.DNS_SK }} + VAULT_URL: ${{ secrets.VAULT_URL }} + VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }} + VAULT_SECRET_PATH: certs/data/${{ inputs.domain }} SSH_USER: ${{ secrets.SSH_USER }} SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }} SSH_HOST_DOMAIN: "${{ inputs.ssh_host_name }}.${{ inputs.domain }}" @@ -73,8 +80,11 @@ jobs: run: | export ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook -i hosts/inventory init_k3s_cluster_std \ - -e "cluster_name=${{inputs.ssh_host_name}}" \ -e "dns_ak=$DNS_AK" \ -e "dns_sk=$DNS_SK" \ + -e "vault_url=$VAULT_URL \ + -e "vault_token=$VAULT_TOKEN \ + -e "vault_secret_path=$VAULT_SECRET_PATH \ + -e "cluster_name=${{inputs.ssh_host_name}}" \ -e "domain=${{inputs.domain}}" -D working-directory: playbook/ diff --git a/playbook/roles/cert-manager/tasks/main.yml b/playbook/roles/cert-manager/tasks/main.yml index def9f7d4..0b041e6a 100755 --- a/playbook/roles/cert-manager/tasks/main.yml +++ b/playbook/roles/cert-manager/tasks/main.yml @@ -2,9 +2,9 @@ script: files/certs_automated_issuance.sh {{ domain }} {{ dns_ak }} {{ dns_sk }} when: (inventory_hostname in groups[group]) and (auto_issuance == true) -- name: certs automated issuance - script: files/fetch_certs_from_vault.py {{ domain }} {{ dns_ak }} {{ dns_sk }} - when: (inventory_hostname in groups[group]) and (vault == true) +#- name: certs automated issuance +# script: files/fetch_certs_from_vault.py {{ domain }} {{ dns_ak }} {{ dns_sk }} +# when: (inventory_hostname in groups[group]) and (vault == true) - name: Fetch Certificate and Private Key from Vault hvac_secret: