Skip to content

Commit 16cb6a4

Browse files
uk-bollyuk-bolly
authored
Merge pull request #235 from ansible-lockdown/devel
rhel9-cis main release v1.0.0
2 parents 151896e + 4fb533b commit 16cb6a4

20 files changed

+440
-404
lines changed

‎.config/requirements.txt

-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
passlib
22
lxml
33
xmltodict
4-
jmespath
54
yamllint

‎.github/workflows/devel_pipeline_validation.yml

+155-136
Original file line numberDiff line numberDiff line change
@@ -1,139 +1,158 @@
11
---
22

3-
name: Devel pipeline
4-
5-
on: # yamllint disable-line rule:truthy
6-
pull_request_target:
7-
types: [opened, reopened, synchronize]
8-
branches:
9-
- devel
10-
paths:
11-
- '**.yml'
12-
- '**.sh'
13-
- '**.j2'
14-
- '**.ps1'
15-
- '**.cfg'
16-
17-
# A workflow run is made up of one or more jobs
18-
# that can run sequentially or in parallel
19-
jobs:
20-
# This will create messages for first time contributers and direct them to the Discord server
21-
welcome:
22-
runs-on: ubuntu-latest
23-
24-
steps:
25-
- uses: actions/first-interaction@main
26-
with:
27-
repo-token: ${{ secrets.GITHUB_TOKEN }}
28-
pr-message: |-
29-
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
30-
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
31-
32-
# This workflow contains a single job that tests the playbook
33-
playbook-test:
34-
# The type of runner that the job will run on
35-
runs-on: ubuntu-latest
36-
env:
37-
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
38-
# Imported as a variable by terraform
39-
TF_VAR_repository: ${{ github.event.repository.name }}
40-
defaults:
41-
run:
42-
shell: bash
43-
working-directory: .github/workflows/github_linux_IaC
44-
45-
steps:
46-
- name: Clone ${{ github.event.repository.name }}
47-
uses: actions/checkout@v4
3+
name: Devel pipeline
4+
5+
on: # yamllint disable-line rule:truthy
6+
pull_request_target:
7+
types: [opened, reopened, synchronize]
8+
branches:
9+
- devel
10+
paths:
11+
- '**.yml'
12+
- '**.sh'
13+
- '**.j2'
14+
- '**.ps1'
15+
- '**.cfg'
16+
# Allow manual running of workflow
17+
workflow_dispatch:
18+
19+
# Allow permissions for AWS auth
20+
permissions:
21+
id-token: write
22+
contents: read
23+
pull-requests: read
24+
25+
# A workflow run is made up of one or more jobs
26+
# that can run sequentially or in parallel
27+
jobs:
28+
# This will create messages for first time contributers and direct them to the Discord server
29+
welcome:
30+
runs-on: self-hosted
31+
32+
steps:
33+
- uses: actions/first-interaction@main
4834
with:
49-
ref: ${{ github.event.pull_request.head.sha }}
50-
51-
# Pull in terraform code for linux servers
52-
- name: Clone GitHub IaC plan
53-
uses: actions/checkout@v4
54-
with:
55-
repository: ansible-lockdown/github_linux_IaC
56-
path: .github/workflows/github_linux_IaC
57-
58-
- name: Add_ssh_key
59-
working-directory: .github/workflows
60-
env:
61-
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
62-
PRIVATE_KEY: "${{ secrets.SSH_PRV_KEY }}"
63-
run: |
64-
mkdir .ssh
65-
chmod 700 .ssh
66-
echo $PRIVATE_KEY > .ssh/github_actions.pem
67-
chmod 600 .ssh/github_actions.pem
68-
69-
- name: DEBUG - Show IaC files
70-
if: env.ENABLE_DEBUG == 'true'
71-
run: |
72-
echo "OSVAR = $OSVAR"
73-
echo "benchmark_type = $benchmark_type"
74-
pwd
75-
ls
76-
env:
77-
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
78-
OSVAR: ${{ vars.OSVAR }}
79-
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
80-
81-
- name: Terraform_Init
82-
id: init
83-
run: terraform init
84-
env:
85-
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
86-
OSVAR: ${{ vars.OSVAR }}
87-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
88-
89-
- name: Terraform_Validate
90-
id: validate
91-
run: terraform validate
92-
env:
93-
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
94-
OSVAR: ${{ vars.OSVAR }}
95-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
96-
97-
- name: Terraform_Apply
98-
id: apply
99-
env:
100-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
101-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
102-
OSVAR: ${{ vars.OSVAR }}
103-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
104-
run: terraform apply -var-file "github_vars.tfvars" -var-file "${OSVAR}.tfvars" --auto-approve -input=false
105-
106-
## Debug Section
107-
- name: DEBUG - Show Ansible hostfile
108-
if: env.ENABLE_DEBUG == 'true'
109-
run: cat hosts.yml
110-
111-
# Aws deployments taking a while to come up insert sleep or playbook fails
112-
113-
- name: Sleep for 60 seconds
114-
run: sleep ${{ vars.BUILD_SLEEPTIME }}
115-
116-
# Run the Ansibleplaybook
117-
- name: Run_Ansible_Playbook
118-
uses: arillso/action.playbook@master
119-
with:
120-
playbook: site.yml
121-
inventory: .github/workflows/github_linux_IaC/hosts.yml
122-
galaxy_file: collections/requirements.yml
123-
private_key: ${{ secrets.SSH_PRV_KEY }}
124-
# verbose: 3
125-
env:
126-
ANSIBLE_HOST_KEY_CHECKING: "false"
127-
ANSIBLE_DEPRECATION_WARNINGS: "false"
128-
ANSIBLE_INJECT_FACT_VARS: "false"
129-
130-
# Remove test system - User secrets to keep if necessary
131-
132-
- name: Terraform_Destroy
133-
if: always() && env.ENABLE_DEBUG == 'false'
134-
env:
135-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
136-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
137-
OSVAR: ${{ vars.OSVAR }}
138-
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
139-
run: terraform destroy -var-file "github_vars.tfvars" -var-file "${OSVAR}.tfvars" --auto-approve -input=false
35+
repo-token: ${{ secrets.GITHUB_TOKEN }}
36+
pr-message: |-
37+
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
38+
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
39+
40+
# This workflow contains a single job that tests the playbook
41+
playbook-test:
42+
# The type of runner that the job will run on
43+
runs-on: self-hosted
44+
env:
45+
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
46+
# Imported as a variable by terraform
47+
TF_VAR_repository: ${{ github.event.repository.name }}
48+
AWS_REGION: "us-east-1"
49+
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
50+
defaults:
51+
run:
52+
shell: bash
53+
working-directory: .github/workflows/github_linux_IaC
54+
# working-directory: .github/workflows
55+
56+
steps:
57+
58+
- name: Git clone the lockdown repository to test
59+
uses: actions/checkout@v4
60+
with:
61+
ref: ${{ github.event.pull_request.head.sha }}
62+
63+
- name: If a variable for IAC_BRANCH is set use that branch
64+
working-directory: .github/workflows
65+
run: |
66+
if [ ${{ vars.IAC_BRANCH }} != '' ]; then
67+
echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
68+
echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
69+
else
70+
echo IAC_BRANCH=main >> $GITHUB_ENV
71+
fi
72+
73+
# Pull in terraform code for linux servers
74+
- name: Clone GitHub IaC plan
75+
uses: actions/checkout@v4
76+
with:
77+
repository: ansible-lockdown/github_linux_IaC
78+
path: .github/workflows/github_linux_IaC
79+
ref: ${{ env.IAC_BRANCH }}
80+
81+
# Uses dedicated restricted role and policy to enable this only for this task
82+
# No credentials are part of github for AWS auth
83+
- name: configure aws credentials
84+
uses: aws-actions/configure-aws-credentials@main
85+
with:
86+
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
87+
role-session-name: ${{ secrets.AWS_ROLE_SESSION }}
88+
aws-region: ${{ env.AWS_REGION }}
89+
90+
- name: DEBUG - Show IaC files
91+
if: env.ENABLE_DEBUG == 'true'
92+
run: |
93+
echo "OSVAR = $OSVAR"
94+
echo "benchmark_type = $benchmark_type"
95+
echo "PRIVSUBNET_ID = $AWS_PRIVSUBNET_ID"
96+
echo "VPC_ID" = $AWS_VPC_SECGRP_ID"
97+
pwd
98+
ls
99+
env:
100+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
101+
OSVAR: ${{ vars.OSVAR }}
102+
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
103+
PRIVSUBNET_ID: ${{ secrets.AWS_PRIVSUBNET_ID }}
104+
VPC_ID: ${{ secrets.AWS_VPC_SECGRP_ID }}
105+
106+
- name: Tofu init
107+
id: init
108+
run: tofu init
109+
env:
110+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
111+
OSVAR: ${{ vars.OSVAR }}
112+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
113+
114+
- name: Tofu validate
115+
id: validate
116+
run: tofu validate
117+
env:
118+
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
119+
OSVAR: ${{ vars.OSVAR }}
120+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
121+
122+
- name: Tofu apply
123+
id: apply
124+
env:
125+
OSVAR: ${{ vars.OSVAR }}
126+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
127+
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
128+
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
129+
run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
130+
131+
## Debug Section
132+
- name: DEBUG - Show Ansible hostfile
133+
if: env.ENABLE_DEBUG == 'true'
134+
run: cat hosts.yml
135+
136+
# Aws deployments taking a while to come up insert sleep or playbook fails
137+
138+
- name: Sleep to allow system to come up
139+
run: sleep ${{ vars.BUILD_SLEEPTIME }}
140+
141+
# Run the Ansible playbook
142+
- name: Run_Ansible_Playbook
143+
env:
144+
ANSIBLE_HOST_KEY_CHECKING: "false"
145+
ANSIBLE_DEPRECATION_WARNINGS: "false"
146+
run: |
147+
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml
148+
149+
# Remove test system - User secrets to keep if necessary
150+
151+
- name: Tofu Destroy
152+
if: always() && env.ENABLE_DEBUG == 'false'
153+
env:
154+
OSVAR: ${{ vars.OSVAR }}
155+
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
156+
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
157+
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
158+
run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false

0 commit comments

Comments
 (0)