Skip to content

Commit 6b5617d

Browse files
uk-bollyuk-bolly
committed
initial
Signed-off-by: Mark Bolwell <[email protected]>
1 parent c165982 commit 6b5617d

15 files changed

+529
-0
lines changed

‎.gitignore

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
.env
2+
*.log
3+
*.retry
4+
.vagrant
5+
tests/*redhat-subscription
6+
tests/Dockerfile
7+
*.iso
8+
*.box
9+
packer_cache
10+
delete*
11+
ignore*
12+
.cache
13+
# VSCode
14+
.vscode
15+
.github/*
16+
# Byte-compiled / optimized / DLL files
17+
__pycache__/
18+
*.py[cod]
19+
*$py.class
20+
.output-mpg
21+
22+
# DS_Store
23+
.DS_Store
24+
._*
25+
26+
# Linux Editors
27+
*~
28+
\#*\#
29+
/.emacs.desktop
30+
/.emacs.desktop.lock
31+
.elc
32+
auto-save-list
33+
tramp
34+
.\#*
35+
*.swp
36+
*.swo
37+
rh-creds.env
38+
travis.env
39+
40+
# Lockdown-specific
41+
benchparse/
42+
*xccdf.xml
43+
*.retry
44+
test_inv
45+
46+
# refactr workflow gitignore
47+
.github/workflow/
48+
49+
# GitHub Issue and PR Templates
50+
.github/ISSUE_TEMPLATE
51+
.github/pull_request_template.md
52+
53+
# terraform
54+
.terraform/
55+
.terraform.local.hcl
56+
.terraform*
57+
terraform.tfstate*
58+
hosts.yml
59+
60+
*_key
61+
*.pub
62+
63+
# Ignore dynamic inventory
64+
AWS_config/inventory.yml
65+
66+
# ignore roles for repo
67+
playbooks/roles/awx_*/
68+
playbooks/roles/ansible_*/

‎AMAZON2.tfvars

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Amazon Linux 2
2+
ami_id = "ami-03e0b06f01d45a4eb"
3+
ami_os = "AmazonLinux2"
4+
ami_username = "ec2-user"
5+
ami_user_home = "/home/ec2-user"
6+
benchmark_os = "Amazon2"

‎README.md

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# Github linux IaC
2+
3+
terraform workflow files for use with the LE linux based pipelines
4+
5+
## Requirements
6+
7+
Each repo needs to have the following variables set
8+
repository variables required - settings/actions/variables
9+
10+
- OSVARS = OS TYPE for benchmark
11+
- Benchmark_type = Type of benchmark (CIS or STIG)
12+
13+
eg.
14+
15+
```shell
16+
OSVARS RHEL9
17+
BENCHMARK_TYPE CIS
18+
```
19+
20+
## Overview
21+
22+
This is called by the repository workflow to pull in this content.
23+
This enables us to manage the workflow and IAC centrally, enabling us to quickly change anything for improvements of issues with a certain region.
24+
25+
```mermaid
26+
A[Benchmark Pipeline] -->|Starts the github workflow|B[Loads linux_benchmark_testing]
27+
B --> C[Imports variables set in repo]
28+
C --> D[STEP - Welcome Message]
29+
D --> E[Sends welcome if first PR and invite to discord]
30+
C --> F[STEP - Build testing pipeline]
31+
F --> G[Starts runner based on ubuntu latest]
32+
G --> H[Imports Variables for usage across workflow]
33+
H --> I[Git Clone in repo and source branch PR is requested from]
34+
I --> J[Git Clone this content for IaC portion of pipeline]
35+
J --> K[creates a local key to be used - Secret]
36+
K --> L[Runs terraform steps]
37+
L -->|terraform init|M[Initiates terraform]
38+
M -->|terraform validate|N[Validates config]
39+
N -->|terraform apply|O[Runs terraform and sets up host]
40+
O -->|sleep 60 seconds|P[If Debug variable set output ansible hosts]
41+
P --> Q[Runs ansible playbook] --> |terraform destroy|R[Destroys all the IaC config]
42+
```

‎RHEL7.tfvars

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#Ami centos 7.11
2+
ami_id = "ami-00e87074e52e6c9f9"
3+
ami_os = "centos7"
4+
ami_username = "centos"
5+
ami_user_home = "/home/centos"
6+
benchmark_os = "RHEL7"
7+

‎RHEL8.tfvars

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#Ami Rocky 85
2+
ami_id = "ami-043ceee68871e0bb5"
3+
ami_os = "rocky8"
4+
ami_username = "rocky"
5+
ami_user_home = "/home/rocky"
6+
benchmark_os = "RHEL8"

‎RHEL9.tfvars

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#Ami Alma 9.2
2+
ami_id = "ami-06bc84fafec254e1d"
3+
ami_os = "rhel9"
4+
ami_username = "ec2-user"
5+
ami_user_home = "/home/ec2-user"
6+
benchmark_os = "RHEL9"

‎UBUNTU18.tfvars

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#Ami ubuntu1804
2+
ami_id = "ami-0d9b9c46fcdf2864f"
3+
ami_os = "ubuntu18"
4+
ami_username = "ubuntu"
5+
ami_user_home = "/home/ubuntu"
6+
benchmark_os = "UBUNTU18"

‎UBUNTU20.tfvars

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#Ami ubuntu 2004
2+
ami_id = "ami-05fe5907b25984493"
3+
ami_os = "ubuntu20"
4+
ami_username = "ubuntu"
5+
ami_user_home = "/home/ubuntu"
6+
benchmark_os = "UBUNTU20"

‎UBUNTU22.tfvars

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#Ami ubuntu 2204
2+
ami_id = "ami-051dcca84f1edfff1"
3+
ami_os = "ubuntu22"
4+
ami_username = "ubuntu"
5+
ami_user_home = "/home/ubuntu"
6+
benchmark_os = "UBUNTU22"

‎github_networks.tf

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
resource "aws_vpc" "Main" {
2+
cidr_block = var.main_vpc_cidr
3+
instance_tenancy = "default"
4+
tags = {
5+
Environment = "${var.environment}"
6+
Name = "${var.namespace}-VPC"
7+
}
8+
}
9+
10+
resource "aws_internet_gateway" "IGW" {
11+
vpc_id = aws_vpc.Main.id
12+
tags = {
13+
Environment = "${var.environment}"
14+
Name = "${var.namespace}-IGW"
15+
}
16+
}
17+
18+
resource "aws_subnet" "publicsubnets" {
19+
vpc_id = aws_vpc.Main.id
20+
cidr_block = var.public_subnets
21+
availability_zone = var.availability_zone
22+
tags = {
23+
Environment = "${var.environment}"
24+
Name = "${var.namespace}-pubsub"
25+
}
26+
}
27+
28+
resource "aws_subnet" "Main" {
29+
vpc_id = aws_vpc.Main.id
30+
cidr_block = var.private_subnets
31+
availability_zone = var.availability_zone
32+
tags = {
33+
Environment = "${var.environment}"
34+
Name = "${var.namespace}-prvsub"
35+
}
36+
}
37+
38+
resource "aws_route_table" "PublicRT" {
39+
vpc_id = aws_vpc.Main.id
40+
route {
41+
cidr_block = "0.0.0.0/0"
42+
gateway_id = aws_internet_gateway.IGW.id
43+
}
44+
tags = {
45+
Environment = "${var.environment}"
46+
Name = "${var.namespace}-publicRT"
47+
}
48+
}
49+
50+
resource "aws_route_table_association" "rt_associate_public" {
51+
subnet_id = aws_subnet.Main.id
52+
route_table_id = aws_route_table.PublicRT.id
53+
}

‎github_vars.tfvars

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
// github_actions variables
2+
// Resourced in github_networks.tf
3+
// Declared in variables.tf
4+
//
5+
6+
namespace = "Lockdown_enterprise_workflow"
7+
8+
// Matching pair name found in AWS for keypairs PEM key
9+
ami_key_pair_name = "github_actions"
10+
private_key = ".ssh/github_actions.pem"
11+
main_vpc_cidr = "172.22.0.0/24"
12+
public_subnets = "172.22.0.128/26"
13+
private_subnets = "172.22.0.192/26"

‎linux_benchmark_testing.yml

+127
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
# This is a basic workflow to help you get started with Actions
2+
3+
name: linux_benchmark_pipeline
4+
5+
# Controls when the action will run.
6+
# Triggers the workflow on push or pull request
7+
# events but only for the devel branch
8+
on: # yamllint disable-line rule:truthy
9+
pull_request_target:
10+
types: [opened, reopened, synchronize]
11+
branches:
12+
- devel
13+
- main
14+
paths:
15+
- '**.yml'
16+
- '**.sh'
17+
- '**.j2'
18+
- '**.ps1'
19+
- '**.cfg'
20+
21+
# A workflow run is made up of one or more jobs
22+
# that can run sequentially or in parallel
23+
jobs:
24+
# This will create messages for first time contributers and direct them to the Discord server
25+
welcome:
26+
runs-on: ubuntu-latest
27+
28+
steps:
29+
- uses: actions/first-interaction@main
30+
with:
31+
repo-token: ${{ secrets.GITHUB_TOKEN }}
32+
pr-message: |-
33+
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
34+
Please join in the conversation happening on the [Discord Server](https://discord.io/ansible-lockdown) as well.
35+
# This workflow contains a single job called "build"
36+
build:
37+
# The type of runner that the job will run on
38+
runs-on: ubuntu-latest
39+
defaults:
40+
run:
41+
shell: bash
42+
working-directory: .github/workflows/github_linux_IaC
43+
44+
env:
45+
ENABLE_DEBUG: false
46+
# Imported as a variable by terraform
47+
TF_VAR_repository: ${{ github.event.repository.name }}
48+
# Imported from github variables this is used to load the relvent OS.tfvars file
49+
OSVAR: ${{ env.OSVAR }}
50+
BENCHMARK_TYPE: ${{ env.BENCHMARK_TYPE }}
51+
52+
# Steps represent a sequence of tasks that will be executed as part of the job
53+
steps:
54+
# Checks-out your repository under $GITHUB_WORKSPACE,
55+
# so your job can access it
56+
- name: Clone ${{ github.event.repository.name }}
57+
uses: actions/checkout@v3
58+
with:
59+
ref: ${{ github.event.pull_request.head.sha }}
60+
61+
# Pull in terraform code for linux servers
62+
- name: Clone github IaC plan
63+
uses: actions/checkout@v3
64+
with:
65+
respository: ansible-lockdown/github_linux_IaC
66+
path: github_linux_IaC
67+
68+
- name: Add_ssh_key
69+
working-directory: .github/workflows
70+
env:
71+
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
72+
PRIVATE_KEY: "${{ secrets.SSH_PRV_KEY }}"
73+
run: |
74+
mkdir .ssh
75+
chmod 700 .ssh
76+
echo $PRIVATE_KEY > .ssh/github_actions.pem
77+
chmod 600 .ssh/github_actions.pem
78+
79+
### Build out the server
80+
81+
- name: Terraform_Init
82+
id: init
83+
run: terraform init
84+
85+
- name: Terraform_Validate
86+
id: validate
87+
run: terraform validate
88+
89+
- name: Terraform_Apply
90+
id: apply
91+
env:
92+
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
93+
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
94+
run: terraform apply -var-file "github_vars.tfvars" -var-file "${OSVAR}.tfvars" --auto-approve -input=false
95+
96+
## Debug Section
97+
- name: DEBUG - Show Ansible hostfile
98+
if: env.ENABLE_DEBUG == 'true'
99+
run: cat hosts.yml
100+
101+
# Aws deployments taking a while to come up insert sleep or playbook fails
102+
103+
- name: Sleep for 60 seconds
104+
run: sleep 60s
105+
shell: bash
106+
107+
# Run the ansible playbook
108+
- name: Run_Ansible_Playbook
109+
uses: arillso/action.playbook@master
110+
with:
111+
playbook: site.yml
112+
inventory: .github/workflows/github_IaC/hosts.yml
113+
galaxy_file: collections/requirements.yml
114+
private_key: ${{ secrets.SSH_PRV_KEY }}
115+
# verbose: 3
116+
env:
117+
ANSIBLE_HOST_KEY_CHECKING: "false"
118+
ANSIBLE_DEPRECATION_WARNINGS: "false"
119+
120+
# Remove test system - User secrets to keep if necessary
121+
122+
- name: Terraform_Destroy
123+
if: always() && env.ENABLE_DEBUG == 'false'
124+
env:
125+
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
126+
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
127+
run: terraform destroy -var-file "github_vars.tfvars" -var-file "${OSVAR}.tfvars" --auto-approve -input=false

0 commit comments

Comments
 (0)