sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

updated to latest workflow

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2024-07-12 08:08:34 +01:00
parent 54e4ee1588
commit 065ab6aec6
No known key found for this signature in database
GPG key ID: 1DE02A772D0908F9
3 changed files with 291 additions and 244 deletions
Download patch file Download diff file Expand all files Collapse all files

259
.github/workflows/devel_pipeline_validation.yml vendored
View file

@ -1,139 +1,158 @@
--- ---
name: Devel pipeline name: Devel pipeline
on: # yamllint disable-line rule:truthy on: # yamllint disable-line rule:truthy
pull_request_target: pull_request_target:
types: [opened, reopened, synchronize] types: [opened, reopened, synchronize]
branches: branches:
- devel - devel
paths: paths:
- '**.yml' - '**.yml'
- '**.sh' - '**.sh'
- '**.j2' - '**.j2'
- '**.ps1' - '**.ps1'
- '**.cfg' - '**.cfg'
# Allow manual running of workflow
workflow_dispatch:
# A workflow run is made up of one or more jobs # Allow permissions for AWS auth
# that can run sequentially or in parallel permissions:
jobs: id-token: write
# This will create messages for first time contributers and direct them to the Discord server contents: read
welcome: pull-requests: read
runs-on: ubuntu-latest
steps: # A workflow run is made up of one or more jobs
- uses: actions/first-interaction@main # that can run sequentially or in parallel
with: jobs:
repo-token: ${{ secrets.GITHUB_TOKEN }} # This will create messages for first time contributers and direct them to the Discord server
pr-message: |- welcome:
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown! runs-on: self-hosted
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
# This workflow contains a single job that tests the playbook steps:
playbook-test: - uses: actions/first-interaction@main
# The type of runner that the job will run on
runs-on: ubuntu-latest
env:
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
# Imported as a variable by terraform
TF_VAR_repository: ${{ github.event.repository.name }}
defaults:
run:
shell: bash
working-directory: .github/workflows/github_linux_IaC
steps:
- name: Clone ${{ github.event.repository.name }}
uses: actions/checkout@v4
with: with:
ref: ${{ github.event.pull_request.head.sha }} repo-token: ${{ secrets.GITHUB_TOKEN }}
pr-message: |-
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
# Pull in terraform code for linux servers # This workflow contains a single job that tests the playbook
- name: Clone GitHub IaC plan playbook-test:
uses: actions/checkout@v4 # The type of runner that the job will run on
with: runs-on: self-hosted
repository: ansible-lockdown/github_linux_IaC env:
path: .github/workflows/github_linux_IaC ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
# Imported as a variable by terraform
TF_VAR_repository: ${{ github.event.repository.name }}
AWS_REGION: "us-east-1"
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
defaults:
run:
shell: bash
working-directory: .github/workflows/github_linux_IaC
# working-directory: .github/workflows
- name: Add_ssh_key steps:
working-directory: .github/workflows
env:
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
PRIVATE_KEY: "${{ secrets.SSH_PRV_KEY }}"
run: |
mkdir .ssh
chmod 700 .ssh
echo $PRIVATE_KEY > .ssh/github_actions.pem
chmod 600 .ssh/github_actions.pem
- name: DEBUG - Show IaC files - name: Git clone the lockdown repository to test
if: env.ENABLE_DEBUG == 'true' uses: actions/checkout@v4
run: | with:
echo "OSVAR = $OSVAR" ref: ${{ github.event.pull_request.head.sha }}
echo "benchmark_type = $benchmark_type"
pwd
ls
env:
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
OSVAR: ${{ vars.OSVAR }}
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
- name: Terraform_Init - name: If a variable for IAC_BRANCH is set use that branch
id: init working-directory: .github/workflows
run: terraform init run: |
env: if [ ${{ vars.IAC_BRANCH }} != '' ]; then
# Imported from GitHub variables this is used to load the relevant OS.tfvars file echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
OSVAR: ${{ vars.OSVAR }} echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} else
echo IAC_BRANCH=main >> $GITHUB_ENV
fi
- name: Terraform_Validate # Pull in terraform code for linux servers
id: validate - name: Clone GitHub IaC plan
run: terraform validate uses: actions/checkout@v4
env: with:
# Imported from GitHub variables this is used to load the relevant OS.tfvars file repository: ansible-lockdown/github_linux_IaC
OSVAR: ${{ vars.OSVAR }} path: .github/workflows/github_linux_IaC
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} ref: ${{ env.IAC_BRANCH }}
- name: Terraform_Apply # Uses dedicated restricted role and policy to enable this only for this task
id: apply # No credentials are part of github for AWS auth
env: - name: configure aws credentials
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} uses: aws-actions/configure-aws-credentials@main
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} with:
OSVAR: ${{ vars.OSVAR }} role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} role-session-name: ${{ secrets.AWS_ROLE_SESSION }}
run: terraform apply -var-file "github_vars.tfvars" -var-file "${OSVAR}.tfvars" --auto-approve -input=false aws-region: ${{ env.AWS_REGION }}
## Debug Section - name: DEBUG - Show IaC files
- name: DEBUG - Show Ansible hostfile if: env.ENABLE_DEBUG == 'true'
if: env.ENABLE_DEBUG == 'true' run: |
run: cat hosts.yml echo "OSVAR = $OSVAR"
echo "benchmark_type = $benchmark_type"
echo "PRIVSUBNET_ID = $AWS_PRIVSUBNET_ID"
echo "VPC_ID" = $AWS_VPC_SECGRP_ID"
pwd
ls
env:
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
OSVAR: ${{ vars.OSVAR }}
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
PRIVSUBNET_ID: ${{ secrets.AWS_PRIVSUBNET_ID }}
VPC_ID: ${{ secrets.AWS_VPC_SECGRP_ID }}
# Aws deployments taking a while to come up insert sleep or playbook fails - name: Tofu init
id: init
run: tofu init
env:
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
OSVAR: ${{ vars.OSVAR }}
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
- name: Sleep for 60 seconds - name: Tofu validate
run: sleep ${{ vars.BUILD_SLEEPTIME }} id: validate
run: tofu validate
env:
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
OSVAR: ${{ vars.OSVAR }}
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
# Run the Ansibleplaybook - name: Tofu apply
- name: Run_Ansible_Playbook id: apply
uses: arillso/action.playbook@master env:
with: OSVAR: ${{ vars.OSVAR }}
playbook: site.yml TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
inventory: .github/workflows/github_linux_IaC/hosts.yml TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
galaxy_file: collections/requirements.yml TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
private_key: ${{ secrets.SSH_PRV_KEY }} run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
# verbose: 3
env:
ANSIBLE_HOST_KEY_CHECKING: "false"
ANSIBLE_DEPRECATION_WARNINGS: "false"
ANSIBLE_INJECT_FACT_VARS: "false"
# Remove test system - User secrets to keep if necessary ## Debug Section
- name: DEBUG - Show Ansible hostfile
if: env.ENABLE_DEBUG == 'true'
run: cat hosts.yml
- name: Terraform_Destroy # Aws deployments taking a while to come up insert sleep or playbook fails
if: always() && env.ENABLE_DEBUG == 'false'
env: - name: Sleep to allow system to come up
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} run: sleep ${{ vars.BUILD_SLEEPTIME }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
OSVAR: ${{ vars.OSVAR }} # Run the Ansible playbook
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} - name: Run_Ansible_Playbook
run: terraform destroy -var-file "github_vars.tfvars" -var-file "${OSVAR}.tfvars" --auto-approve -input=false env:
ANSIBLE_HOST_KEY_CHECKING: "false"
ANSIBLE_DEPRECATION_WARNINGS: "false"
run: |
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml
# Remove test system - User secrets to keep if necessary
- name: Tofu Destroy
if: always() && env.ENABLE_DEBUG == 'false'
env:
OSVAR: ${{ vars.OSVAR }}
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false

246
.github/workflows/main_pipeline_validation.yml vendored
View file

@ -1,128 +1,156 @@
--- ---
name: Main pipeline name: Main pipeline
on: # yamllint disable-line rule:truthy on: # yamllint disable-line rule:truthy
pull_request_target: pull_request_target:
types: [opened, reopened, synchronize] types: [opened, reopened, synchronize]
branches: branches:
- main - main
paths: paths:
- '**.yml' - '**.yml'
- '**.sh' - '**.sh'
- '**.j2' - '**.j2'
- '**.ps1' - '**.ps1'
- '**.cfg' - '**.cfg'
# A workflow run is made up of one or more jobs # Allow permissions for AWS auth
# that can run sequentially or in parallel permissions:
jobs: id-token: write
contents: read
pull-requests: read
# This workflow contains a single job that tests the playbook # A workflow run is made up of one or more jobs
playbook-test: # that can run sequentially or in parallel
# The type of runner that the job will run on jobs:
runs-on: ubuntu-latest # This will create messages for first time contributers and direct them to the Discord server
env: welcome:
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }} runs-on: self-hosted
# Imported as a variable by terraform
TF_VAR_repository: ${{ github.event.repository.name }}
defaults:
run:
shell: bash
working-directory: .github/workflows/github_linux_IaC
steps: steps:
- name: Clone ${{ github.event.repository.name }} - uses: actions/first-interaction@main
uses: actions/checkout@v4
with: with:
ref: ${{ github.event.pull_request.head.sha }} repo-token: ${{ secrets.GITHUB_TOKEN }}
pr-message: |-
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
# Pull in terraform code for linux servers # This workflow contains a single job that tests the playbook
- name: Clone GitHub IaC plan playbook-test:
uses: actions/checkout@v4 # The type of runner that the job will run on
with: runs-on: self-hosted
repository: ansible-lockdown/github_linux_IaC env:
path: .github/workflows/github_linux_IaC ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
# Imported as a variable by terraform
TF_VAR_repository: ${{ github.event.repository.name }}
AWS_REGION : "us-east-1"
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
defaults:
run:
shell: bash
working-directory: .github/workflows/github_linux_IaC
# working-directory: .github/workflows
- name: Add_ssh_key steps:
working-directory: .github/workflows
env:
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
PRIVATE_KEY: "${{ secrets.SSH_PRV_KEY }}"
run: |
mkdir .ssh
chmod 700 .ssh
echo $PRIVATE_KEY > .ssh/github_actions.pem
chmod 600 .ssh/github_actions.pem
- name: DEBUG - Show IaC files - name: Git clone the lockdown repository to test
if: env.ENABLE_DEBUG == 'true' uses: actions/checkout@v4
run: | with:
echo "OSVAR = $OSVAR" ref: ${{ github.event.pull_request.head.sha }}
echo "benchmark_type = $benchmark_type"
pwd
ls
env:
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
OSVAR: ${{ vars.OSVAR }}
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
- name: Terraform_Init - name: If a variable for IAC_BRANCH is set use that branch
id: init working-directory: .github/workflows
run: terraform init run: |
env: if [ ${{ vars.IAC_BRANCH }} != '' ]; then
# Imported from GitHub variables this is used to load the relevant OS.tfvars file echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
OSVAR: ${{ vars.OSVAR }} echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} else
echo IAC_BRANCH=main >> $GITHUB_ENV
fi
- name: Terraform_Validate # Pull in terraform code for linux servers
id: validate - name: Clone GitHub IaC plan
run: terraform validate uses: actions/checkout@v4
env: with:
# Imported from GitHub variables this is used to load the relevant OS.tfvars file repository: ansible-lockdown/github_linux_IaC
OSVAR: ${{ vars.OSVAR }} path: .github/workflows/github_linux_IaC
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} ref: ${{ env.IAC_BRANCH }}
- name: Terraform_Apply # Uses dedicated restricted role and policy to enable this only for this task
id: apply # No credentials are part of github for AWS auth
env: - name: configure aws credentials
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} uses: aws-actions/configure-aws-credentials@main
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} with:
OSVAR: ${{ vars.OSVAR }} role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} role-session-name: ${{ secrets.AWS_ROLE_SESSION }}
run: terraform apply -var-file "github_vars.tfvars" -var-file "${OSVAR}.tfvars" --auto-approve -input=false aws-region: ${{ env.AWS_REGION }}
## Debug Section - name: DEBUG - Show IaC files
- name: DEBUG - Show Ansible hostfile if: env.ENABLE_DEBUG == 'true'
if: env.ENABLE_DEBUG == 'true' run: |
run: cat hosts.yml echo "OSVAR = $OSVAR"
echo "benchmark_type = $benchmark_type"
echo "PRIVSUBNET_ID = $AWS_PRIVSUBNET_ID"
echo "VPC_ID" = $AWS_VPC_SECGRP_ID"
pwd
ls
env:
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
OSVAR: ${{ vars.OSVAR }}
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
PRIVSUBNET_ID: ${{ secrets.AWS_PRIVSUBNET_ID }}
VPC_ID: ${{ secrets.AWS_VPC_SECGRP_ID }}
# Aws deployments taking a while to come up insert sleep or playbook fails - name: Tofu init
id: init
run: tofu init
env:
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
OSVAR: ${{ vars.OSVAR }}
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
- name: Sleep for 60 seconds - name: Tofu validate
run: sleep ${{ vars.BUILD_SLEEPTIME }} id: validate
run: tofu validate
env:
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
OSVAR: ${{ vars.OSVAR }}
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
# Run the Ansibleplaybook - name: Tofu apply
- name: Run_Ansible_Playbook id: apply
uses: arillso/action.playbook@master env:
with: OSVAR: ${{ vars.OSVAR }}
playbook: site.yml TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
inventory: .github/workflows/github_linux_IaC/hosts.yml TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
galaxy_file: collections/requirements.yml TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
private_key: ${{ secrets.SSH_PRV_KEY }} run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
# verbose: 3
env:
ANSIBLE_HOST_KEY_CHECKING: "false"
ANSIBLE_DEPRECATION_WARNINGS: "false"
ANSIBLE_INJECT_FACT_VARS: "false"
# Remove test system - User secrets to keep if necessary ## Debug Section
- name: DEBUG - Show Ansible hostfile
if: env.ENABLE_DEBUG == 'true'
run: cat hosts.yml
- name: Terraform_Destroy # Aws deployments taking a while to come up insert sleep or playbook fails
if: always() && env.ENABLE_DEBUG == 'false'
env: - name: Sleep to allow system to come up
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} run: sleep ${{ vars.BUILD_SLEEPTIME }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
OSVAR: ${{ vars.OSVAR }} # Run the Ansible playbook
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }} - name: Run_Ansible_Playbook
run: terraform destroy -var-file "github_vars.tfvars" -var-file "${OSVAR}.tfvars" --auto-approve -input=false env:
ANSIBLE_HOST_KEY_CHECKING: "false"
ANSIBLE_DEPRECATION_WARNINGS: "false"
run: |
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml
# Remove test system - User secrets to keep if necessary
- name: Tofu Destroy
if: always() && env.ENABLE_DEBUG == 'false'
env:
OSVAR: ${{ vars.OSVAR }}
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false

30
.github/workflows/update_galaxy.yml vendored
View file

@ -1,19 +1,19 @@
--- ---
name: update galaxy name: update galaxy
on: on:
push: push:
branches: branches:
- main - main
jobs: jobs:
update_role: update_role:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Checkout repo - name: Checkout repo
uses: actions/checkout@v4 uses: actions/checkout@v4
- name: Action Ansible Galaxy Release ${{ github.ref_name }} - name: Action Ansible Galaxy Release ${{ github.ref_name }}
uses: ansible-actions/ansible-galaxy-action@main uses: ansible-actions/ansible-galaxy-action@main
with: with:
galaxy_api_key: ${{ secrets.GALAXY_API_KEY }} galaxy_api_key: ${{ secrets.GALAXY_API_KEY }}