forked from ansible-lockdown/RHEL9-CIS
workflows updated
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell
parent
d2b371432e
commit
ed5942f494
2 changed files with 229 additions and 236 deletions
242
.github/workflows/devel_pipeline_validation.yml
vendored
242
.github/workflows/devel_pipeline_validation.yml
vendored
|
|
@ -4,16 +4,16 @@
|
||||||
|
|
||||||
on: # yamllint disable-line rule:truthy
|
on: # yamllint disable-line rule:truthy
|
||||||
pull_request_target:
|
pull_request_target:
|
||||||
types: [opened, reopened, synchronize]
|
types: [opened, reopened, synchronize]
|
||||||
branches:
|
branches:
|
||||||
- devel
|
- devel
|
||||||
- benchmark*
|
- benchmark*
|
||||||
paths:
|
paths:
|
||||||
- '**.yml'
|
- '**.yml'
|
||||||
- '**.sh'
|
- '**.sh'
|
||||||
- '**.j2'
|
- '**.j2'
|
||||||
- '**.ps1'
|
- '**.ps1'
|
||||||
- '**.cfg'
|
- '**.cfg'
|
||||||
# Allow manual running of workflow
|
# Allow manual running of workflow
|
||||||
workflow_dispatch:
|
workflow_dispatch:
|
||||||
|
|
||||||
|
|
@ -27,133 +27,131 @@
|
||||||
# that can run sequentially or in parallel
|
# that can run sequentially or in parallel
|
||||||
jobs:
|
jobs:
|
||||||
# This will create messages for first time contributers and direct them to the Discord server
|
# This will create messages for first time contributers and direct them to the Discord server
|
||||||
welcome:
|
welcome:
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
|
|
||||||
steps:
|
steps:
|
||||||
- uses: actions/first-interaction@main
|
- uses: actions/first-interaction@main
|
||||||
with:
|
with:
|
||||||
repo-token: ${{ secrets.GITHUB_TOKEN }}
|
repo_token: ${{ secrets.GITHUB_TOKEN }}
|
||||||
pr-message: |-
|
issue_message: |-
|
||||||
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
|
Congrats on opening your first issue and thank you for taking the time to help improve Ansible-Lockdown!
|
||||||
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
|
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
|
||||||
|
pr_message: |-
|
||||||
|
Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
|
||||||
|
Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
|
||||||
|
|
||||||
# This workflow contains a single job that tests the playbook
|
# This workflow contains a single job that tests the playbook
|
||||||
playbook-test:
|
playbook-test:
|
||||||
# The type of runner that the job will run on
|
# The type of runner that the job will run on
|
||||||
runs-on: self-hosted
|
runs-on: self-hosted
|
||||||
env:
|
env:
|
||||||
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
|
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
|
||||||
# Imported as a variable by terraform
|
# Imported as a variable by terraform
|
||||||
TF_VAR_repository: ${{ github.event.repository.name }}
|
TF_VAR_repository: ${{ github.event.repository.name }}
|
||||||
AWS_REGION: "us-east-1"
|
AWS_REGION: "us-east-1"
|
||||||
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
|
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
|
||||||
defaults:
|
defaults:
|
||||||
run:
|
run:
|
||||||
shell: bash
|
shell: bash
|
||||||
working-directory: .github/workflows/github_linux_IaC
|
working-directory: .github/workflows/github_linux_IaC
|
||||||
# working-directory: .github/workflows
|
# working-directory: .github/workflows
|
||||||
|
|
||||||
steps:
|
steps:
|
||||||
|
|
||||||
- name: Git clone the lockdown repository to test
|
- name: Git clone the lockdown repository to test
|
||||||
uses: actions/checkout@v4
|
uses: actions/checkout@v4
|
||||||
with:
|
with:
|
||||||
ref: ${{ github.event.pull_request.head.sha }}
|
ref: ${{ github.event.pull_request.head.sha }}
|
||||||
|
|
||||||
- name: If a variable for IAC_BRANCH is set use that branch
|
- name: If a variable for IAC_BRANCH is set use that branch
|
||||||
working-directory: .github/workflows
|
working-directory: .github/workflows
|
||||||
run: |
|
run: |
|
||||||
if [ ${{ vars.IAC_BRANCH }} != '' ]; then
|
if [ ${{ vars.IAC_BRANCH }} != '' ]; then
|
||||||
echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
|
echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
|
||||||
echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
|
echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
|
||||||
else
|
else
|
||||||
echo IAC_BRANCH=main >> $GITHUB_ENV
|
echo IAC_BRANCH=main >> $GITHUB_ENV
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Pull in terraform code for linux servers
|
# Pull in terraform code for linux servers
|
||||||
- name: Clone GitHub IaC plan
|
- name: Clone GitHub IaC plan
|
||||||
uses: actions/checkout@v4
|
uses: actions/checkout@v4
|
||||||
with:
|
with:
|
||||||
repository: ansible-lockdown/github_linux_IaC
|
repository: ansible-lockdown/github_linux_IaC
|
||||||
path: .github/workflows/github_linux_IaC
|
path: .github/workflows/github_linux_IaC
|
||||||
ref: ${{ env.IAC_BRANCH }}
|
ref: ${{ env.IAC_BRANCH }}
|
||||||
|
|
||||||
# Uses dedicated restricted role and policy to enable this only for this task
|
# Uses dedicated restricted role and policy to enable this only for this task
|
||||||
# No credentials are part of github for AWS auth
|
# No credentials are part of github for AWS auth
|
||||||
- name: configure aws credentials
|
- name: configure aws credentials
|
||||||
uses: aws-actions/configure-aws-credentials@main
|
uses: aws-actions/configure-aws-credentials@main
|
||||||
with:
|
with:
|
||||||
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
|
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
|
||||||
role-session-name: ${{ secrets.AWS_ROLE_SESSION }}
|
role-session-name: ${{ secrets.AWS_ROLE_SESSION }}
|
||||||
aws-region: ${{ env.AWS_REGION }}
|
aws-region: ${{ env.AWS_REGION }}
|
||||||
|
|
||||||
- name: DEBUG - Show IaC files
|
- name: DEBUG - Show IaC files
|
||||||
if: env.ENABLE_DEBUG == 'true'
|
if: env.ENABLE_DEBUG == 'true'
|
||||||
run: |
|
run: |
|
||||||
echo "OSVAR = $OSVAR"
|
echo "OSVAR = $OSVAR"
|
||||||
echo "benchmark_type = $benchmark_type"
|
echo "benchmark_type = $benchmark_type"
|
||||||
echo "PRIVSUBNET_ID = $AWS_PRIVSUBNET_ID"
|
pwd
|
||||||
echo "VPC_ID" = $AWS_VPC_SECGRP_ID"
|
env:
|
||||||
pwd
|
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
|
||||||
ls
|
OSVAR: ${{ vars.OSVAR }}
|
||||||
env:
|
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
|
||||||
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
|
|
||||||
OSVAR: ${{ vars.OSVAR }}
|
|
||||||
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
|
|
||||||
PRIVSUBNET_ID: ${{ secrets.AWS_PRIVSUBNET_ID }}
|
|
||||||
VPC_ID: ${{ secrets.AWS_VPC_SECGRP_ID }}
|
|
||||||
|
|
||||||
- name: Tofu init
|
- name: Tofu init
|
||||||
id: init
|
id: init
|
||||||
run: tofu init
|
run: tofu init
|
||||||
env:
|
env:
|
||||||
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
|
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
|
||||||
OSVAR: ${{ vars.OSVAR }}
|
OSVAR: ${{ vars.OSVAR }}
|
||||||
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
|
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
|
||||||
|
|
||||||
- name: Tofu validate
|
- name: Tofu validate
|
||||||
id: validate
|
id: validate
|
||||||
run: tofu validate
|
run: tofu validate
|
||||||
env:
|
env:
|
||||||
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
|
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
|
||||||
OSVAR: ${{ vars.OSVAR }}
|
OSVAR: ${{ vars.OSVAR }}
|
||||||
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
|
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
|
||||||
|
|
||||||
- name: Tofu apply
|
- name: Tofu apply
|
||||||
id: apply
|
id: apply
|
||||||
env:
|
env:
|
||||||
OSVAR: ${{ vars.OSVAR }}
|
OSVAR: ${{ vars.OSVAR }}
|
||||||
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
|
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
|
||||||
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
|
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
|
||||||
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
|
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
|
||||||
run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
|
run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
|
||||||
|
|
||||||
## Debug Section
|
## Debug Section
|
||||||
- name: DEBUG - Show Ansible hostfile
|
- name: DEBUG - Show Ansible hostfile
|
||||||
if: env.ENABLE_DEBUG == 'true'
|
if: env.ENABLE_DEBUG == 'true'
|
||||||
run: cat hosts.yml
|
run: cat hosts.yml
|
||||||
|
|
||||||
# Aws deployments taking a while to come up insert sleep or playbook fails
|
# Aws deployments taking a while to come up insert sleep or playbook fails
|
||||||
|
|
||||||
- name: Sleep to allow system to come up
|
- name: Sleep to allow system to come up
|
||||||
run: sleep ${{ vars.BUILD_SLEEPTIME }}
|
run: sleep ${{ vars.BUILD_SLEEPTIME }}
|
||||||
|
|
||||||
# Run the Ansible playbook
|
# Run the Ansible playbook
|
||||||
- name: Run_Ansible_Playbook
|
- name: Run_Ansible_Playbook
|
||||||
env:
|
env:
|
||||||
ANSIBLE_HOST_KEY_CHECKING: "false"
|
ANSIBLE_HOST_KEY_CHECKING: "false"
|
||||||
ANSIBLE_DEPRECATION_WARNINGS: "false"
|
ANSIBLE_DEPRECATION_WARNINGS: "false"
|
||||||
run: |
|
run: |
|
||||||
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml
|
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml
|
||||||
|
|
||||||
# Remove test system - User secrets to keep if necessary
|
# Remove test system - User secrets to keep if necessary
|
||||||
|
|
||||||
- name: Tofu Destroy
|
- name: Tofu Destroy
|
||||||
if: always() && env.ENABLE_DEBUG == 'false'
|
if: always() && env.ENABLE_DEBUG == 'false'
|
||||||
env:
|
env:
|
||||||
OSVAR: ${{ vars.OSVAR }}
|
OSVAR: ${{ vars.OSVAR }}
|
||||||
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
|
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
|
||||||
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
|
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
|
||||||
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
|
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
|
||||||
run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false
|
run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false
|
||||||
|
|
|
||||||
223
.github/workflows/main_pipeline_validation.yml
vendored
223
.github/workflows/main_pipeline_validation.yml
vendored
|
|
@ -4,16 +4,16 @@
|
||||||
|
|
||||||
on: # yamllint disable-line rule:truthy
|
on: # yamllint disable-line rule:truthy
|
||||||
pull_request_target:
|
pull_request_target:
|
||||||
types: [opened, reopened, synchronize]
|
types: [opened, reopened, synchronize]
|
||||||
branches:
|
branches:
|
||||||
- main
|
- main
|
||||||
- latest
|
- latest
|
||||||
paths:
|
paths:
|
||||||
- '**.yml'
|
- '**.yml'
|
||||||
- '**.sh'
|
- '**.sh'
|
||||||
- '**.j2'
|
- '**.j2'
|
||||||
- '**.ps1'
|
- '**.ps1'
|
||||||
- '**.cfg'
|
- '**.cfg'
|
||||||
|
|
||||||
# Allow permissions for AWS auth
|
# Allow permissions for AWS auth
|
||||||
permissions:
|
permissions:
|
||||||
|
|
@ -24,123 +24,118 @@
|
||||||
# A workflow run is made up of one or more jobs
|
# A workflow run is made up of one or more jobs
|
||||||
# that can run sequentially or in parallel
|
# that can run sequentially or in parallel
|
||||||
jobs:
|
jobs:
|
||||||
|
# This workflow contains a single job that tests the playbook
|
||||||
|
playbook-test:
|
||||||
|
# The type of runner that the job will run on
|
||||||
|
runs-on: self-hosted
|
||||||
|
env:
|
||||||
|
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
|
||||||
|
# Imported as a variable by terraform
|
||||||
|
TF_VAR_repository: ${{ github.event.repository.name }}
|
||||||
|
AWS_REGION : "us-east-1"
|
||||||
|
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
|
||||||
|
defaults:
|
||||||
|
run:
|
||||||
|
shell: bash
|
||||||
|
working-directory: .github/workflows/github_linux_IaC
|
||||||
|
# working-directory: .github/workflows
|
||||||
|
|
||||||
# This workflow contains a single job that tests the playbook
|
steps:
|
||||||
playbook-test:
|
|
||||||
# The type of runner that the job will run on
|
|
||||||
runs-on: self-hosted
|
|
||||||
env:
|
|
||||||
ENABLE_DEBUG: ${{ vars.ENABLE_DEBUG }}
|
|
||||||
# Imported as a variable by terraform
|
|
||||||
TF_VAR_repository: ${{ github.event.repository.name }}
|
|
||||||
AWS_REGION : "us-east-1"
|
|
||||||
ANSIBLE_VERSION: ${{ vars.ANSIBLE_RUNNER_VERSION }}
|
|
||||||
defaults:
|
|
||||||
run:
|
|
||||||
shell: bash
|
|
||||||
working-directory: .github/workflows/github_linux_IaC
|
|
||||||
# working-directory: .github/workflows
|
|
||||||
|
|
||||||
steps:
|
- name: Git clone the lockdown repository to test
|
||||||
|
uses: actions/checkout@v4
|
||||||
|
with:
|
||||||
|
ref: ${{ github.event.pull_request.head.sha }}
|
||||||
|
|
||||||
- name: Git clone the lockdown repository to test
|
- name: If a variable for IAC_BRANCH is set use that branch
|
||||||
uses: actions/checkout@v4
|
working-directory: .github/workflows
|
||||||
with:
|
run: |
|
||||||
ref: ${{ github.event.pull_request.head.sha }}
|
if [ ${{ vars.IAC_BRANCH }} != '' ]; then
|
||||||
|
echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
|
||||||
|
echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
|
||||||
|
else
|
||||||
|
echo IAC_BRANCH=main >> $GITHUB_ENV
|
||||||
|
fi
|
||||||
|
|
||||||
- name: If a variable for IAC_BRANCH is set use that branch
|
# Pull in terraform code for linux servers
|
||||||
working-directory: .github/workflows
|
- name: Clone GitHub IaC plan
|
||||||
run: |
|
uses: actions/checkout@v4
|
||||||
if [ ${{ vars.IAC_BRANCH }} != '' ]; then
|
with:
|
||||||
echo "IAC_BRANCH=${{ vars.IAC_BRANCH }}" >> $GITHUB_ENV
|
repository: ansible-lockdown/github_linux_IaC
|
||||||
echo "Pipeline using the following IAC branch ${{ vars.IAC_BRANCH }}"
|
path: .github/workflows/github_linux_IaC
|
||||||
else
|
ref: ${{ env.IAC_BRANCH }}
|
||||||
echo IAC_BRANCH=main >> $GITHUB_ENV
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Pull in terraform code for linux servers
|
# Uses dedicated restricted role and policy to enable this only for this task
|
||||||
- name: Clone GitHub IaC plan
|
# No credentials are part of github for AWS auth
|
||||||
uses: actions/checkout@v4
|
- name: configure aws credentials
|
||||||
with:
|
uses: aws-actions/configure-aws-credentials@main
|
||||||
repository: ansible-lockdown/github_linux_IaC
|
with:
|
||||||
path: .github/workflows/github_linux_IaC
|
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
|
||||||
ref: ${{ env.IAC_BRANCH }}
|
role-session-name: ${{ secrets.AWS_ROLE_SESSION }}
|
||||||
|
aws-region: ${{ env.AWS_REGION }}
|
||||||
|
|
||||||
# Uses dedicated restricted role and policy to enable this only for this task
|
- name: DEBUG - Show IaC files
|
||||||
# No credentials are part of github for AWS auth
|
if: env.ENABLE_DEBUG == 'true'
|
||||||
- name: configure aws credentials
|
run: |
|
||||||
uses: aws-actions/configure-aws-credentials@main
|
echo "OSVAR = $OSVAR"
|
||||||
with:
|
echo "benchmark_type = $benchmark_type"
|
||||||
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
|
pwd
|
||||||
role-session-name: ${{ secrets.AWS_ROLE_SESSION }}
|
ls
|
||||||
aws-region: ${{ env.AWS_REGION }}
|
env:
|
||||||
|
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
|
||||||
|
OSVAR: ${{ vars.OSVAR }}
|
||||||
|
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
|
||||||
|
|
||||||
- name: DEBUG - Show IaC files
|
- name: Tofu init
|
||||||
if: env.ENABLE_DEBUG == 'true'
|
id: init
|
||||||
run: |
|
run: tofu init
|
||||||
echo "OSVAR = $OSVAR"
|
env:
|
||||||
echo "benchmark_type = $benchmark_type"
|
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
|
||||||
echo "PRIVSUBNET_ID = $AWS_PRIVSUBNET_ID"
|
OSVAR: ${{ vars.OSVAR }}
|
||||||
echo "VPC_ID" = $AWS_VPC_SECGRP_ID"
|
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
|
||||||
pwd
|
|
||||||
ls
|
|
||||||
env:
|
|
||||||
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
|
|
||||||
OSVAR: ${{ vars.OSVAR }}
|
|
||||||
benchmark_type: ${{ vars.BENCHMARK_TYPE }}
|
|
||||||
PRIVSUBNET_ID: ${{ secrets.AWS_PRIVSUBNET_ID }}
|
|
||||||
VPC_ID: ${{ secrets.AWS_VPC_SECGRP_ID }}
|
|
||||||
|
|
||||||
- name: Tofu init
|
- name: Tofu validate
|
||||||
id: init
|
id: validate
|
||||||
run: tofu init
|
run: tofu validate
|
||||||
env:
|
env:
|
||||||
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
|
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
|
||||||
OSVAR: ${{ vars.OSVAR }}
|
OSVAR: ${{ vars.OSVAR }}
|
||||||
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
|
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
|
||||||
|
|
||||||
- name: Tofu validate
|
- name: Tofu apply
|
||||||
id: validate
|
id: apply
|
||||||
run: tofu validate
|
env:
|
||||||
env:
|
OSVAR: ${{ vars.OSVAR }}
|
||||||
# Imported from GitHub variables this is used to load the relevant OS.tfvars file
|
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
|
||||||
OSVAR: ${{ vars.OSVAR }}
|
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
|
||||||
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
|
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
|
||||||
|
run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
|
||||||
- name: Tofu apply
|
|
||||||
id: apply
|
|
||||||
env:
|
|
||||||
OSVAR: ${{ vars.OSVAR }}
|
|
||||||
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
|
|
||||||
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
|
|
||||||
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
|
|
||||||
run: tofu apply -var-file "${OSVAR}.tfvars" --auto-approve -input=false
|
|
||||||
|
|
||||||
## Debug Section
|
## Debug Section
|
||||||
- name: DEBUG - Show Ansible hostfile
|
- name: DEBUG - Show Ansible hostfile
|
||||||
if: env.ENABLE_DEBUG == 'true'
|
if: env.ENABLE_DEBUG == 'true'
|
||||||
run: cat hosts.yml
|
run: cat hosts.yml
|
||||||
|
|
||||||
# Aws deployments taking a while to come up insert sleep or playbook fails
|
# Aws deployments taking a while to come up insert sleep or playbook fails
|
||||||
|
|
||||||
- name: Sleep to allow system to come up
|
- name: Sleep to allow system to come up
|
||||||
run: sleep ${{ vars.BUILD_SLEEPTIME }}
|
run: sleep ${{ vars.BUILD_SLEEPTIME }}
|
||||||
|
|
||||||
# Run the Ansible playbook
|
# Run the Ansible playbook
|
||||||
- name: Run_Ansible_Playbook
|
- name: Run_Ansible_Playbook
|
||||||
env:
|
env:
|
||||||
ANSIBLE_HOST_KEY_CHECKING: "false"
|
ANSIBLE_HOST_KEY_CHECKING: "false"
|
||||||
ANSIBLE_DEPRECATION_WARNINGS: "false"
|
ANSIBLE_DEPRECATION_WARNINGS: "false"
|
||||||
run: |
|
run: |
|
||||||
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml
|
/opt/ansible_${{ env.ANSIBLE_VERSION }}_venv/bin/ansible-playbook -i hosts.yml --private-key ~/.ssh/le_runner ../../../site.yml
|
||||||
|
|
||||||
# Remove test system - User secrets to keep if necessary
|
# Remove test system - User secrets to keep if necessary
|
||||||
|
|
||||||
- name: Tofu Destroy
|
- name: Tofu Destroy
|
||||||
if: always() && env.ENABLE_DEBUG == 'false'
|
if: always() && env.ENABLE_DEBUG == 'false'
|
||||||
env:
|
env:
|
||||||
OSVAR: ${{ vars.OSVAR }}
|
OSVAR: ${{ vars.OSVAR }}
|
||||||
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
|
TF_VAR_benchmark_type: ${{ vars.BENCHMARK_TYPE }}
|
||||||
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
|
TF_VAR_privsubnet_id: ${{ secrets.AWS_PRIVSUBNET_ID }}
|
||||||
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
|
TF_VAR_vpc_secgrp_id: ${{ secrets.AWS_VPC_SECGRP_ID }}
|
||||||
run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false
|
run: tofu destroy -var-file "${OSVAR}.tfvars" --auto-approve -input=false
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue