Setup Terraform and ES Stack

Author: tobio

.github/workflows/copilot-setup-steps.yml

@@ -21,13 +21,95 @@ jobs:
     permissions:
       # If you want to clone the repository as part of your setup steps, for example to install dependencies, you'll need the `contents: read` permission. If you don't clone the repository in your setup steps, Copilot will do this for you automatically after the steps complete.
       contents: read
+    env:
+      ELASTICSEARCH_ENDPOINTS: "http://localhost:9200"
+      ELASTICSEARCH_USERNAME: "elastic"
+      ELASTICSEARCH_PASSWORD: password
+      KIBANA_ENDPOINT: "http://localhost:5601"
+      KIBANA_USERNAME: "elastic"
+      KIBANA_PASSWORD: password
+      KIBANA_SYSTEM_USERNAME: kibana_system
+      KIBANA_SYSTEM_PASSWORD: password
+      TF_ACC: "1"
+      STACK_VERSION: 9.0.3
+    services:
+      elasticsearch:
+        image: docker.elastic.co/elasticsearch/elasticsearch:${{ env.STACK_VERSION }}
+        env:
+          discovery.type: single-node
+          xpack.security.enabled: true
+          xpack.security.authc.api_key.enabled: true
+          xpack.security.authc.token.enabled: true
+          xpack.watcher.enabled: true
+          xpack.license.self_generated.type: trial
+          repositories.url.allowed_urls: https://example.com/*
+          path.repo: /tmp
+          ELASTIC_PASSWORD: ${{ env.ELASTICSEARCH_PASSWORD }}
+        ports:
+          - 9200:9200
+        options: --health-cmd="curl http://localhost:9200/_cluster/health" --health-interval=10s --health-timeout=5s --health-retries=10
+      kibana:
+        image: docker.elastic.co/kibana/kibana:${{ env.STACK_VERSION }}
+        env:
+          SERVER_NAME: kibana
+          ELASTICSEARCH_HOSTS: http://elasticsearch:9200
+          ELASTICSEARCH_USERNAME: ${{ env.KIBANA_SYSTEM_USERNAME }}
+          ELASTICSEARCH_PASSWORD: ${{ env.KIBANA_SYSTEM_PASSWORD }}
+          XPACK_ENCRYPTEDSAVEDOBJECTS_ENCRYPTIONKEY: a7a6311933d3503b89bc2dbc36572c33a6c10925682e591bffcab6911c06786d
+          # LOGGING_ROOT_LEVEL: debug
+        ports:
+          - 5601:5601
+        options: --health-cmd="curl http://localhost:5601/api/status" --health-interval=10s --health-timeout=5s --health-retries=10
+      fleet:
+        image: docker.elastic.co/beats/elastic-agent:${{ env.STACK_VERSION }}
+        env:
+          SERVER_NAME: fleet
+          FLEET_ENROLL: "1"
+          FLEET_URL: https://fleet:8220
+          FLEET_INSECURE: "true"
+          FLEET_SERVER_ENABLE: "1"
+          FLEET_SERVER_POLICY_ID: fleet-server
+          FLEET_SERVER_ELASTICSEARCH_HOST: http://elasticsearch:9200
+          FLEET_SERVER_ELASTICSEARCH_INSECURE: "true"
+          FLEET_SERVER_INSECURE_HTTP: "true"
+          KIBANA_HOST: http://kibana:5601
+          KIBANA_FLEET_SETUP: "1"
+          KIBANA_FLEET_PASSWORD: ${{ env.ELASTICSEARCH_PASSWORD }}
+        ports:
+          - 8220:8220
+        options: --restart="unless-stopped"
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
         with:
           go-version-file: 'go.mod'
           cache: true
+      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
+        with:
+          terraform_wrapper: false
 
       - name: Get dependencies
         run: make setup
+
+      - name: Setup Kibana user
+        run: make set-kibana-password
+        env:
+          ELASTICSEARCH_PASSWORD: ${{ env.ELASTICSEARCH_PASSWORD }}
+          KIBANA_SYSTEM_USERNAME: ${{ env.KIBANA_SYSTEM_USERNAME }}
+          KIBANA_SYSTEM_PASSWORD: ${{ env.KIBANA_SYSTEM_PASSWORD }}
+
+      - id: get-api-key
+        name: Get ES API key
+        run: |-
+          echo "apikey=$(make create-es-api-key | jq -r .encoded)" >> "$GITHUB_OUTPUT"
+        env:
+          ELASTICSEARCH_PASSWORD: ${{ env.ELASTICSEARCH_PASSWORD }}
+
+      - id: setup-fleet
+        name: Setup Fleet
+        run: |-
+          make setup-kibana-fleet
+        env:
+          ELASTICSEARCH_PASSWORD: ${{ env.ELASTICSEARCH_PASSWORD }}
+          FLEET_NAME: "fleet"