Skip to content

Commit 6843bbc

Browse files
soerenschneidersoerenschneider
committed
add pipeline for running ansible
1 parent 62b15bc commit 6843bbc

File tree

7 files changed

+237
-0
lines changed

7 files changed

+237
-0
lines changed

‎cicd/ansible/kustomization.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
apiVersion: kustomize.config.k8s.io/v1beta1
3+
kind: Kustomization
4+
namespace: "cicd-ansible"
5+
resources:
6+
- https://api.hub.tekton.dev/v1/resource/tekton/task/git-clone/0.9/raw
7+
- task-ssh-key-generate.yaml
8+
- task-ssh-key-sign.yaml
9+
- task-ansible-run-playbook.yaml
10+
- pipeline.yaml
11+
- namespace.yaml
12+
- rbac.yaml

‎cicd/ansible/namespace.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
kind: Namespace
3+
apiVersion: v1
4+
metadata:
5+
name: ansible
6+
labels:
7+
name: ansible

‎cicd/ansible/pipeline.yaml‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
---
2+
apiVersion: tekton.dev/v1
3+
kind: Pipeline
4+
metadata:
5+
name: "ansible"
6+
spec:
7+
description: "This pipeline clones a github repo, builds it and uploads assets."
8+
params:
9+
- name: "ansible-repo-clone-url"
10+
type: "string"
11+
description: "URL of the Ansible repo to clone"
12+
- name: "ansible-inventory-repo-clone-url"
13+
type: "string"
14+
description: "URL of the Ansible inventory repo to clone"
15+
- name: "revision"
16+
type: "string"
17+
default: ""
18+
- description: "Endpoint of Vault API"
19+
name: "vault-address"
20+
type: "string"
21+
- description: "Vault SSH role"
22+
name: "vault-ssh-role"
23+
type: "string"
24+
- description: "Vault SSH mount"
25+
name: "vault-ssh-mount"
26+
type: "string"
27+
- description: "Vault Kubernetes auth role"
28+
name: "vault-kubernetes-auth-role"
29+
type: "string"
30+
- description: "Vault Kubernetes auth mount"
31+
name: "vault-kubernetes-auth-mount"
32+
type: "string"
33+
workspaces:
34+
- name: "shared-data"
35+
description: "This workspace contains the cloned repo files, so they can be read by the next task."
36+
- name: "ssh-creds"
37+
description: "Workspace containing the SSH keys to clone from GitHub"
38+
tasks:
39+
- name: "git-clone-ansible"
40+
taskRef:
41+
name: "git-clone"
42+
workspaces:
43+
- name: "output"
44+
workspace: "shared-data"
45+
params:
46+
- name: "url"
47+
value: $(params.ansible-repo-clone-url)
48+
- name: "revision"
49+
value: $(params.revision)
50+
- name: "subdirectory"
51+
value: "ansible"
52+
- name: "git-clone-ansible-inventory"
53+
taskRef:
54+
name: "git-clone"
55+
workspaces:
56+
- name: "output"
57+
workspace: "shared-data"
58+
- name: "ssh-directory"
59+
workspace: "ssh-creds"
60+
params:
61+
- name: "url"
62+
value: $(params.ansible-inventory-repo-clone-url)
63+
- name: "revision"
64+
value: $(params.revision)
65+
- name: "subdirectory"
66+
value: "inventory"
67+
- name: "ssh-key-generate"
68+
taskRef:
69+
name: "ssh-key-generate"
70+
workspaces:
71+
- name: "keypair"
72+
workspace: "shared-data"
73+
- name: "ssh-key-sign"
74+
runAfter: ["ssh-key-generate"]
75+
taskRef:
76+
name: "ssh-key-sign"
77+
workspaces:
78+
- name: "keypair"
79+
workspace: "shared-data"
80+
params:
81+
- name: "vault-address"
82+
value: $(params.vault-address)
83+
- name: "vault-ssh-role"
84+
value: $(params.vault-ssh-role)
85+
- name: "vault-ssh-mount"
86+
value: $(params.vault-ssh-mount)
87+
- name: "vault-kubernetes-auth-role"
88+
value: $(params.vault-kubernetes-auth-role)
89+
- name: "vault-kubernetes-auth-mount"
90+
value: $(params.vault-kubernetes-auth-mount)
91+
- name: "ansible-run-playbook"
92+
runAfter: ["git-clone-ansible", "git-clone-ansible-inventory", "ssh-key-sign"]
93+
taskRef:
94+
name: "ansible-run-playbook"
95+
workspaces:
96+
- name: "source"
97+
workspace: "shared-data"
98+
- name: "keypair"
99+
workspace: "shared-data"

‎cicd/ansible/rbac.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
apiVersion: "v1"
3+
kind: "ServiceAccount"
4+
metadata:
5+
name: "ansible"
6+
---
7+
apiVersion: "rbac.authorization.k8s.io/v1"
8+
kind: "Role"
9+
metadata:
10+
name: "ansible"
11+
rules:
12+
- apiGroups: [""]
13+
resources: ["secrets"]
14+
verbs: ["get", "list", "create", "update", "patch"]
15+
---
16+
apiVersion: "rbac.authorization.k8s.io/v1"
17+
kind: "RoleBinding"
18+
metadata:
19+
name: "secret-manager-binding"
20+
subjects:
21+
- kind: "ServiceAccount"
22+
name: "ansible"
23+
namespace: "cicd-ansible"
24+
roleRef:
25+
kind: "Role"
26+
name: "ansible"
27+
apiGroup: "rbac.authorization.k8s.io"

‎cicd/ansible/task-ansible-run-playbook.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
apiVersion: tekton.dev/v1
3+
kind: Task
4+
metadata:
5+
name: "ansible-run-playbook"
6+
spec:
7+
description: "Runs an Ansible playbook"
8+
workspaces:
9+
- name: "source"
10+
- name: "keypair"
11+
steps:
12+
- name: "ansible-run-playbook"
13+
image: "cr.svc.ez.soeren.cloud/ansible"
14+
imagePullPolicy: Always
15+
env:
16+
- name: "HOME"
17+
value: "/tmp"
18+
command:
19+
- sleep
20+
- "300"
21+
- name: "ansible-run-playbook"
22+
image: "cr.svc.ez.soeren.cloud/ansible"
23+
imagePullPolicy: Always
24+
env:
25+
- name: "HOME"
26+
value: "/tmp"
27+
command:
28+
- ansible-playbook
29+
- -i inventory/inventory.yml
30+
- -e ansible_ssh_private_key_file=$(workspaces.keypair.path)/key
31+
- ansible/playbooks/jukebox/playbook.yml

‎cicd/ansible/task-ssh-key-generate.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
apiVersion: tekton.dev/v1
3+
kind: Task
4+
metadata:
5+
name: "ssh-key-generate"
6+
spec:
7+
description: "Generates a ssh public key pair"
8+
workspaces:
9+
- name: "keypair"
10+
steps:
11+
- name: "generate-ssh-key"
12+
image: "cr.svc.ez.soeren.cloud/alpine"
13+
imagePullPolicy: Always
14+
env:
15+
- name: "HOME"
16+
value: "/tmp"
17+
script: |-
18+
ssh-keygen -t ed25519 -f /workspace/keypair/key -N ""

‎cicd/ansible/task-ssh-key-sign.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
apiVersion: tekton.dev/v1
3+
kind: Task
4+
metadata:
5+
name: "ssh-key-sign"
6+
spec:
7+
description: "Sign a ssh public key"
8+
workspaces:
9+
- name: "keypair"
10+
params:
11+
- description: "Endpoint of Vault API"
12+
name: "vault-address"
13+
type: "string"
14+
- description: "Vault SSH role"
15+
name: "vault-ssh-role"
16+
type: "string"
17+
- description: "Vault SSH mount"
18+
name: "vault-ssh-mount"
19+
type: "string"
20+
default: "ssh"
21+
- description: "Vault Kubernetes auth role"
22+
name: "vault-kubernetes-auth-role"
23+
type: "string"
24+
- description: "Vault Kubernetes auth mount"
25+
name: "vault-kubernetes-auth-mount"
26+
type: "string"
27+
default: "kubernetes"
28+
steps:
29+
- name: "sign-ssh-key"
30+
image: "ghcr.io/soerenschneider/vault-ssh-cli:1.9.1"
31+
imagePullPolicy: IfNotPresent
32+
env:
33+
- name: "HOME"
34+
value: "/tmp"
35+
args:
36+
- "--vault-address=$(params.vault-address)"
37+
- "sign-user-key"
38+
- "--pub-key-file=$(workspaces.keypair.path)/key.pub"
39+
- "--signed-key-file=$(workspaces.keypair.path)/key-cert.pub"
40+
- "--vault-ssh-role=$(params.vault-ssh-role)"
41+
- "--vault-ssh-mount=$(params.vault-ssh-mount)"
42+
- "--vault-auth-kubernetes-role=$(params.vault-kubernetes-auth-role)"
43+
- "--vault-auth-kubernetes-mount=$(params.vault-kubernetes-auth-mount)"

0 commit comments

Comments
 (0)