forked from EGI-Federation/fedcloud-catchall-operations
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Use fedcloud secrets (EGI-Federation#347)
* Do not send long lived secrets to VM Instead use fedcloud secret command with a locker that can only be used 2 times (one for putting the secret, another for getting it) and for 1 hour max. * Move the ansible role to this repository Instead of having this externally managed as it is a pain to update and to keep properly aligned * Move to the embedded role
- Loading branch information
Showing
16 changed files
with
321 additions
and
23 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| --- | ||
| name: Test role | ||
|
|
||
| on: [push, pull_request] | ||
|
|
||
| jobs: | ||
| molecule: | ||
| name: Runs molecule for the ansible role | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
| - name: Set up Python | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: '>=3.9' | ||
| - name: Install dependencies | ||
| run: | | ||
| pip install molecule molecule-plugins[docker] pytest pytest-testinfra | ||
| - name: Test Ansible Bootstrap | ||
| run: | | ||
| cd deploy/roles/catchall | ||
| molecule test | ||
| env: | ||
| PY_COLORS: 1 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| # AMS details | ||
| ams_project: egi_cloud_info | ||
| ams_host: msg.argo.grnet.gr | ||
| ams_token: secret | ||
|
|
||
| # check-in endpoint | ||
| checkin_token_endpoint: "https://aai.egi.eu/oidc/token" | ||
|
|
||
| # docker image for the cloud info provider | ||
| cloud_info_image: egifedcloud/ops-cloud-info:latest | ||
|
|
||
| # site configuration location | ||
| site_config_dir: sites | ||
|
|
||
| # No site information as default | ||
| sites: [] | ||
|
|
||
| cloud_info_cron: | ||
| minute: "4,34" | ||
| hour: "*" | ||
| weekday: "*" | ||
| timeout: "600" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| --- | ||
| - name: Converge | ||
| hosts: all | ||
| tasks: | ||
| - name: "Include catchall role" | ||
| ansible.builtin.include_role: | ||
| name: "catchall" | ||
| vars: | ||
| sites: | ||
| - endpoint: https://example.com:5000/v3/ | ||
| gocdb: foo.bar | ||
| vos: | ||
| - auth: | ||
| project_id: a123456 | ||
| name: sample_vo | ||
| - auth: | ||
| project_id: b987659 | ||
| name: vo.example.com | ||
| - endpoint: https://site.org:5000/v3/ | ||
| gocdb: bar.foo | ||
| region: region1 | ||
| vos: | ||
| - auth: | ||
| project_id: a123456 | ||
| name: sample_vo | ||
| - auth: | ||
| project_id: b987659 | ||
| name: vo.example.com |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| --- | ||
| dependency: | ||
| name: galaxy | ||
| driver: | ||
| name: docker | ||
| platforms: | ||
| - name: instance | ||
| image: ubuntu:latest | ||
| lint: ansible-lint --exclude .github/ | ||
| provisioner: | ||
| name: ansible | ||
| verifier: | ||
| name: testinfra |
30 changes: 30 additions & 0 deletions
30
deploy/roles/catchall/molecule/default/tests/test_default.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| import hashlib | ||
| import os | ||
|
|
||
| import testinfra.utils.ansible_runner | ||
|
|
||
| testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( | ||
| os.environ["MOLECULE_INVENTORY_FILE"] | ||
| ).get_hosts("all") | ||
|
|
||
|
|
||
| def test_site_files(host): | ||
| endpoint_hash = hashlib.md5(b"https://example.com:5000/v3/").hexdigest() | ||
| filename = "foo-bar-%s" % endpoint_hash | ||
| assert host.file("/etc/egi/cloud-info/").is_directory | ||
| assert host.file("/etc/egi/cloud-info/%s.yaml" % filename).exists | ||
| assert not host.file("/etc/egi/cloud-info/%s.env" % filename).contains("OS_REGION") | ||
| assert host.file("/etc/egi/cloud-info/%s.env" % filename).exists | ||
| assert host.file("/etc/cron.d/cloud-info-%s" % filename).exists | ||
|
|
||
|
|
||
| def test_site_files_region(host): | ||
| endpoint_hash = hashlib.md5(b"https://site.org:5000/v3/").hexdigest() | ||
| filename = "bar-foo-%s" % endpoint_hash | ||
| assert host.file("/etc/egi/cloud-info/").is_directory | ||
| assert host.file("/etc/egi/cloud-info/%s.yaml" % filename).exists | ||
| assert host.file("/etc/egi/cloud-info/%s.env" % filename).exists | ||
| assert host.file("/etc/egi/cloud-info/%s.env" % filename).contains( | ||
| "OS_REGION=region1" | ||
| ) | ||
| assert host.file("/etc/cron.d/cloud-info-%s" % filename).exists |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| molecule | ||
| molecule-plugins[docker] | ||
| pytest-testinfra | ||
| ansible-lint |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| --- | ||
| - name: Cloud-info config directory | ||
| ansible.builtin.template: | ||
| src: site-info.yaml.j2 | ||
| dest: /etc/egi/cloud-info/{{ filename }}.yaml | ||
| mode: "600" | ||
|
|
||
| - name: Cloud info env | ||
| ansible.builtin.template: | ||
| src: cloud-info.env.j2 | ||
| dest: /etc/egi/cloud-info/{{ filename }}.env | ||
| mode: "600" | ||
|
|
||
| - name: Cloud info cron | ||
| ansible.builtin.cron: | ||
| name: cloud-info-provider {{ site.gocdb }} | ||
| weekday: "{{ cloud_info_cron.weekday }}" | ||
| minute: "{{ cloud_info_cron.minute }}" | ||
| hour: "{{ cloud_info_cron.hour }}" | ||
| user: root | ||
| job: > | ||
| flock -n -w {{ cloud_info_cron.timeout }} /var/lock/cloud-info/{{ filename }} | ||
| docker run --rm -v /etc/egi:/etc/egi:ro | ||
| --env-file /etc/egi/cloud-info/{{ filename }}.env | ||
| {{ cloud_info_image }} >> /var/log/cloud-info/{{ filename }}.log 2>&1 | ||
| cron_file: "cloud-info-{{ filename }}" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| --- | ||
| - name: Install dependencies | ||
| ansible.builtin.apt: | ||
| name: | ||
| - apt-transport-https | ||
| - ca-certificates | ||
| - curl | ||
| - gnupg-agent | ||
| - software-properties-common | ||
| state: present | ||
| update_cache: true | ||
|
|
||
| - name: Docker repo key | ||
| ansible.builtin.apt_key: | ||
| id: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88 | ||
| url: https://download.docker.com/linux/ubuntu/gpg | ||
| state: present | ||
|
|
||
| - name: Add docker repo | ||
| ansible.builtin.apt_repository: | ||
| repo: "deb [arch=amd64] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable" | ||
| state: present | ||
|
|
||
| - name: Install docker | ||
| ansible.builtin.apt: | ||
| name: | ||
| - docker-ce | ||
| - docker-ce-cli | ||
| - containerd.io | ||
| state: present | ||
| update_cache: true | ||
|
|
||
| - name: Ensure docker config dir is present | ||
| ansible.builtin.file: | ||
| path: /etc/docker | ||
| state: directory | ||
| mode: "775" | ||
|
|
||
| - name: Configure docker | ||
| ansible.builtin.copy: | ||
| # this is very CESNET-MCC specific, may be better to move as configurable | ||
| content: | | ||
| { | ||
| "mtu": 1442, | ||
| "exec-opts": ["native.cgroupdriver=systemd"], | ||
| "log-driver": "json-file", | ||
| "log-opts": { | ||
| "max-size": "100m" | ||
| }, | ||
| "storage-driver": "overlay2" | ||
| } | ||
| dest: /etc/docker/daemon.json | ||
| mode: "660" | ||
|
|
||
| - name: Restart docker | ||
| ansible.builtin.systemd: | ||
| name: docker | ||
| state: restarted | ||
| daemon_reload: true |
Oops, something went wrong.