Skip to content

Commit 6fc11dc

Browse files
xNokxNok
committed
chore: refactor secrets for clarity
1 parent abfb8d1 commit 6fc11dc

File tree

3 files changed

+79
-80
lines changed

3 files changed

+79
-80
lines changed

‎.github/workflows/ansible.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -62,15 +62,15 @@ jobs:
6262
6363
- name: write inventory to file
6464
env:
65-
INVENTORY: ${{ secrets.INVENTORY }}
65+
INVENTORY: ${{ secrets.ANSIBLE_INVENTORY }}
6666
run: 'echo "$INVENTORY" > inventory'
6767

6868
- name: Install SSH key
6969
uses: shimataro/ssh-key-action@v2
7070
with:
71-
key: ${{ secrets.SSH_KEY }}
71+
key: ${{ secrets.ANSIBLE_SSH_KEY }}
7272
name: id_rsa # optional
73-
known_hosts: ${{ secrets.KNOWN_HOSTS }}
73+
known_hosts: ${{ secrets.ANSIBLE_KNOWN_HOSTS }}
7474
# config: ${{ secrets.CONFIG }} # ssh_config; optional
7575
if_key_exists: fail # replace / ignore / fail; optional (defaults to fail)
7676

‎terraform/digitalocean/ansible.tf

+76
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
/**
2+
* Github environnement secrets for Ansible
3+
*
4+
*/
5+
resource "github_actions_environment_secret" "ansible_inventory" {
6+
repository = data.github_repository.repo.name
7+
environment = github_repository_environment.digitalocean_environment.environment
8+
secret_name = "ansible_inventory"
9+
plaintext_value = templatefile(
10+
"${path.module}/templates/ansible_inventory.tpl",
11+
{
12+
user = "root"
13+
prefix = "swarm"
14+
nodes = digitalocean_droplet.nodes.*.ipv4_address,
15+
managers = digitalocean_droplet.managers.*.ipv4_address
16+
}
17+
)
18+
}
19+
20+
resource "github_actions_environment_secret" "ansible_ssh" {
21+
repository = data.github_repository.repo.name
22+
environment = github_repository_environment.digitalocean_environment.environment
23+
secret_name = "ansible_ssh_key"
24+
plaintext_value = tls_private_key.ssh.private_key_pem
25+
}
26+
27+
data "sshclient_host" "nodes" {
28+
count = length(digitalocean_droplet.nodes)
29+
hostname = digitalocean_droplet.nodes[count.index].ipv4_address
30+
username = "keyscan"
31+
insecure_ignore_host_key = true # we use this to scan and obtain the key
32+
}
33+
34+
data "sshclient_host" "managers" {
35+
count = length(digitalocean_droplet.managers)
36+
hostname = digitalocean_droplet.managers[count.index].ipv4_address
37+
username = "keyscan"
38+
insecure_ignore_host_key = true # we use this to scan and obtain the key
39+
}
40+
41+
resource "time_sleep" "wait_30_seconds" {
42+
depends_on = [digitalocean_droplet.nodes, digitalocean_droplet.managers]
43+
44+
create_duration = "30s"
45+
}
46+
47+
data "sshclient_keyscan" "keyscan_nodes" {
48+
count = length(data.sshclient_host.nodes)
49+
host_json = data.sshclient_host.nodes[count.index].json
50+
depends_on = [time_sleep.wait_30_seconds]
51+
}
52+
53+
data "sshclient_keyscan" "keyscan_managers" {
54+
count = length(data.sshclient_host.managers)
55+
host_json = data.sshclient_host.managers[count.index].json
56+
depends_on = [time_sleep.wait_30_seconds]
57+
}
58+
59+
locals {
60+
known_hosts = merge(
61+
{for k, v in data.sshclient_host.nodes : v.hostname => data.sshclient_keyscan.keyscan_nodes[k].authorized_key },
62+
{for k, v in data.sshclient_host.managers : v.hostname => data.sshclient_keyscan.keyscan_managers[k].authorized_key },
63+
)
64+
}
65+
66+
resource "github_actions_environment_secret" "ansible_known_hosts" {
67+
repository = data.github_repository.repo.name
68+
environment = github_repository_environment.digitalocean_environment.environment
69+
secret_name = "ansible_known_hosts"
70+
plaintext_value = templatefile(
71+
"${path.module}/templates/known_hosts.tpl",
72+
{
73+
known_hosts = local.known_hosts
74+
}
75+
)
76+
}

‎terraform/digitalocean/github.tf

-77
Original file line numberDiff line numberDiff line change
@@ -43,80 +43,3 @@ resource "github_branch_protection" "main" {
4343
contexts = ["validate"]
4444
}
4545
}
46-
47-
/**
48-
* Github environnement secrets for Ansible
49-
*
50-
*/
51-
resource "github_actions_environment_secret" "inventory" {
52-
repository = data.github_repository.repo.name
53-
environment = github_repository_environment.digitalocean_environment.environment
54-
secret_name = "inventory"
55-
plaintext_value = templatefile(
56-
"${path.module}/templates/ansible_inventory.tpl",
57-
{
58-
user = "root"
59-
prefix = "swarm"
60-
nodes = digitalocean_droplet.nodes.*.ipv4_address,
61-
managers = digitalocean_droplet.managers.*.ipv4_address
62-
}
63-
)
64-
}
65-
66-
resource "github_actions_environment_secret" "ssh" {
67-
repository = data.github_repository.repo.name
68-
environment = github_repository_environment.digitalocean_environment.environment
69-
secret_name = "ssh_key"
70-
plaintext_value = tls_private_key.ssh.private_key_pem
71-
}
72-
73-
data "sshclient_host" "nodes" {
74-
count = length(digitalocean_droplet.nodes)
75-
hostname = digitalocean_droplet.nodes[count.index].ipv4_address
76-
username = "keyscan"
77-
insecure_ignore_host_key = true # we use this to scan and obtain the key
78-
}
79-
80-
data "sshclient_host" "managers" {
81-
count = length(digitalocean_droplet.managers)
82-
hostname = digitalocean_droplet.managers[count.index].ipv4_address
83-
username = "keyscan"
84-
insecure_ignore_host_key = true # we use this to scan and obtain the key
85-
}
86-
87-
resource "time_sleep" "wait_30_seconds" {
88-
depends_on = [digitalocean_droplet.nodes, digitalocean_droplet.managers]
89-
90-
create_duration = "30s"
91-
}
92-
93-
data "sshclient_keyscan" "keyscan_nodes" {
94-
count = length(data.sshclient_host.nodes)
95-
host_json = data.sshclient_host.nodes[count.index].json
96-
depends_on = [time_sleep.wait_30_seconds]
97-
}
98-
99-
data "sshclient_keyscan" "keyscan_managers" {
100-
count = length(data.sshclient_host.managers)
101-
host_json = data.sshclient_host.managers[count.index].json
102-
depends_on = [time_sleep.wait_30_seconds]
103-
}
104-
105-
locals {
106-
known_hosts = merge(
107-
{for k, v in data.sshclient_host.nodes : v.hostname => data.sshclient_keyscan.keyscan_nodes[k].authorized_key },
108-
{for k, v in data.sshclient_host.managers : v.hostname => data.sshclient_keyscan.keyscan_managers[k].authorized_key },
109-
)
110-
}
111-
112-
resource "github_actions_environment_secret" "known_hosts" {
113-
repository = data.github_repository.repo.name
114-
environment = github_repository_environment.digitalocean_environment.environment
115-
secret_name = "known_hosts"
116-
plaintext_value = templatefile(
117-
"${path.module}/templates/known_hosts.tpl",
118-
{
119-
known_hosts = local.known_hosts
120-
}
121-
)
122-
}

0 commit comments

Comments
 (0)