add Dockerfile: terraform-iac-runner

.github/workflows/terraform-iac-runner-image.yaml

@@ -0,0 +1,30 @@
+name: Build & push apline image
+on:
+  pull_request:
+  push:
+    paths:
+      - 'terraform-iac-runner/main.tf'
+      - 'terraform-iac-runner/Dockerfile'
+      - 'terraform-iac-runner/.terraformrc'
+      - '.github/workflows/terraform-iac-runner-image.yaml'
+    branches:
+      - main
+
+jobs:
+  base-image:
+    runs-on: ubuntu-latest
+    name: Build terraform base image
+    steps:
+      - uses: actions/checkout@master
+
+      - name: 'Artifact: build && push alpine image'
+        uses: aevea/action-kaniko@master
+        with:
+          registry: artifact.onwalk.net
+          username: admin 
+          password: ${{ secrets.HELM_REPO_PASSWORD }}
+          build_file: './terraform-iac-runner/Dockerfile'
+          image: devops/iac-runner
+          tag: latest
+          cache: true
+          cache_registry: cache

base.yml

@@ -1,6 +0,0 @@
-image:
-  name: artifact.onwalk.net/k8s/kaniko-executor:1.9.1-debug 
-  entrypoint: [""]
-
-stages:
-  - build

terraform-iac-runner/.gitlab-ci.yml

@@ -0,0 +1,12 @@
+stages:
+  - build
+
+build-image-job:
+  stage: build
+  image:
+    name: gcr.io/kaniko-project/executor:v1.9.0-debug
+    entrypoint: [""]
+  script:
+    - mkdir -p /kaniko/.docker
+    - echo "{\"auths\":{\"artifact.onwalk.net/k8s\":{\"auth\":\"$(printf "%s:%s" "admin" "${PASSWORD}" | base64 | tr -d '\n')\"}}}" > /kaniko/.docker/config.json
+    - /kaniko/executor --context "${CI_PROJECT_DIR}" --dockerfile "${CI_PROJECT_DIR}/Dockerfile" --destination "artifact.onwalk.net/devops/iac-runner:latest"

terraform-iac-runner/.terraformrc

@@ -0,0 +1,7 @@
+disable_checkpoint = true
+disable_checkpoint_signature = true
+provider_installation {
+    filesystem_mirror {
+        path = "/data/terraform/"
+    }
+}

terraform-iac-runner/Dockerfile

@@ -0,0 +1,56 @@
+FROM infracost/infracost:latest as builder
+
+# Build IAC Runner
+FROM hashicorp/terraform:1.2.1 
+LABEL maintainer="Haitao Pan <xz@onwalk.net>"
+
+ARG GLIBC_VERSION=2.34-r0
+ARG AWSCLI_VERSION=2.6.1
+
+RUN apk add --update --no-cache ca-certificates openssl openssh-client git bash wget make curl jq py3-pip unzip zip && \
+    mkdir -pv /root/.terraform.d/plugin-cache && \
+    pip3 install jinja2 hvac python-hcl2 && \
+    wget https://mirrors.onwalk.net/tools/linux-amd64/gauth.tar.gz && tar -xvpf gauth.tar.gz -C /usr/bin/ && chmod 755 /usr/bin/gauth && \
+    wget https://mirrors.onwalk.net/tools/linux-amd64/gitleaks_8.8.5_linux_x64.tar.gz && tar -xvpf gitleaks_8.8.5_linux_x64.tar.gz && cp gitleaks /usr/bin/ && chmod 755 /usr/bin/gitleaks
+
+# install glibc compatibility for alpine
+RUN apk --no-cache add \
+        binutils \
+        curl \
+    && curl -sL https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub -o /etc/apk/keys/sgerrand.rsa.pub \
+    && curl -sLO https://github.com/sgerrand/alpine-pkg-glibc/releases/download/${GLIBC_VERSION}/glibc-${GLIBC_VERSION}.apk \
+    && curl -sLO https://github.com/sgerrand/alpine-pkg-glibc/releases/download/${GLIBC_VERSION}/glibc-bin-${GLIBC_VERSION}.apk \
+    && curl -sLO https://github.com/sgerrand/alpine-pkg-glibc/releases/download/${GLIBC_VERSION}/glibc-i18n-${GLIBC_VERSION}.apk \
+    && apk add --no-cache \
+        glibc-${GLIBC_VERSION}.apk \
+        glibc-bin-${GLIBC_VERSION}.apk \
+        glibc-i18n-${GLIBC_VERSION}.apk \
+    && /usr/glibc-compat/bin/localedef -i en_US -f UTF-8 en_US.UTF-8 \
+    && curl -sL https://awscli.amazonaws.com/awscli-exe-linux-x86_64-${AWSCLI_VERSION}.zip -o awscliv2.zip \
+    && unzip awscliv2.zip \
+    && aws/install \
+    && rm -rf \
+        awscliv2.zip \
+        aws \
+        /usr/local/aws-cli/v2/current/dist/aws_completer \
+        /usr/local/aws-cli/v2/current/dist/awscli/data/ac.index \
+        /usr/local/aws-cli/v2/current/dist/awscli/examples \
+        glibc-*.apk \
+    && find /usr/local/aws-cli/v2/current/dist/awscli/botocore/data -name examples-1.json -delete \
+    && apk --no-cache del binutils curl \
+    && rm -rf /var/cache/apk/*
+
+# add pre-cost tools 
+COPY --from=builder /usr/bin/terragrunt /usr/bin/
+COPY --from=builder /usr/bin/infracost /usr/bin/
+RUN mkdir -pv /root/.config/infracost/
+COPY credentials.yml /root/.config/infracost/
+RUN infracost configure get api_key
+
+# init terraform provider mirror
+COPY main.tf .
+RUN mkdir -pv /data/terraform/
+RUN terraform providers mirror /data/terraform/ && rm -f main.tf .terraform.lock.hcl
+COPY .terraformrc /root/
+
+ENTRYPOINT ["terraform"]

terraform-iac-runner/Makefile

@@ -0,0 +1,4 @@
+Makefileall:
+	cp -av ~/.terraform.d/ .
+	sudo docker build --network host --no-cache -t artifact.onwalk.net/devops/iac-runner:latest .
+	sudo docker push artifact.onwalk.net/devops/iac-runner:latest 

terraform-iac-runner/credentials.yml

@@ -0,0 +1,3 @@
+version: "0.1"
+api_key: ico-oyoBjgPkjlpwDXsO9r4hjmWlGj0CKGR2
+pricing_api_endpoint: https://pricing.api.infracost.io

terraform-iac-runner/main.tf

@@ -0,0 +1,17 @@
+provider "aws" {
+  region     = "ap-east-1"
+}
+
+terraform {
+  required_providers {
+    local = {
+      source = "hashicorp/local"
+    }
+    aws = {
+      source  = "hashicorp/aws"
+    }
+    tls = {
+      source  = "hashicorp/tls"
+    }
+  }
+}

terraform-iac-runner/repositories

@@ -0,0 +1,2 @@
+https://mirrors.ustc.edu.cn/alpine/v3.15/main
+https://mirrors.ustc.edu.cn/alpine/v3.15/community