diff --git a/.github/workflows/terraform-iac-runner-image.yaml b/.github/workflows/terraform-iac-runner-image.yaml new file mode 100644 index 0000000..0cb2b1d --- /dev/null +++ b/.github/workflows/terraform-iac-runner-image.yaml @@ -0,0 +1,30 @@ +name: Build & push apline image +on: + pull_request: + push: + paths: + - 'terraform-iac-runner/main.tf' + - 'terraform-iac-runner/Dockerfile' + - 'terraform-iac-runner/.terraformrc' + - '.github/workflows/terraform-iac-runner-image.yaml' + branches: + - main + +jobs: + base-image: + runs-on: ubuntu-latest + name: Build terraform base image + steps: + - uses: actions/checkout@master + + - name: 'Artifact: build && push alpine image' + uses: aevea/action-kaniko@master + with: + registry: artifact.onwalk.net + username: admin + password: ${{ secrets.HELM_REPO_PASSWORD }} + build_file: './terraform-iac-runner/Dockerfile' + image: devops/iac-runner + tag: latest + cache: true + cache_registry: cache diff --git a/base.yml b/base.yml deleted file mode 100644 index e8e6383..0000000 --- a/base.yml +++ /dev/null @@ -1,6 +0,0 @@ -image: - name: artifact.onwalk.net/k8s/kaniko-executor:1.9.1-debug - entrypoint: [""] - -stages: - - build diff --git a/terraform-iac-runner/.gitlab-ci.yml b/terraform-iac-runner/.gitlab-ci.yml new file mode 100644 index 0000000..f70f95d --- /dev/null +++ b/terraform-iac-runner/.gitlab-ci.yml @@ -0,0 +1,12 @@ +stages: + - build + +build-image-job: + stage: build + image: + name: gcr.io/kaniko-project/executor:v1.9.0-debug + entrypoint: [""] + script: + - mkdir -p /kaniko/.docker + - echo "{\"auths\":{\"artifact.onwalk.net/k8s\":{\"auth\":\"$(printf "%s:%s" "admin" "${PASSWORD}" | base64 | tr -d '\n')\"}}}" > /kaniko/.docker/config.json + - /kaniko/executor --context "${CI_PROJECT_DIR}" --dockerfile "${CI_PROJECT_DIR}/Dockerfile" --destination "artifact.onwalk.net/devops/iac-runner:latest" diff --git a/terraform-iac-runner/.terraformrc b/terraform-iac-runner/.terraformrc new file mode 100644 index 0000000..5b4ad51 --- /dev/null +++ b/terraform-iac-runner/.terraformrc @@ -0,0 +1,7 @@ +disable_checkpoint = true +disable_checkpoint_signature = true +provider_installation { + filesystem_mirror { + path = "/data/terraform/" + } +} diff --git a/terraform-iac-runner/Dockerfile b/terraform-iac-runner/Dockerfile new file mode 100644 index 0000000..f517b7c --- /dev/null +++ b/terraform-iac-runner/Dockerfile @@ -0,0 +1,56 @@ +FROM infracost/infracost:latest as builder + +# Build IAC Runner +FROM hashicorp/terraform:1.2.1 +LABEL maintainer="Haitao Pan " + +ARG GLIBC_VERSION=2.34-r0 +ARG AWSCLI_VERSION=2.6.1 + +RUN apk add --update --no-cache ca-certificates openssl openssh-client git bash wget make curl jq py3-pip unzip zip && \ + mkdir -pv /root/.terraform.d/plugin-cache && \ + pip3 install jinja2 hvac python-hcl2 && \ + wget https://mirrors.onwalk.net/tools/linux-amd64/gauth.tar.gz && tar -xvpf gauth.tar.gz -C /usr/bin/ && chmod 755 /usr/bin/gauth && \ + wget https://mirrors.onwalk.net/tools/linux-amd64/gitleaks_8.8.5_linux_x64.tar.gz && tar -xvpf gitleaks_8.8.5_linux_x64.tar.gz && cp gitleaks /usr/bin/ && chmod 755 /usr/bin/gitleaks + +# install glibc compatibility for alpine +RUN apk --no-cache add \ + binutils \ + curl \ + && curl -sL https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub -o /etc/apk/keys/sgerrand.rsa.pub \ + && curl -sLO https://github.com/sgerrand/alpine-pkg-glibc/releases/download/${GLIBC_VERSION}/glibc-${GLIBC_VERSION}.apk \ + && curl -sLO https://github.com/sgerrand/alpine-pkg-glibc/releases/download/${GLIBC_VERSION}/glibc-bin-${GLIBC_VERSION}.apk \ + && curl -sLO https://github.com/sgerrand/alpine-pkg-glibc/releases/download/${GLIBC_VERSION}/glibc-i18n-${GLIBC_VERSION}.apk \ + && apk add --no-cache \ + glibc-${GLIBC_VERSION}.apk \ + glibc-bin-${GLIBC_VERSION}.apk \ + glibc-i18n-${GLIBC_VERSION}.apk \ + && /usr/glibc-compat/bin/localedef -i en_US -f UTF-8 en_US.UTF-8 \ + && curl -sL https://awscli.amazonaws.com/awscli-exe-linux-x86_64-${AWSCLI_VERSION}.zip -o awscliv2.zip \ + && unzip awscliv2.zip \ + && aws/install \ + && rm -rf \ + awscliv2.zip \ + aws \ + /usr/local/aws-cli/v2/current/dist/aws_completer \ + /usr/local/aws-cli/v2/current/dist/awscli/data/ac.index \ + /usr/local/aws-cli/v2/current/dist/awscli/examples \ + glibc-*.apk \ + && find /usr/local/aws-cli/v2/current/dist/awscli/botocore/data -name examples-1.json -delete \ + && apk --no-cache del binutils curl \ + && rm -rf /var/cache/apk/* + +# add pre-cost tools +COPY --from=builder /usr/bin/terragrunt /usr/bin/ +COPY --from=builder /usr/bin/infracost /usr/bin/ +RUN mkdir -pv /root/.config/infracost/ +COPY credentials.yml /root/.config/infracost/ +RUN infracost configure get api_key + +# init terraform provider mirror +COPY main.tf . +RUN mkdir -pv /data/terraform/ +RUN terraform providers mirror /data/terraform/ && rm -f main.tf .terraform.lock.hcl +COPY .terraformrc /root/ + +ENTRYPOINT ["terraform"] diff --git a/terraform-iac-runner/Makefile b/terraform-iac-runner/Makefile new file mode 100755 index 0000000..f63b667 --- /dev/null +++ b/terraform-iac-runner/Makefile @@ -0,0 +1,4 @@ +Makefileall: + cp -av ~/.terraform.d/ . + sudo docker build --network host --no-cache -t artifact.onwalk.net/devops/iac-runner:latest . + sudo docker push artifact.onwalk.net/devops/iac-runner:latest diff --git a/terraform-iac-runner/main.tf b/terraform-iac-runner/main.tf new file mode 100644 index 0000000..64845d1 --- /dev/null +++ b/terraform-iac-runner/main.tf @@ -0,0 +1,17 @@ +provider "aws" { + region = "ap-east-1" +} + +terraform { + required_providers { + local = { + source = "hashicorp/local" + } + aws = { + source = "hashicorp/aws" + } + tls = { + source = "hashicorp/tls" + } + } +} diff --git a/terraform-iac-runner/repositories b/terraform-iac-runner/repositories new file mode 100755 index 0000000..281b398 --- /dev/null +++ b/terraform-iac-runner/repositories @@ -0,0 +1,2 @@ +https://mirrors.ustc.edu.cn/alpine/v3.15/main +https://mirrors.ustc.edu.cn/alpine/v3.15/community