Skip to content

Commit dbe20a5

Browse files
adskyiprogeradskyiproger
committed
feat: Add infrastructure provision logic
1 parent 19b9270 commit dbe20a5

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

65 files changed

+5285
-0
lines changed

‎.github/workflows/provision-k8s.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: Provision k8s Infrastructure
2+
run-name: "Provision ${{ inputs.environment }} (tag: ${{ inputs.tags }})"
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
environment:
7+
description: 'Infrastructure to provision'
8+
required: true
9+
default: 'e2e'
10+
type: choice
11+
options:
12+
- e2e
13+
14+
tags:
15+
description: 'Tags to apply to the provisioned resources'
16+
required: true
17+
default: all
18+
type: choice
19+
options:
20+
- all
21+
- updates
22+
- users
23+
- backup
24+
- application
25+
- tools
26+
- fail2ban
27+
- decrypt-on-boot
28+
- checks
29+
- containerd-setup
30+
- kubernetes-installation
31+
- join-workers
32+
- system-preparation
33+
jobs:
34+
provision:
35+
runs-on:
36+
- self-hosted
37+
- ${{ inputs.environment }}
38+
- node
39+
environment: ${{ inputs.environment }}
40+
steps:
41+
- name: Set variables for ansible
42+
id: ansible-variables
43+
run: |
44+
JSON_WITH_NEWLINES=$(cat<<EOF
45+
${{ toJSON(env) }}
46+
EOF)
47+
JSON_WITHOUT_NEWLINES=$(echo $JSON_WITH_NEWLINES | jq -R -c .)
48+
echo "EXTRA_VARS=$JSON_WITHOUT_NEWLINES" >> $GITHUB_OUTPUT
49+
env:
50+
encrypted_disk_size: ${{ vars.DISK_SPACE }}
51+
disk_encryption_key: ${{ secrets.ENCRYPTION_KEY }}
52+
k8s_runner_token: ${{ secrets.GH_TOKEN }}
53+
repository: ${{ github.repository }}
54+
k8s_cluster_env: ${{ inputs.environment }}
55+
docker_username: ${{ secrets.DOCKER_USERNAME }}
56+
docker_password: ${{ secrets.DOCKER_TOKEN }}
57+
- name: checkout repository
58+
uses: actions/checkout@v5
59+
- name: Run Ansible Playbook
60+
uses: dawidd6/action-ansible-playbook@v4
61+
env:
62+
ANSIBLE_PERSISTENT_COMMAND_TIMEOUT: 10
63+
ANSIBLE_SSH_TIMEOUT: 10
64+
ANSIBLE_SSH_RETRIES: 5
65+
with:
66+
requirements: galaxy-requirements.yml
67+
playbook: playbook.yml
68+
directory: ./infrastructure-k8s/server-setup
69+
# Add --verbose to get more output
70+
options: |-
71+
--inventory inventory/${{ inputs.environment }}.yml
72+
${{ inputs.tags != 'all' && format('--tags={0}', inputs.tags) || '' }}
73+
--extra-vars ""${{ steps.ansible-variables.outputs.EXTRA_VARS }}""

‎infrastructure-k8s/README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# WORK IN PROGRESS!!!!!!!
2+
3+
DONT'T TRY TO RUN CONTENT INSIDE THIS FOLDER
4+
5+
# Kubernetes todo
6+
7+
1. Add metrics server: https://github.com/kubernetes-sigs/metrics-server

‎infrastructure-k8s/cryptfs/bootstrap.sh‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
#!/bin/bash
2+
# This Source Code Form is subject to the terms of the Mozilla Public
3+
# License, v. 2.0. If a copy of the MPL was not distributed with this
4+
# file, You can obtain one at https://mozilla.org/MPL/2.0/.
5+
#
6+
# OpenCRVS is also distributed under the terms of the Civil Registration
7+
# & Healthcare Disclaimer located at http://opencrvs.org/license.
8+
#
9+
# Copyright (C) The OpenCRVS Authors located at https://github.com/opencrvs/opencrvs-core/blob/master/AUTHORS.
10+
11+
set -e
12+
13+
# defaults, use options to override
14+
FS_SIZE=50g # -s, --size
15+
FS_FILE=/cryptfs_file_sparse.img # -f, --file
16+
MOUNT_PATH=/data # -m, --mount
17+
DEV_MAP_NAME=cryptfs # -n, --name
18+
# -p, --passphrase (required)
19+
20+
# options
21+
while [[ "$1" =~ ^- && ! "$1" == "--" ]]; do case $1 in
22+
-s | --size )
23+
shift; FS_SIZE=$1
24+
;;
25+
-f | --file )
26+
shift; FS_FILE=$1
27+
;;
28+
-m | --mount )
29+
shift; MOUNT_PATH=$1
30+
;;
31+
-n | --dev-map-name )
32+
shift; DEV_MAP_NAME=$1
33+
;;
34+
-p | --passphrase )
35+
shift; PASSPHRASE=$1
36+
;;
37+
esac; shift; done
38+
if [[ "$1" == '--' ]]; then shift; fi
39+
40+
if [[ -z "$PASSPHRASE" ]]; then
41+
echo "ERROR: Passphrase is required. Use -p or --passphrase."
42+
exit 1
43+
fi
44+
45+
# creates a sparse file that will be used for the crypt file system data
46+
if test -f "$FS_FILE"; then
47+
echo "ERROR: $FS_FILE exists, cannot bootstrap as the file might already contain existing data. Try run mount.sh to mount the file."
48+
exit 1
49+
else
50+
truncate -s $FS_SIZE $FS_FILE
51+
fi
52+
53+
# create a loop device from the data file
54+
LOOP_DEVICE=$(losetup --find --show $FS_FILE)
55+
56+
# setup encryption on the device
57+
echo $PASSPHRASE | cryptsetup -q -d - luksFormat $LOOP_DEVICE
58+
59+
# open the LUKS device and set a mapping name
60+
echo $PASSPHRASE | cryptsetup -d - luksOpen $LOOP_DEVICE $DEV_MAP_NAME
61+
62+
# create a file system on the device
63+
mkfs.ext4 /dev/mapper/$DEV_MAP_NAME
64+
65+
# mount the device to a folder
66+
mkdir -p $MOUNT_PATH
67+
mount /dev/mapper/$DEV_MAP_NAME $MOUNT_PATH

‎infrastructure-k8s/cryptfs/decrypt.sh‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
#!/bin/bash
2+
# This Source Code Form is subject to the terms of the Mozilla Public
3+
# License, v. 2.0. If a copy of the MPL was not distributed with this
4+
# file, You can obtain one at https://mozilla.org/MPL/2.0/.
5+
#
6+
# OpenCRVS is also distributed under the terms of the Civil Registration
7+
# & Healthcare Disclaimer located at http://opencrvs.org/license.
8+
#
9+
# Copyright (C) The OpenCRVS Authors located at https://github.com/opencrvs/opencrvs-core/blob/master/AUTHORS.
10+
11+
# defaults, use options to override
12+
FS_FILE=/cryptfs_file_sparse.img # -f, --file
13+
MOUNT_PATH=/data # -m, --mount
14+
DEV_MAP_NAME=cryptfs # -n, --name
15+
# -key, --encryptionKeyFilepath (required - path to a file containing the decryption passphrase in the format DISK_ENCRYPTION_KEY=XXXX.)
16+
# options
17+
while [[ "$1" =~ ^- && ! "$1" == "--" ]]; do case $1 in
18+
-f | --file )
19+
shift; FS_FILE=$1
20+
;;
21+
-m | --mount )
22+
shift; MOUNT_PATH=$1
23+
;;
24+
-n | --dev-map-name )
25+
shift; DEV_MAP_NAME=$1
26+
;;
27+
-key | --encryptionKeyFilepath )
28+
shift; ENCRYPTION_KEY_FILE_PATH=$1
29+
;;
30+
esac; shift; done
31+
if [[ "$1" == '--' ]]; then shift; fi
32+
33+
# In this example, we load the disk encryption password from a file.
34+
# We recommend that the encryption key is served via a secure API from a Hardware Security Module
35+
if [[ -z "$ENCRYPTION_KEY_FILE_PATH" ]]; then
36+
echo "ERROR: Disk encrytion key file path is required. Use -key or --encryptionKeyFilepath."
37+
exit 1
38+
fi
39+
40+
source $ENCRYPTION_KEY_FILE_PATH
41+
42+
# create a loop device from the data file if it doesn't already exist
43+
LOOP_DEVICE=$(losetup -j /cryptfs_file_sparse.img | awk '{print substr($1, 1, length($1)-1)}' | head -1)
44+
echo $LOOP_DEVICE
45+
if [[ -z "$LOOP_DEVICE" ]]; then
46+
LOOP_DEVICE=$(losetup --find --show $FS_FILE)
47+
echo "Created new loop device $LOOP_DEVICE"
48+
else
49+
echo "Using existing loop device $LOOP_DEVICE"
50+
fi
51+
52+
# open the LUKS device and set a mapping name
53+
echo $DISK_ENCRYPTION_KEY | cryptsetup -d - luksOpen $LOOP_DEVICE $DEV_MAP_NAME || true
54+
55+
# mount the device to a folder
56+
mount /dev/mapper/$DEV_MAP_NAME $MOUNT_PATH || true

‎infrastructure-k8s/cryptfs/mount.sh‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
#!/bin/bash
2+
# This Source Code Form is subject to the terms of the Mozilla Public
3+
# License, v. 2.0. If a copy of the MPL was not distributed with this
4+
# file, You can obtain one at https://mozilla.org/MPL/2.0/.
5+
#
6+
# OpenCRVS is also distributed under the terms of the Civil Registration
7+
# & Healthcare Disclaimer located at http://opencrvs.org/license.
8+
#
9+
# Copyright (C) The OpenCRVS Authors located at https://github.com/opencrvs/opencrvs-core/blob/master/AUTHORS.
10+
11+
# defaults, use options to override
12+
FS_FILE=/cryptfs_file_sparse.img # -f, --file
13+
MOUNT_PATH=/data # -m, --mount
14+
DEV_MAP_NAME=cryptfs # -n, --name
15+
# -p, --passphrase (required)
16+
17+
# options
18+
while [[ "$1" =~ ^- && ! "$1" == "--" ]]; do case $1 in
19+
-f | --file )
20+
shift; FS_FILE=$1
21+
;;
22+
-m | --mount )
23+
shift; MOUNT_PATH=$1
24+
;;
25+
-n | --dev-map-name )
26+
shift; DEV_MAP_NAME=$1
27+
;;
28+
-p | --passphrase )
29+
shift; PASSPHRASE=$1
30+
;;
31+
esac; shift; done
32+
if [[ "$1" == '--' ]]; then shift; fi
33+
34+
if [[ -z "$PASSPHRASE" ]]; then
35+
echo "ERROR: Passphrase is required. Use -p or --passphrase."
36+
exit 1
37+
fi
38+
39+
# create a loop device from the data file if it doesn't already exist
40+
LOOP_DEVICE=$(losetup -j /cryptfs_file_sparse.img | awk '{print substr($1, 1, length($1)-1)}' | head -1)
41+
echo $LOOP_DEVICE
42+
if [[ -z "$LOOP_DEVICE" ]]; then
43+
LOOP_DEVICE=$(losetup --find --show $FS_FILE)
44+
echo "Created new loop device $LOOP_DEVICE"
45+
else
46+
echo "Using existing loop device $LOOP_DEVICE"
47+
fi
48+
49+
# open the LUKS device and set a mapping name
50+
echo $PASSPHRASE | cryptsetup -d - luksOpen $LOOP_DEVICE $DEV_MAP_NAME || true
51+
52+
# mount the device to a folder
53+
mount /dev/mapper/$DEV_MAP_NAME $MOUNT_PATH || true

‎infrastructure-k8s/cryptfs/umount.sh‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#!/bin/bash
2+
# This Source Code Form is subject to the terms of the Mozilla Public
3+
# License, v. 2.0. If a copy of the MPL was not distributed with this
4+
# file, You can obtain one at https://mozilla.org/MPL/2.0/.
5+
#
6+
# OpenCRVS is also distributed under the terms of the Civil Registration
7+
# & Healthcare Disclaimer located at http://opencrvs.org/license.
8+
#
9+
# Copyright (C) The OpenCRVS Authors located at https://github.com/opencrvs/opencrvs-core/blob/master/AUTHORS.
10+
11+
# defaults, use options to override
12+
FS_FILE=/cryptfs_file_sparse.img # -f, --file
13+
MOUNT_PATH=/data # -m, --mount
14+
DEV_MAP_NAME=cryptfs # -n, --name
15+
16+
# options
17+
while [[ "$1" =~ ^- && ! "$1" == "--" ]]; do case $1 in
18+
-f | --file )
19+
shift; FS_FILE=$1
20+
;;
21+
-m | --mount )
22+
shift; MOUNT_PATH=$1
23+
;;
24+
-n | --dev-map-name )
25+
shift; DEV_MAP_NAME=$1
26+
;;
27+
esac; shift; done
28+
if [[ "$1" == '--' ]]; then shift; fi
29+
30+
# unmount the device from a folder
31+
umount $MOUNT_PATH
32+
33+
# close the encrypted device
34+
cryptsetup luksClose /dev/mapper/$DEV_MAP_NAME
35+
36+
# remove the associated loop devices
37+
losetup -l | grep $FS_FILE | awk '{print $1}' | xargs -L 1 losetup -d

0 commit comments

Comments
 (0)