Skip to content

Commit ae6ae7d

Browse files
matttrachmatttrach
authored
Merge branch 'main' into dependabot/github_actions/aws-actions/configure-aws-credentials-6
2 parents 8fe7aac + 280be2c commit ae6ae7d

9 files changed

Lines changed: 68 additions & 34 deletions

File tree

‎.github/workflows/fossa.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: FOSSA Scanning
2+
3+
on:
4+
push:
5+
branches: ["main", "master", "release/**"]
6+
workflow_dispatch:
7+
8+
permissions:
9+
contents: read
10+
id-token: write
11+
12+
jobs:
13+
fossa-scanning:
14+
runs-on: ubuntu-latest
15+
timeout-minutes: 30
16+
steps:
17+
- name: Checkout
18+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
19+
20+
# The FOSSA token is shared between all repos in Rancher's GH org. It can be
21+
# used directly and there is no need to request specific access to EIO.
22+
- name: Read FOSSA token
23+
uses: rancher-eio/read-vault-secrets@main
24+
with:
25+
secrets: |
26+
secret/data/github/org/rancher/fossa/push token | FOSSA_API_KEY_PUSH_ONLY
27+
28+
- name: FOSSA scan
29+
uses: fossas/fossa-action@main
30+
with:
31+
api-key: ${{ env.FOSSA_API_KEY_PUSH_ONLY }}
32+
# Only runs the scan and do not provide/returns any results back to the
33+
# pipeline.
34+
run-tests: false

‎examples/downstream/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ module "rancher" {
6767
# rke2
6868
rke2_version = local.rke2_version
6969
local_file_path = local.local_file_path
70-
install_method = "rpm" # rpm only for now, need to figure out local helm chart installs otherwise
70+
install_method = "rpm"
7171
cni = "canal"
7272
node_configuration = {
7373
"rancher" = {

‎examples/downstream_splitrole/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ module "rancher" {
6767
# rke2
6868
rke2_version = local.rke2_version
6969
local_file_path = local.local_file_path
70-
install_method = "rpm" # rpm only for now, need to figure out local helm chart installs otherwise
70+
install_method = "rpm"
7171
cni = "canal"
7272
node_configuration = {
7373
"rancher" = {

‎examples/one/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ module "rancher" {
5656
# rke2
5757
rke2_version = local.rke2_version
5858
local_file_path = local.local_file_path
59-
install_method = "rpm" # rpm only for now, need to figure out local helm chart installs otherwise
59+
install_method = "tar" # this installs RKE using the tar method, but it isn't an air-gapped install, Rancher install still uses public helm chart
6060
cni = "canal"
6161
node_configuration = {
6262
"rancher" = {

‎examples/prod/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ module "rancher" {
8787
# rke2
8888
rke2_version = local.rke2_version
8989
local_file_path = local.local_file_path
90-
install_method = "rpm" # rpm only for now, need to figure out local helm chart installs otherwise
90+
install_method = "tar" # tar install, but not air-gapped
9191
cni = "canal"
9292
node_configuration = {
9393
"initial" = {

‎examples/three/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ module "rancher" {
124124
# rke2
125125
rke2_version = local.rke2_version
126126
local_file_path = local.local_file_path
127-
install_method = "rpm" # rpm only for now, need to figure out local helm chart installs otherwise
127+
install_method = "tar" # tar install, but not air-gapped
128128
cni = "canal"
129129
node_configuration = local.node_configuration
130130
# rancher

‎flake.lock‎

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎modules/install_rancher/rancher/main.tf‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,7 @@ data "kubernetes_secret_v1" "certificate" {
190190

191191
# we need to create the tls-ca and tls-ca-additional secrets while the rancher pod is starting up
192192
# the rancher pod will fail a few times, but once the secrets are in place it will start and everything will start to work
193-
resource "kubernetes_secret" "rancher_tls_ca" {
193+
resource "kubernetes_secret_v1" "rancher_tls_ca" {
194194
depends_on = [
195195
time_sleep.settle_before_rancher,
196196
terraform_data.wait_for_nginx,
@@ -203,7 +203,7 @@ resource "kubernetes_secret" "rancher_tls_ca" {
203203
name = "tls-ca"
204204
namespace = "cattle-system"
205205
}
206-
type = "generic"
206+
type = "Opaque" # "generic" https://kubernetes.io/docs/concepts/configuration/secret/#secret-types
207207
data = {
208208
"cacerts.pem" = data.kubernetes_secret_v1.certificate.data["tls.crt"], # don't base64 encode
209209
}
@@ -214,7 +214,7 @@ resource "kubernetes_secret" "rancher_tls_ca" {
214214
}
215215
}
216216

217-
resource "kubernetes_secret" "rancher_tls_ca_additional" {
217+
resource "kubernetes_secret_v1" "rancher_tls_ca_additional" {
218218
depends_on = [
219219
time_sleep.settle_before_rancher,
220220
terraform_data.wait_for_nginx,
@@ -227,7 +227,7 @@ resource "kubernetes_secret" "rancher_tls_ca_additional" {
227227
name = "tls-ca-additional"
228228
namespace = "cattle-system"
229229
}
230-
type = "generic"
230+
type = "Opaque" # "generic" https://kubernetes.io/docs/concepts/configuration/secret/#secret-types
231231
data = {
232232
"ca-additional.pem" = data.kubernetes_secret_v1.certificate.data["tls.crt"], # don't base64 encode
233233
}
@@ -246,8 +246,8 @@ resource "terraform_data" "wait_for_rancher" {
246246
kubernetes_manifest.issuer,
247247
helm_release.rancher,
248248
data.kubernetes_secret_v1.certificate,
249-
kubernetes_secret.rancher_tls_ca,
250-
kubernetes_secret.rancher_tls_ca_additional,
249+
kubernetes_secret_v1.rancher_tls_ca,
250+
kubernetes_secret_v1.rancher_tls_ca_additional,
251251
]
252252
provisioner "local-exec" {
253253
command = <<-EOT
@@ -268,8 +268,8 @@ resource "terraform_data" "get_public_cert_info" {
268268
kubernetes_manifest.issuer,
269269
helm_release.rancher,
270270
data.kubernetes_secret_v1.certificate,
271-
kubernetes_secret.rancher_tls_ca,
272-
kubernetes_secret.rancher_tls_ca_additional,
271+
kubernetes_secret_v1.rancher_tls_ca,
272+
kubernetes_secret_v1.rancher_tls_ca_additional,
273273
terraform_data.wait_for_rancher,
274274
]
275275
provisioner "local-exec" {

‎modules/install_rancher/rancher_externalTLS/main.tf‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ resource "terraform_data" "cattle-system" {
109109
}
110110
}
111111

112-
resource "kubernetes_secret" "tls_rancher_ingress" {
112+
resource "kubernetes_secret_v1" "tls_rancher_ingress" {
113113
depends_on = [
114114
time_sleep.settle_before_rancher,
115115
terraform_data.wait_for_nginx,
@@ -119,7 +119,7 @@ resource "kubernetes_secret" "tls_rancher_ingress" {
119119
name = "tls-rancher-ingress"
120120
namespace = "cattle-system"
121121
}
122-
type = "kubernetes.io/tls"
122+
type = "kubernetes.io/tls" #https://kubernetes.io/docs/concepts/configuration/secret/#secret-types
123123
data = {
124124
"tls.crt" = local.full_chain,
125125
"tls.key" = local.private_key,
@@ -131,18 +131,18 @@ resource "kubernetes_secret" "tls_rancher_ingress" {
131131
}
132132
}
133133

134-
resource "kubernetes_secret" "rancher_tls_ca" {
134+
resource "kubernetes_secret_v1" "rancher_tls_ca" {
135135
depends_on = [
136136
time_sleep.settle_before_rancher,
137137
terraform_data.wait_for_nginx,
138138
terraform_data.cattle-system,
139-
kubernetes_secret.tls_rancher_ingress,
139+
kubernetes_secret_v1.tls_rancher_ingress,
140140
]
141141
metadata {
142142
name = "tls-ca"
143143
namespace = "cattle-system"
144144
}
145-
type = "generic"
145+
type = "Opaque" #https://kubernetes.io/docs/concepts/configuration/secret/#secret-types
146146
data = {
147147
"cacerts.pem" = local.ca_certs
148148
}
@@ -153,19 +153,19 @@ resource "kubernetes_secret" "rancher_tls_ca" {
153153
}
154154
}
155155

156-
resource "kubernetes_secret" "rancher_tls_ca_additional" {
156+
resource "kubernetes_secret_v1" "rancher_tls_ca_additional" {
157157
depends_on = [
158158
time_sleep.settle_before_rancher,
159159
terraform_data.wait_for_nginx,
160160
terraform_data.cattle-system,
161-
kubernetes_secret.tls_rancher_ingress,
162-
kubernetes_secret.rancher_tls_ca,
161+
kubernetes_secret_v1.tls_rancher_ingress,
162+
kubernetes_secret_v1.rancher_tls_ca,
163163
]
164164
metadata {
165165
name = "tls-ca-additional"
166166
namespace = "cattle-system"
167167
}
168-
type = "generic"
168+
type = "Opaque" #"generic" https://kubernetes.io/docs/concepts/configuration/secret/#secret-types
169169
data = {
170170
"ca-additional.pem" = local.ca_certs,
171171
}
@@ -182,9 +182,9 @@ resource "helm_release" "rancher" {
182182
time_sleep.settle_before_rancher,
183183
terraform_data.wait_for_nginx,
184184
terraform_data.cattle-system,
185-
kubernetes_secret.tls_rancher_ingress,
186-
kubernetes_secret.rancher_tls_ca,
187-
kubernetes_secret.rancher_tls_ca_additional,
185+
kubernetes_secret_v1.tls_rancher_ingress,
186+
kubernetes_secret_v1.rancher_tls_ca,
187+
kubernetes_secret_v1.rancher_tls_ca_additional,
188188
]
189189
name = "rancher"
190190
chart = "${local.rancher_helm_repo}/${local.rancher_helm_channel}/rancher-${local.rancher_version}.tgz"
@@ -211,9 +211,9 @@ resource "terraform_data" "wait_for_rancher" {
211211
time_sleep.settle_before_rancher,
212212
terraform_data.wait_for_nginx,
213213
terraform_data.cattle-system,
214-
kubernetes_secret.tls_rancher_ingress,
215-
kubernetes_secret.rancher_tls_ca,
216-
kubernetes_secret.rancher_tls_ca_additional,
214+
kubernetes_secret_v1.tls_rancher_ingress,
215+
kubernetes_secret_v1.rancher_tls_ca,
216+
kubernetes_secret_v1.rancher_tls_ca_additional,
217217
helm_release.rancher,
218218
]
219219
provisioner "local-exec" {
@@ -231,9 +231,9 @@ resource "terraform_data" "get_public_cert_info" {
231231
time_sleep.settle_before_rancher,
232232
terraform_data.wait_for_nginx,
233233
terraform_data.cattle-system,
234-
kubernetes_secret.tls_rancher_ingress,
235-
kubernetes_secret.rancher_tls_ca,
236-
kubernetes_secret.rancher_tls_ca_additional,
234+
kubernetes_secret_v1.tls_rancher_ingress,
235+
kubernetes_secret_v1.rancher_tls_ca,
236+
kubernetes_secret_v1.rancher_tls_ca_additional,
237237
helm_release.rancher,
238238
terraform_data.wait_for_rancher,
239239
]

0 commit comments

Comments
 (0)