Skip to content

Commit 974c025

Browse files
dungpham91dungpham91
committed
feat(init): add gha and packer
1 parent aae884a commit 974c025

File tree

5 files changed

+303
-0
lines changed

5 files changed

+303
-0
lines changed

‎.github/workflows/packer.yml

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: Build Packer AMI
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches:
7+
- main
8+
paths:
9+
- "packer/**"
10+
11+
permissions: read-all
12+
13+
concurrency:
14+
group: ${{ github.workflow }}-${{ github.ref }}
15+
cancel-in-progress: true
16+
17+
jobs:
18+
build:
19+
runs-on: ubuntu-latest
20+
steps:
21+
- name: Checkout code
22+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
23+
24+
- name: Set up Packer
25+
uses: hashicorp/setup-packer@1aa358be5cf73883762b302a3a03abd66e75b232 # v3.1.0
26+
27+
- name: Set up AWS Credentials
28+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
29+
with:
30+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
31+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
32+
aws-region: us-east-1
33+
34+
- name: Build Packer AMI
35+
run: |
36+
cd packer
37+
packer fmt .
38+
packer init .
39+
packer validate build.pkr.hcl
40+
packer build build.pkr.hcl
41+
42+
slack-notify:
43+
needs:
44+
- build
45+
if: always()
46+
runs-on: ubuntu-latest
47+
steps:
48+
- name: Slack notification
49+
uses: come25136/workflow-notification-for-slack@main
50+
with:
51+
repo_token: ${{ secrets.GITHUB_TOKEN }}
52+
slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}

‎.github/workflows/pr-check.yml

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: PR Check
2+
3+
on:
4+
workflow_dispatch:
5+
pull_request:
6+
paths:
7+
- '**/*.tf'
8+
permissions: read-all
9+
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: true
13+
14+
jobs:
15+
terraform-check:
16+
runs-on: ubuntu-latest
17+
18+
steps:
19+
- name: Checkout repository
20+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
21+
22+
- name: Set up Terraform
23+
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
24+
with:
25+
terraform_version: '1.10.4'
26+
27+
- name: Check Terraform format
28+
run: terraform fmt -recursive .
29+
30+
- name: Validate Terraform code
31+
run: terraform validate
32+
33+
- name: Install Checkov
34+
run: |
35+
python -m pip install --upgrade pip
36+
pip install checkov
37+
38+
- name: Scan Terraform with Checkov
39+
run: checkov -d . --quiet
40+
41+
slack-notify:
42+
needs:
43+
- terraform-check
44+
if: always()
45+
runs-on: ubuntu-latest
46+
steps:
47+
- name: Slack notification
48+
uses: come25136/workflow-notification-for-slack@main
49+
with:
50+
repo_token: ${{ secrets.GITHUB_TOKEN }}
51+
slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}

‎.gitignore

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Terraform
2+
.terraform/
3+
4+
# Local .tfstate files
5+
*.tfstate
6+
*.tfstate.*
7+
8+
# .tfvars files that are included with version control
9+
*.tfvars
10+
11+
# .tfvars files that are not included with version control
12+
override.tf
13+
override.tf.json
14+
*_override.tf
15+
*_override.tf.json
16+
17+
# Crash log files
18+
crash.log
19+
20+
# Exclude all .tfplan files
21+
*.tfplan
22+
23+
# Ignore CLI configuration files
24+
.terraformrc
25+
terraform.rc
26+
27+
# If you use the "remote" backend, exclude the .terraform directory
28+
# since it will be populated with remote state files
29+
.terraform
30+
31+
# Ignore .hcl files for CLI command configuration
32+
*.hcl
33+
34+
# Except .hcl files in packer/ directory
35+
!packer/**/*.hcl
36+
37+
# CLI .terraform directories (local)
38+
.tf/

‎atlantis.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
version: 3
2+
projects:
3+
- name: dev
4+
dir: env/dev
5+
workspace: default
6+
autoplan:
7+
enabled: true
8+
9+
- name: qa
10+
dir: env/qa
11+
workspace: default
12+
autoplan:
13+
enabled: true

‎packer/build.pkr.hcl

+149
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
#------------------------------------------------------------------------------
2+
# Packer plugin
3+
#------------------------------------------------------------------------------
4+
packer {
5+
required_plugins {
6+
amazon = {
7+
source = "github.com/hashicorp/amazon"
8+
version = "v1.3.4"
9+
}
10+
}
11+
}
12+
13+
#------------------------------------------------------------------------------
14+
# Variables
15+
#------------------------------------------------------------------------------
16+
variable "ami_name_prefix" {
17+
type = string
18+
default = "amazon-eks-node"
19+
}
20+
21+
variable "aws_tag_unit" {
22+
type = string
23+
default = "devops"
24+
}
25+
26+
variable "aws_tag_environment" {
27+
type = string
28+
default = "dev"
29+
}
30+
31+
variable "aws_tag_owner" {
32+
type = string
33+
default = "devopslite"
34+
}
35+
36+
variable "aws_tag_project" {
37+
type = string
38+
default = "devopslite"
39+
}
40+
41+
variable "region" {
42+
type = string
43+
default = "us-east-1"
44+
}
45+
46+
variable "vpc_id" {
47+
type = string
48+
default = "vpc-09eaa132bddb868ba"
49+
}
50+
51+
variable "public_subnet_id" {
52+
type = string
53+
default = "subnet-09eafbc8bd301fc34"
54+
}
55+
56+
variable "communicator" {
57+
description = "communication method used for instance"
58+
default = "ssh"
59+
}
60+
61+
variable "ssh_username" {
62+
description = "ssh username for packer to use for provisioning"
63+
default = "ec2-user"
64+
}
65+
66+
locals {
67+
timestamp = timestamp()
68+
date_part = formatdate("YYYYMMDD", local.timestamp)
69+
time_part = formatdate("HHmmss", local.timestamp)
70+
ami_name = "${var.ami_name_prefix}-${local.date_part}-${local.time_part}"
71+
}
72+
73+
#------------------------------------------------------------------------------
74+
# Sources
75+
#------------------------------------------------------------------------------
76+
source "amazon-ebs" "eks_node" {
77+
ami_description = "A node AMI used in EKS with Wazuh agent, based on Amazon Linux 2023."
78+
ami_name = local.ami_name
79+
instance_type = "t3a.small"
80+
region = var.region
81+
vpc_id = var.vpc_id
82+
subnet_id = var.public_subnet_id
83+
associate_public_ip_address = true
84+
85+
source_ami_filter {
86+
filters = {
87+
architecture = "x86_64"
88+
name = "amazon-eks-node-al2023-x86_64-standard-1.31-*"
89+
"root-device-type" = "ebs"
90+
"virtualization-type" = "hvm"
91+
}
92+
93+
most_recent = true
94+
owners = ["602401143452"]
95+
}
96+
97+
run_tags = {
98+
Name = local.ami_name
99+
Environment = var.aws_tag_environment
100+
Owners = var.aws_tag_owner
101+
Project = var.aws_tag_project
102+
}
103+
104+
run_volume_tags = {
105+
Name = local.ami_name
106+
Environment = var.aws_tag_environment
107+
Owners = var.aws_tag_owner
108+
Project = var.aws_tag_project
109+
}
110+
111+
tags = {
112+
Name = local.ami_name
113+
Environment = var.aws_tag_environment
114+
Owners = var.aws_tag_owner
115+
Project = var.aws_tag_project
116+
}
117+
118+
snapshot_tags = {
119+
Name = local.ami_name
120+
Environment = var.aws_tag_environment
121+
Owners = var.aws_tag_owner
122+
Project = var.aws_tag_project
123+
}
124+
125+
communicator = var.communicator
126+
ssh_username = var.ssh_username
127+
}
128+
129+
#------------------------------------------------------------------------------
130+
# Build AMI
131+
#------------------------------------------------------------------------------
132+
build {
133+
sources = ["source.amazon-ebs.eks_node"]
134+
135+
provisioner "shell" {
136+
inline = [
137+
"sudo dnf upgrade -y",
138+
"sudo rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH",
139+
"sudo bash -c 'cat > /etc/yum.repos.d/wazuh.repo << EOF\n[wazuh]\ngpgcheck=1\ngpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH\nenabled=1\nname=EL-\\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1\nEOF'",
140+
"sudo dnf install -y wazuh-agent",
141+
"sudo sed -i 's/<address>MANAGER_IP<\\/address>/<address>siem.devopslite.com<\\/address>/g' /var/ossec/etc/ossec.conf",
142+
"sudo systemctl daemon-reload",
143+
"sudo systemctl enable wazuh-agent",
144+
"echo 'Completed install wazuh-agent' > /tmp/wazuh-agent-install.log",
145+
"cat /tmp/wazuh-agent-install.log",
146+
"sudo sed -i \"s/^enabled=1/enabled=0/\" /etc/yum.repos.d/wazuh.repo",
147+
]
148+
}
149+
}

0 commit comments

Comments
 (0)