Patrick de Ruiter
899fac55bb
Some checks failed
Code Quality & Security Scan / TFLint (push) Successful in 20s
Code Quality & Security Scan / Terraform Destroy (push) Has been skipped
Code Quality & Security Scan / Tfsec Security Scan (push) Successful in 30s
Code Quality & Security Scan / Checkov Security Scan (push) Successful in 37s
Code Quality & Security Scan / Terraform Validate (push) Failing after 31s
Code Quality & Security Scan / SonarQube Scan (push) Has been skipped
Code Quality & Security Scan / Terraform Plan (push) Has been skipped
Code Quality & Security Scan / Terraform Apply (push) Has been skipped
Added working pipeline based on terraform-docker-eda module: - Added pipeline.yaml with complete CI/CD workflow including Vault CLI setup - Added setup-ssh.sh for Docker provider SSH key authentication - Added .tflint.hcl for Terraform linting configuration - Removed old sonarqube.yaml pipeline file Pipeline now includes: - Vault CLI installation and SSH key setup via script - Proper backend configuration with -backend-config flags - All security scans: TFLint, Tfsec, Checkov - SonarQube integration - Terraform plan/apply with MinIO artifact storage - Terraform destroy workflow with manual approval This pipeline configuration has been proven to work with Vault, MinIO, and Docker providers using self-signed certificates.
55 lines
1.4 KiB
HCL
55 lines
1.4 KiB
HCL
terraform {
|
|
required_version = ">= 1.5.0"
|
|
|
|
required_providers {
|
|
docker = {
|
|
source = "kreuzwerker/docker"
|
|
version = "~> 3.0"
|
|
}
|
|
vault = {
|
|
source = "hashicorp/vault"
|
|
version = "~> 3.25"
|
|
}
|
|
dns = {
|
|
source = "hashicorp/dns"
|
|
version = "~> 3.4"
|
|
}
|
|
}
|
|
}
|
|
|
|
# Configure the DNS Provider
|
|
provider "dns" {
|
|
update {
|
|
server = data.vault_generic_secret.dns.data["dns_server"]
|
|
key_name = data.vault_generic_secret.dns.data["key_name"]
|
|
key_algorithm = data.vault_generic_secret.dns.data["key_algorithm"]
|
|
key_secret = data.vault_generic_secret.dns.data["key_secret"]
|
|
}
|
|
}
|
|
|
|
# Configure the Docker Provider
|
|
provider "docker" {
|
|
host = "tcp://192.168.2.170:2376"
|
|
|
|
# Use cert_path only if certificates exist (local development)
|
|
# For CI/CD, use DOCKER_HOST environment variable instead
|
|
cert_path = fileexists(pathexpand("~/.docker/ca.pem")) ? pathexpand("~/.docker") : null
|
|
}
|
|
|
|
# Configure the Vault Provider
|
|
provider "vault" {
|
|
address = "https://wbyc-srv-docker01.bsdserver.lan:8200"
|
|
|
|
# Skip TLS verification for self-signed certificates in CI/CD
|
|
# Set VAULT_SKIP_VERIFY=true environment variable in pipeline
|
|
skip_tls_verify = tobool(coalesce(try(var.vault_skip_tls_verify, null), false))
|
|
|
|
auth_login {
|
|
path = "auth/approle/login"
|
|
parameters = {
|
|
role_id = var.role_id
|
|
secret_id = var.secret_id
|
|
}
|
|
}
|
|
}
|