diff --git a/.ansible-lint.yml b/.ansible-lint.yml new file mode 100644 index 0000000..a9f7e8c --- /dev/null +++ b/.ansible-lint.yml @@ -0,0 +1,7 @@ +--- +skip_list: + - var-naming[no-role-prefix] +exclude_paths: + - .github + - ui-meta/ + - assets/ diff --git a/.checkov.yml b/.checkov.yml new file mode 100644 index 0000000..fd7bf68 --- /dev/null +++ b/.checkov.yml @@ -0,0 +1,11 @@ +--- +skip-check: + # Requires all urls used with ansible.builtin.uri to be HTTPS + # Redirection to HTTPS is handled by the Kubernetes ingress + - CKV2_ANSIBLE_1 + # Requires all blocks to have rescue: - not considered appropriate + - CKV2_ANSIBLE_3 + - CKV2_GHA_1 +skip-path: + - vendor/ + - collections/ diff --git a/.editorconfig b/.editorconfig new file mode 100644 index 0000000..984b0d9 --- /dev/null +++ b/.editorconfig @@ -0,0 +1,8 @@ +# The is primarily used to alter the behaviour of linters executed by super-linter. +# See https://editorconfig.org/ + +# shfmt will default to indenting shell scripts with tabs, +# define the indent as 2 spaces +[bin/*] +indent_style = space +indent_size = 2 diff --git a/.github/linters/.checkov.yml b/.github/linters/.checkov.yml new file mode 120000 index 0000000..4ff6236 --- /dev/null +++ b/.github/linters/.checkov.yml @@ -0,0 +1 @@ +../../.checkov.yml \ No newline at end of file diff --git a/.github/linters/actionlint.yml b/.github/linters/actionlint.yml new file mode 120000 index 0000000..766b4e9 --- /dev/null +++ b/.github/linters/actionlint.yml @@ -0,0 +1 @@ +../../actionlint.yml \ No newline at end of file diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml new file mode 100644 index 0000000..e51c31b --- /dev/null +++ b/.github/workflows/lint.yml @@ -0,0 +1,47 @@ +--- +name: Lint + +on: # yamllint disable-line rule:truthy + workflow_call: + +permissions: + contents: read + packages: read + # To report GitHub Actions status checks + statuses: write + +jobs: + lint: + name: Lint + runs-on: ubuntu-latest + permissions: + contents: read + packages: read + # To report GitHub Actions status checks + statuses: write + + steps: + - uses: actions/checkout@v4 + with: + # super-linter needs the full git history to get the + # list of files that changed across commits + fetch-depth: 0 + submodules: true + + - name: Run ansible-lint + uses: ansible/ansible-lint@v25.4.0 + + - name: Load super-linter configuration + # Use grep inverse matching to exclude eventual comments in the .env file + # because the GitHub Actions command to set environment variables doesn't + # support comments. + # yamllint disable-line rule:line-length + # Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/workflow-commands-for-github-actions#setting-an-environment-variable + run: grep -v '^#' super-linter.env >> "$GITHUB_ENV" + if: always() + + - name: Run super-linter + uses: super-linter/super-linter@v7.3.0 + if: always() + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml new file mode 100644 index 0000000..d890bff --- /dev/null +++ b/.github/workflows/pr.yml @@ -0,0 +1,26 @@ +--- + name: Build and test PR + + permissions: + contents: read + packages: read + # To report GitHub Actions status checks + statuses: write + + concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + + on: + pull_request: + types: + - opened + - synchronize + - ready_for_review + - reopened + branches: + - main + + jobs: + lint: + uses: ./.github/workflows/lint.yml diff --git a/.yamllint.yml b/.yamllint.yml new file mode 100644 index 0000000..3220260 --- /dev/null +++ b/.yamllint.yml @@ -0,0 +1,24 @@ +--- +extends: default + +rules: + brackets: + forbid: non-empty + comments: + # https://github.com/prettier/prettier/issues/6780 + min-spaces-from-content: 1 + # https://github.com/adrienverge/yamllint/issues/384 + comments-indentation: false + document-start: disable + # 160 chars was the default used by old E204 rule, but + # you can easily change it or disable in your .yamllint file. + line-length: + max: 160 + # We are adding an extra space inside braces as that's how prettier does it + # and we are trying not to fight other linters. + braces: + min-spaces-inside: 0 # yamllint defaults to 0 + max-spaces-inside: 1 # yamllint defaults to 0 + octal-values: + forbid-implicit-octal: true # yamllint defaults to false + forbid-explicit-octal: true # yamllint defaults to false diff --git a/README.md b/README.md index eff7e2a..9aab987 100644 --- a/README.md +++ b/README.md @@ -1 +1,17 @@ # caas-workstation + +## Developing locally + +To run the GitHub Actions linters locally, use: + +```sh +docker run --rm \ + -e RUN_LOCAL=true \ + --env-file "super-linter.env" \ + -v "$(pwd)":/tmp/lint \ + ghcr.io/super-linter/super-linter:v7.3.0 +``` + +```sh +ansible-lint -c .ansible-lint.yml +``` diff --git a/actionlint.yml b/actionlint.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/actionlint.yml @@ -0,0 +1 @@ +--- diff --git a/roles/cluster_infra/tasks/main.yml b/roles/cluster_infra/tasks/main.yml index 25a7c8c..ad7c886 100644 --- a/roles/cluster_infra/tasks/main.yml +++ b/roles/cluster_infra/tasks/main.yml @@ -1,39 +1,41 @@ --- -# Convert the floating IP id to an address for Terraform -- block: +- name: Convert the floating IP id to an address for Terraform + when: + - cluster_floating_ip is defined + - cluster_floating_ip + block: - name: Look up floating ip azimuth_cloud.terraform.os_floating_ip_info: floating_ip: "{{ cluster_floating_ip }}" register: cluster_floating_ip_info - name: Set floating IP address fact - set_fact: + ansible.builtin.set_fact: cluster_floating_ip_address: "{{ cluster_floating_ip_info.floating_ip.floating_ip_address }}" - when: - - cluster_floating_ip is defined - - cluster_floating_ip - name: Install Terraform binary - include_role: + ansible.builtin.include_role: name: azimuth_cloud.terraform.install - name: Make Terraform project directory - file: + ansible.builtin.file: path: "{{ terraform_project_path }}" state: directory + mode: "0755" - name: Template Terraform files into project directory - template: + ansible.builtin.template: src: "{{ item }}.j2" dest: "{{ terraform_project_path }}/{{ item }}" + mode: "0644" loop: - outputs.tf - providers.tf - resources.tf - name: Provision infrastructure - include_role: + ansible.builtin.include_role: name: azimuth_cloud.terraform.infra vars: terraform_rebuild_nodes: "{{ azimuth_update_reason == 'patch' }}" diff --git a/super-linter.env b/super-linter.env new file mode 100644 index 0000000..b60dc86 --- /dev/null +++ b/super-linter.env @@ -0,0 +1,14 @@ +# Detect that default branch is main when running locally +DEFAULT_BRANCH=main + +# Don't validate JSCPD +VALIDATE_JSCPD=false + +# Don't validate JS standard because it conflicts with JS prettier +VALIDATE_JAVASCRIPT_STANDARD=false + +# Don't validate Ansible because ansible-lint is more flexible +VALIDATE_ANSIBLE=false + +# Don't validate YAML prettier because yamllint is sufficient +VALIDATE_YAML_PRETTIER=false diff --git a/ui-meta/workstation-external-ssh-fast-volume-type.yml b/ui-meta/workstation-external-ssh-fast-volume-type.yml index f66d37e..e0afe3b 100644 --- a/ui-meta/workstation-external-ssh-fast-volume-type.yml +++ b/ui-meta/workstation-external-ssh-fast-volume-type.yml @@ -1,3 +1,4 @@ +--- name: "workstation-external-ssh" label: "Linux Workstation (with SSH access)" description: Linux workstation (Ubuntu 22.04) accessible via a web browser and by SSH. @@ -28,7 +29,7 @@ parameters: - name: cluster_volume_size label: "Data volume size (GB)" description: |- - The size of the data volume for the workstation. + The size of the data volume for the workstation. The data volume will be available at `/data`. kind: cloud.volume_size default: 10 @@ -40,7 +41,7 @@ parameters: label: Provision high-performance storage for the data volume description: | If a high-performance storage type is available, use it for for the data - volume. If no high-performance storage type is available, this option has + volume. If no high-performance storage type is available, this option has no effect and a standard cloud volume will be provisioned for data. kind: boolean required: false diff --git a/ui-meta/workstation-external-ssh.yml b/ui-meta/workstation-external-ssh.yml index 5458851..0c2967a 100644 --- a/ui-meta/workstation-external-ssh.yml +++ b/ui-meta/workstation-external-ssh.yml @@ -1,3 +1,4 @@ +--- name: "workstation-external-ssh" label: "Linux Workstation (with SSH access)" description: Linux workstation (Ubuntu 22.04) accessible via a web browser and by SSH. @@ -28,7 +29,7 @@ parameters: - name: cluster_volume_size label: "Data volume size (GB)" description: |- - The size of the data volume for the workstation. + The size of the data volume for the workstation. The data volume will be available at `/data`. kind: cloud.volume_size default: 10 diff --git a/ui-meta/workstation-fast-volume-type.yml b/ui-meta/workstation-fast-volume-type.yml index be1b741..8f21778 100644 --- a/ui-meta/workstation-fast-volume-type.yml +++ b/ui-meta/workstation-fast-volume-type.yml @@ -1,3 +1,4 @@ +--- name: "workstation" label: "Linux Workstation" description: Linux workstation (Ubuntu 22.04) accessible via a web browser. @@ -20,19 +21,19 @@ parameters: - name: cluster_volume_size label: "Data volume size (GB)" description: |- - The size of the data volume for the workstation. + The size of the data volume for the workstation. The data volume will be available at `/data`. kind: cloud.volume_size default: 10 options: min: 10 immutable: true - + - name: use_cluster_volume_type_fast label: Provision high-performance storage for the data volume description: | If a high-performance storage type is available, use it for for the data - volume. If no high-performance storage type is available, this option has + volume. If no high-performance storage type is available, this option has no effect and a standard cloud volume will be provisioned for data. kind: boolean required: false diff --git a/ui-meta/workstation.yml b/ui-meta/workstation.yml index 1eaebc8..411a22a 100644 --- a/ui-meta/workstation.yml +++ b/ui-meta/workstation.yml @@ -1,3 +1,4 @@ +--- name: "workstation" label: "Linux Workstation" description: Linux workstation (Ubuntu 22.04) accessible via a web browser. @@ -20,7 +21,7 @@ parameters: - name: cluster_volume_size label: "Data volume size (GB)" description: |- - The size of the data volume for the workstation. + The size of the data volume for the workstation. The data volume will be available at `/data`. kind: cloud.volume_size default: 10 diff --git a/workstation.yml b/workstation.yml index 4954dc7..94e26fa 100644 --- a/workstation.yml +++ b/workstation.yml @@ -7,8 +7,8 @@ - name: Configure project share hosts: workstation - gather_facts: no - become: yes + gather_facts: false + become: true vars: os_manila_mount_shares: - share_name: "{{ cluster_project_manila_share_name | default('azimuth-project-share') }}" @@ -19,7 +19,7 @@ mount_mode: ugo=rwX tasks: - name: Configure Manila project share - include_role: + ansible.builtin.include_role: name: stackhpc.os-manila-mount when: cluster_project_manila_share | default(false) | bool @@ -27,7 +27,7 @@ hosts: openstack tasks: - name: Wait for Monitoring to become available - uri: + ansible.builtin.uri: url: "http://{{ zenith_fqdn_monitoring }}" method: GET follow_redirects: safe @@ -44,9 +44,9 @@ delay: 10 until: "monitoring_uri is not failed" when: (cluster_state | default('present')) == 'present' - + - name: Wait for webconsole to become available - uri: + ansible.builtin.uri: url: "http://{{ zenith_fqdn_webconsole }}" method: GET follow_redirects: safe @@ -64,10 +64,11 @@ until: "webconsole_uri is not failed" when: (cluster_state | default('present')) == 'present' -# Write the outputs as the final task -- hosts: localhost +- name: Write the outputs as the final task + hosts: localhost tasks: - - debug: + - name: Print cluster access ip + ansible.builtin.debug: var: outputs vars: fip_address: "{{ hostvars[groups['openstack'][0]].cluster_floating_ip_address }}"