sarex/terraform-contour-mirror
1
0
Fork 0
mirror of https://gitlab.sarex.io/infra/terraform-contour-mirror.git synced 2026-08-05 18:31:00 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity

++ scope sops age key to decrypt step instead of whole ci job

Browse Source
This commit is contained in:
Kochetkov S 2026-08-04 12:56:21 +03:00
parent 854013a415
commit c7e04cb836
2 changed files with 36 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
.gitea/workflows/terraform.yml
View File

@ -51,7 +51,6 @@ jobs:
S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }}
VAULT_ADDR: ${{ secrets.VAULT_ADDR }}
VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
KUBE_CONTEXT: ${{ secrets.KUBE_CONTEXT }}
KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
KUBECONFIG: /workspace/.kube/config
@ -84,10 +83,20 @@ jobs:
else
echo "No KUBECONFIG_B64 — in-cluster runner: kubernetes/vault providers use the pod ServiceAccount kubeconfig or in-cluster config."
fi
- name: Decrypt secret values
# SOPS_AGE_KEY only reaches this step, not the whole job - the rest
# (checkout, kubeconfig, terragrunt run) never sees it.
env:
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
run: |
if ! command -v sops >/dev/null 2>&1; then apk add --no-cache sops || (apk add --no-cache curl && curl -fsSL https://github.com/getsops/sops/releases/download/v3.9.0/sops-v3.9.0.linux.amd64 -o /usr/local/bin/sops && chmod +x /usr/local/bin/sops); fi
sops --decrypt infrastructure-secrets.yaml > /tmp/infra-secret-values.yaml
echo "INFRA_SECRET_VALUES_FILE=/tmp/infra-secret-values.yaml" >> "$GITHUB_ENV"
- name: Run validate for all stacks
run: |
. ./scripts/load_admin_creds.sh
./scripts/run_all_stacks.sh validate
rm -f /tmp/infra-secret-values.yaml
plan:
needs: [validate]
@ -101,7 +110,6 @@ jobs:
S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }}
VAULT_ADDR: ${{ secrets.VAULT_ADDR }}
VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
KUBE_CONTEXT: ${{ secrets.KUBE_CONTEXT }}
KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
KUBECONFIG: /workspace/.kube/config
@ -132,10 +140,20 @@ jobs:
echo "$KUBECONFIG_B64" | base64 -d > /workspace/.kube/config
chmod 600 /workspace/.kube/config
fi
- name: Decrypt secret values
# SOPS_AGE_KEY only reaches this step, not the whole job - the rest
# (checkout, kubeconfig, terragrunt run) never sees it.
env:
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
run: |
if ! command -v sops >/dev/null 2>&1; then apk add --no-cache sops || (apk add --no-cache curl && curl -fsSL https://github.com/getsops/sops/releases/download/v3.9.0/sops-v3.9.0.linux.amd64 -o /usr/local/bin/sops && chmod +x /usr/local/bin/sops); fi
sops --decrypt infrastructure-secrets.yaml > /tmp/infra-secret-values.yaml
echo "INFRA_SECRET_VALUES_FILE=/tmp/infra-secret-values.yaml" >> "$GITHUB_ENV"
- name: Run plan for all stacks
run: |
. ./scripts/load_admin_creds.sh
./scripts/run_all_stacks.sh plan
rm -f /tmp/infra-secret-values.yaml
apply:
needs: [plan]
@ -150,7 +168,6 @@ jobs:
S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }}
VAULT_ADDR: ${{ secrets.VAULT_ADDR }}
VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
KUBE_CONTEXT: ${{ secrets.KUBE_CONTEXT }}
KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
KUBECONFIG: /workspace/.kube/config
@ -181,7 +198,17 @@ jobs:
echo "$KUBECONFIG_B64" | base64 -d > /workspace/.kube/config
chmod 600 /workspace/.kube/config
fi
- name: Decrypt secret values
# SOPS_AGE_KEY only reaches this step, not the whole job - the rest
# (checkout, kubeconfig, terragrunt run) never sees it.
env:
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
run: |
if ! command -v sops >/dev/null 2>&1; then apk add --no-cache sops || (apk add --no-cache curl && curl -fsSL https://github.com/getsops/sops/releases/download/v3.9.0/sops-v3.9.0.linux.amd64 -o /usr/local/bin/sops && chmod +x /usr/local/bin/sops); fi
sops --decrypt infrastructure-secrets.yaml > /tmp/infra-secret-values.yaml
echo "INFRA_SECRET_VALUES_FILE=/tmp/infra-secret-values.yaml" >> "$GITHUB_ENV"
- name: Run apply for all stacks
run: |
. ./scripts/load_admin_creds.sh
./scripts/run_all_stacks.sh apply
rm -f /tmp/infra-secret-values.yaml

7
live/vault-secrets/terragrunt.hcl
View File

@ -7,7 +7,12 @@ locals {
infra_config = yamldecode(file("${local.repo_root}/infrastructure.yaml"))
secrets_file = "${local.repo_root}/infrastructure-secrets.yaml"
secrets_config = try(yamldecode(sops_decrypt_file(local.secrets_file)), {})
# В CI файл расшифровывается заранее одним шагом, и путь передаётся через
# INFRA_SECRET_VALUES_FILE (SOPS_AGE_KEY нужен только этому шагу, не всей
# джобе). Локально - fallback на прямую расшифровку через sops_decrypt_file.
secret_values_env_file = get_env("INFRA_SECRET_VALUES_FILE", "")
secrets_config_raw = local.secret_values_env_file != "" ? file(local.secret_values_env_file) : try(sops_decrypt_file(local.secrets_file), "")
secrets_config = try(yamldecode(local.secrets_config_raw), {})
env_override = trimspace(get_env("INFRA_ENV", ""))
env_from_file = try(trimspace(local.infra_config.current_environment), "")