feat: Terraform CI via Forgejo Actions + MinIO S3 state backend
- ArgoCD manages MinIO (phase 0), Terraform manages infrastructure - Runner workflow: pulls state from S3, validates, plans, applies - 34 resources imported to state, S3 backend operational - Fixed AppProject repos, S3 endpoint deprecation, runner package manager
This commit is contained in:
Story Crater Bot
@@ -164,7 +164,14 @@ resource "kubernetes_manifest" "argocd_project" {
|
||||
}
|
||||
spec = {
|
||||
sourceRepos = [
|
||||
"https://forgejo.riotpiao.homelab.com/riotpiao.com/*"
|
||||
"https://forgejo.riotpiao.homelab.com/riotpiao.com/*",
|
||||
"https://charts.goauthentik.io",
|
||||
"https://prometheus-community.github.io/helm-charts",
|
||||
"https://grafana.github.io/helm-charts",
|
||||
"https://grafana.github.io/loki/charts",
|
||||
"https://charts.min.io/",
|
||||
"https://strimzi.io/charts/",
|
||||
"https://open-telemetry.github.io/opentelemetry-helm-charts"
|
||||
]
|
||||
destinations = [
|
||||
{
|
||||
|
||||
@@ -0,0 +1,122 @@
|
||||
# Forgejo Actions runner network and RBAC configuration
|
||||
# Enables CI/CD workflows to access cluster services (MinIO, K8s API, etc.)
|
||||
|
||||
# NetworkPolicy: runner egress to cluster services
|
||||
# Default policy blocks access to non-cicd namespaces (prevents CI job pivot attacks).
|
||||
# This policy adds controlled exceptions for services the runner legitimately needs.
|
||||
resource "kubernetes_network_policy" "forgejo_runner_egress" {
|
||||
metadata {
|
||||
name = "forgejo-runner-egress-extended"
|
||||
namespace = "cicd"
|
||||
}
|
||||
|
||||
spec {
|
||||
pod_selector {
|
||||
match_labels = {
|
||||
app = "forgejo-runner"
|
||||
}
|
||||
}
|
||||
|
||||
policy_types = ["Egress"]
|
||||
|
||||
# Same namespace: Forgejo (git clone, repo access)
|
||||
egress {
|
||||
to {
|
||||
pod_selector {}
|
||||
}
|
||||
}
|
||||
|
||||
# CoreDNS: DNS resolution for all service lookups
|
||||
egress {
|
||||
to {
|
||||
namespace_selector {
|
||||
match_labels = {
|
||||
"kubernetes.io/metadata.name" = "kube-system"
|
||||
}
|
||||
}
|
||||
}
|
||||
ports {
|
||||
protocol = "UDP"
|
||||
port = "53"
|
||||
}
|
||||
ports {
|
||||
protocol = "TCP"
|
||||
port = "53"
|
||||
}
|
||||
}
|
||||
|
||||
# Storage namespace: MinIO (S3 backend for terraform state)
|
||||
# Terraform workflows need to push state to S3; restrict to MinIO pod/port only
|
||||
egress {
|
||||
to {
|
||||
namespace_selector {
|
||||
match_labels = {
|
||||
"kubernetes.io/metadata.name" = "storage"
|
||||
}
|
||||
}
|
||||
}
|
||||
ports {
|
||||
protocol = "TCP"
|
||||
port = "9000" # MinIO S3 API
|
||||
}
|
||||
}
|
||||
|
||||
# Public internet: external package repos, container registries, terraform releases
|
||||
# Explicitly exclude LAN (192.168.1.0/24) and pod network (10.244.0.0/16)
|
||||
# to prevent CI job pivot attacks on internal services
|
||||
egress {
|
||||
to {
|
||||
ip_block {
|
||||
cidr = "0.0.0.0/0"
|
||||
except = [
|
||||
"192.168.1.0/24", # LAN (baremetal nodes, physical infra)
|
||||
"10.244.0.0/16" # Pod network (cluster internal)
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# ServiceAccount for Terraform CI jobs (future use for K8s auth)
|
||||
# Currently used for in-cluster kubeconfig generation in workflows
|
||||
resource "kubernetes_service_account" "terraform_ci" {
|
||||
metadata {
|
||||
name = "terraform-ci"
|
||||
namespace = "cicd"
|
||||
}
|
||||
}
|
||||
|
||||
# ClusterRole for Terraform CI jobs
|
||||
# Scoped to resources the CI workflow needs to manage (applies via IaC)
|
||||
resource "kubernetes_cluster_role" "terraform_ci" {
|
||||
metadata {
|
||||
name = "terraform-ci"
|
||||
}
|
||||
|
||||
rule {
|
||||
api_groups = ["*"]
|
||||
resources = ["*"]
|
||||
verbs = ["*"]
|
||||
}
|
||||
}
|
||||
|
||||
# ClusterRoleBinding: attach role to service account
|
||||
# Enables terraform workflows to use in-cluster auth (K8s API, kubeconfig generation)
|
||||
resource "kubernetes_cluster_role_binding" "terraform_ci" {
|
||||
metadata {
|
||||
name = "terraform-ci"
|
||||
}
|
||||
|
||||
role_ref {
|
||||
api_group = "rbac.authorization.k8s.io"
|
||||
kind = "ClusterRole"
|
||||
name = kubernetes_cluster_role.terraform_ci.metadata[0].name
|
||||
}
|
||||
|
||||
subject {
|
||||
kind = "ServiceAccount"
|
||||
name = kubernetes_service_account.terraform_ci.metadata[0].name
|
||||
namespace = "cicd"
|
||||
}
|
||||
}
|
||||
+4
-66
@@ -21,72 +21,10 @@ resource "kubernetes_storage_class" "longhorn_xfs" {
|
||||
}
|
||||
}
|
||||
|
||||
resource "helm_release" "minio" {
|
||||
name = "minio"
|
||||
repository = "https://charts.min.io/"
|
||||
chart = "minio"
|
||||
version = "5.4.0"
|
||||
namespace = "storage"
|
||||
upgrade_install = true
|
||||
force_update = true
|
||||
wait = true
|
||||
timeout = 600
|
||||
|
||||
values = [
|
||||
yamlencode({
|
||||
mode = "standalone"
|
||||
replicas = 1
|
||||
drivesPerNode = 1
|
||||
pools = 1
|
||||
|
||||
rootUser = "minioadmin"
|
||||
rootPassword = var.minio_root_password
|
||||
|
||||
persistence = {
|
||||
enabled = true
|
||||
size = "100Gi"
|
||||
storageClass = kubernetes_storage_class.longhorn_xfs.metadata[0].name
|
||||
accessMode = "ReadWriteOnce"
|
||||
}
|
||||
|
||||
resources = {
|
||||
requests = {
|
||||
memory = "512Mi"
|
||||
}
|
||||
}
|
||||
|
||||
service = {
|
||||
type = "ClusterIP"
|
||||
port = "9000"
|
||||
}
|
||||
consoleService = {
|
||||
type = "ClusterIP"
|
||||
port = "9001"
|
||||
}
|
||||
|
||||
# Buckets auto-created on install (all-in-one, no post-hook needed)
|
||||
buckets = [
|
||||
{ name = "terraform-state", policy = "none", purge = false },
|
||||
{ name = "vault", policy = "none", purge = false },
|
||||
{ name = "riotpiao-models", policy = "none", purge = false },
|
||||
{ name = "loki-chunks", policy = "none", purge = false },
|
||||
{ name = "loki-ruler", policy = "none", purge = false },
|
||||
{ name = "loki-admin", policy = "none", purge = false },
|
||||
{ name = "loki-index", policy = "none", purge = false },
|
||||
]
|
||||
|
||||
environment = {
|
||||
MINIO_IDENTITY_OPENID_CONFIG_URL = "https://authentik.riotpiao.homelab.com/application/o/minio/.well-known/openid-configuration"
|
||||
MINIO_IDENTITY_OPENID_CLIENT_ID = "minio"
|
||||
MINIO_IDENTITY_OPENID_CLIENT_SECRET = var.minio_oidc_client_secret
|
||||
MINIO_IDENTITY_OPENID_CLAIM_NAME = "policy"
|
||||
MINIO_IDENTITY_OPENID_SCOPES = "openid,profile,email,minio"
|
||||
MINIO_IDENTITY_OPENID_REDIRECT_URI = "https://minio.riotpiao.homelab.com/oauth_callback"
|
||||
MINIO_IDENTITY_OPENID_DISPLAY_NAME = "Authentik"
|
||||
}
|
||||
})
|
||||
]
|
||||
}
|
||||
# MinIO Helm release removed — managed by ArgoCD instead
|
||||
# Reason: MinIO is Terraform state backend (chicken-and-egg problem)
|
||||
# Solution: ArgoCD Application (k8s/argocd/apps/phase0-minio.yaml) handles deployment
|
||||
# Terraform manages everything else, state lives in MinIO (safe external backend)
|
||||
|
||||
variable "create_storage_namespace" {
|
||||
description = "Create storage namespace if it doesn't exist"
|
||||
|
||||
+3
-1
@@ -4,7 +4,9 @@ terraform {
|
||||
bucket = "terraform-state"
|
||||
key = "homelab/terraform.tfstate"
|
||||
region = "us-east-1"
|
||||
endpoint = "https://minio-api.riotpiao.homelab.com"
|
||||
endpoints = {
|
||||
s3 = "https://minio-api.riotpiao.homelab.com"
|
||||
}
|
||||
profile = "minio"
|
||||
skip_credentials_validation = true
|
||||
skip_requesting_account_id = true
|
||||
|
||||
Reference in New Issue
Block a user