Story Crater Bot
e71c7ad37e
- Create Phase 4 ArgoCD Application (terraform-apply) - PostSync Hook Job runs: terraform init && terraform apply -auto-approve - ServiceAccount + ClusterRole for cluster-admin RBAC - S3 credentials encrypted with SOPS (terraform-s3-secrets.enc.yaml) - Pre-commit hook blocks local 'terraform apply' — all changes via git push - True IaC: modify terraform/*.tf → git push → ArgoCD applies automatically
69 lines
1.9 KiB
YAML
69 lines
1.9 KiB
YAML
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: terraform-apply
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/hook: PostSync
|
|
argocd.argoproj.io/hook-delete-policy: HookSucceeded
|
|
spec:
|
|
backoffLimit: 3
|
|
template:
|
|
spec:
|
|
serviceAccountName: terraform-apply
|
|
containers:
|
|
- name: terraform
|
|
image: hashicorp/terraform:latest
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
set -e
|
|
|
|
echo "=== Terraform Apply Hook (ArgoCD PostSync) ==="
|
|
|
|
# Clone repo
|
|
git clone --depth 1 https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git /repo
|
|
cd /repo/terraform
|
|
|
|
# Set S3 credentials
|
|
export AWS_ACCESS_KEY_ID=$(cat /run/secrets/s3/AWS_ACCESS_KEY_ID)
|
|
export AWS_SECRET_ACCESS_KEY=$(cat /run/secrets/s3/AWS_SECRET_ACCESS_KEY)
|
|
export AWS_ENDPOINT_URL=$(cat /run/secrets/s3/AWS_ENDPOINT_URL)
|
|
|
|
# Initialize and apply
|
|
echo "Initializing Terraform..."
|
|
terraform init
|
|
|
|
echo "Planning Terraform changes..."
|
|
terraform plan -out=tfplan
|
|
|
|
echo "Applying Terraform..."
|
|
terraform apply -auto-approve tfplan
|
|
|
|
echo "✓ Terraform apply complete"
|
|
volumeMounts:
|
|
- name: s3-creds
|
|
mountPath: /run/secrets/s3
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
memory: "256Mi"
|
|
cpu: "250m"
|
|
limits:
|
|
memory: "1Gi"
|
|
cpu: "1"
|
|
volumes:
|
|
- name: s3-creds
|
|
projected:
|
|
sources:
|
|
- secret:
|
|
name: terraform-s3-creds
|
|
items:
|
|
- key: AWS_ACCESS_KEY_ID
|
|
path: AWS_ACCESS_KEY_ID
|
|
- key: AWS_SECRET_ACCESS_KEY
|
|
path: AWS_SECRET_ACCESS_KEY
|
|
- key: AWS_ENDPOINT_URL
|
|
path: AWS_ENDPOINT_URL
|
|
restartPolicy: Never
|