feat(ci): add dagger yamllint and kubeconform tasks

Smana · Jun 14, 2024 · 60190e4 · 60190e4
1 parent 48b7473
commit 60190e4
Show file tree

Hide file tree

Showing 14 changed files with 509 additions and 552 deletions.
diff --git a/.github/workflows/dagger.yaml b/.github/workflows/dagger.yaml
@@ -0,0 +1,36 @@
+name: dagger
+on:
+  push:
+    branches: ["*"]
+
+jobs:
+  build:
+    name: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      #   - name: Yaml lint
+      #     uses: dagger/dagger-for-github@v5
+      #     with:
+      #       version: "latest"
+      #       verb: call
+      #       module: github.com/tsirysndr/daggerverse/yamllint
+      #       args: lint --src .
+
+      - name: Validate Flux clusters manifests
+        uses: dagger/dagger-for-github@v5
+        with:
+          version: "latest"
+          verb: call
+          module: github.com/Smana/daggerverse/kubeconform@kubeconform/v0.0.4
+          args: validate --manifests "./clusters" --catalog
+
+      - name: Validate Kubernetes manifests (Kustomize directories)
+        uses: dagger/dagger-for-github@v5
+        with:
+          version: "latest"
+          verb: call
+          module: github.com/Smana/daggerverse/kubeconform@kubeconform/v0.0.4
+          args: validate --manifests "." --kustomize --flux --env="cluster_name=foobar,region=eu-west-3,domain_name=example.com" --catalog --crds https://github.com/kubernetes-sigs/gateway-api/tree/main/config/crd
diff --git a/.github/workflows/manifests.yaml b/.github/workflows/manifests.yaml
diff --git a/.github/workflows/pr-agent.yaml b/.github/workflows/pr-agent.yaml
@@ -15,4 +15,4 @@ jobs:
         uses: Codium-ai/pr-agent@main
         env:
           OPENAI_KEY: ${{ secrets.OPENAI_KEY }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.yamllint b/.yamllint
@@ -0,0 +1,14 @@
+---
+extends: default
+
+rules:
+  comments-indentation:
+    level: error
+  indentation:
+    indent-sequences: consistent
+    spaces: 2
+    check-multi-line-strings: false
+  line-length: disable
+  document-start: disable
+  comments: disable
+  truthy: disable
diff --git a/scripts/validate.sh b/scripts/validate.sh
diff --git a/security/base/epis/cert-manager.yaml b/security/base/epis/cert-manager.yaml
@@ -1,36 +1,36 @@
 apiVersion: cloud.ogenki.io/v1alpha1
 kind: EPI
 metadata:
-    name: xplane-cert-manager-${cluster_name}
-    namespace: security
+  name: xplane-cert-manager-${cluster_name}
+  namespace: security
 spec:
-    parameters:
-        clusterName: ${cluster_name}
-        serviceAccount:
-            name: cert-manager
-            namespace: security
-        # Reference: https://cert-manager.io/docs/configuration/acme/dns01/route53/
-        policyDocument: |
-            {
-            "Version": "2012-10-17",
-            "Statement": [
-                {
-                "Effect": "Allow",
-                "Action": "route53:GetChange",
-                "Resource": "arn:aws:route53:::change/*"
-                },
-                {
-                "Effect": "Allow",
-                "Action": [
-                    "route53:ChangeResourceRecordSets",
-                    "route53:ListResourceRecordSets"
-                ],
-                "Resource": "arn:aws:route53:::hostedzone/*"
-                },
-                {
-                "Effect": "Allow",
-                "Action": "route53:ListHostedZonesByName",
-                "Resource": "*"
-                }
-            ]
-            }
+  parameters:
+    clusterName: ${cluster_name}
+    serviceAccount:
+      name: cert-manager
+      namespace: security
+    # Reference: https://cert-manager.io/docs/configuration/acme/dns01/route53/
+    policyDocument: |
+      {
+      "Version": "2012-10-17",
+      "Statement": [
+          {
+          "Effect": "Allow",
+          "Action": "route53:GetChange",
+          "Resource": "arn:aws:route53:::change/*"
+          },
+          {
+          "Effect": "Allow",
+          "Action": [
+              "route53:ChangeResourceRecordSets",
+              "route53:ListResourceRecordSets"
+          ],
+          "Resource": "arn:aws:route53:::hostedzone/*"
+          },
+          {
+          "Effect": "Allow",
+          "Action": "route53:ListHostedZonesByName",
+          "Resource": "*"
+          }
+      ]
+      }
diff --git a/security/base/epis/external-dns.yaml b/security/base/epis/external-dns.yaml
@@ -1,38 +1,38 @@
 apiVersion: cloud.ogenki.io/v1alpha1
 kind: EPI
 metadata:
-    name: xplane-external-dns-${cluster_name}
-    namespace: kube-system
+  name: xplane-external-dns-${cluster_name}
+  namespace: kube-system
 spec:
-    deletionPolicy: Delete
-    parameters:
-        clusterName: ${cluster_name}
-        serviceAccount:
-            name: external-dns
-            namespace: kube-system
-        # Reference: https://kubernetes-sigs.github.io/external-dns/v0.13.4/tutorials/aws/#iam-policy
-        policyDocument: |
-            {
-                "Version": "2012-10-17",
-                "Statement": [
-                    {
-                        "Effect": "Allow",
-                        "Action": [
-                            "route53:ChangeResourceRecordSets"
-                        ],
-                        "Resource": [
-                            "arn:aws:route53:::hostedzone/*"
-                        ]
-                    },
-                    {
-                        "Effect": "Allow",
-                        "Action": [
-                            "route53:ListHostedZones",
-                            "route53:ListResourceRecordSets"
-                        ],
-                        "Resource": [
-                            "*"
-                        ]
-                    }
-                ]
-            }
+  deletionPolicy: Delete
+  parameters:
+    clusterName: ${cluster_name}
+    serviceAccount:
+      name: external-dns
+      namespace: kube-system
+    # Reference: https://kubernetes-sigs.github.io/external-dns/v0.13.4/tutorials/aws/#iam-policy
+    policyDocument: |
+      {
+          "Version": "2012-10-17",
+          "Statement": [
+              {
+                  "Effect": "Allow",
+                  "Action": [
+                      "route53:ChangeResourceRecordSets"
+                  ],
+                  "Resource": [
+                      "arn:aws:route53:::hostedzone/*"
+                  ]
+              },
+              {
+                  "Effect": "Allow",
+                  "Action": [
+                      "route53:ListHostedZones",
+                      "route53:ListResourceRecordSets"
+                  ],
+                  "Resource": [
+                      "*"
+                  ]
+              }
+          ]
+      }
diff --git a/security/base/epis/external-secrets.yaml b/security/base/epis/external-secrets.yaml
@@ -1,30 +1,30 @@
 apiVersion: cloud.ogenki.io/v1alpha1
 kind: EPI
 metadata:
-    name: xplane-external-secrets-${cluster_name}
-    namespace: security
+  name: xplane-external-secrets-${cluster_name}
+  namespace: security
 spec:
-    parameters:
-        clusterName: ${cluster_name}
-        serviceAccount:
-            name: external-secrets
-            namespace: security
-        # Reference: https://github.com/external-secrets/external-secrets/blob/main/terraform/aws/modules/cluster/irsa.tf
-        policyDocument: |
-            {
-                "Version": "2012-10-17",
-                "Statement": [
-                    {
-                        "Effect": "Allow",
-                        "Action": [
-                            "secretsmanager:GetResourcePolicy",
-                            "secretsmanager:GetSecretValue",
-                            "secretsmanager:DescribeSecret",
-                            "secretsmanager:ListSecretVersionIds"
-                        ],
-                        "Resource": [
-                            "*"
-                        ]
-                    }
-                ]
-            }
+  parameters:
+    clusterName: ${cluster_name}
+    serviceAccount:
+      name: external-secrets
+      namespace: security
+    # Reference: https://github.com/external-secrets/external-secrets/blob/main/terraform/aws/modules/cluster/irsa.tf
+    policyDocument: |
+      {
+          "Version": "2012-10-17",
+          "Statement": [
+              {
+                  "Effect": "Allow",
+                  "Action": [
+                      "secretsmanager:GetResourcePolicy",
+                      "secretsmanager:GetSecretValue",
+                      "secretsmanager:DescribeSecret",
+                      "secretsmanager:ListSecretVersionIds"
+                  ],
+                  "Resource": [
+                      "*"
+                  ]
+              }
+          ]
+      }