Ben Vincent
054110d748
terragrunt-enc is the single source of truth for encapi ENC data (Puppet statuses, roles, and node classifications), managed with Terraform/Terragrunt. It supersedes Cobbler classification for Puppet and the terraform-incus dual-write prototype (PR #39). - Add modules/encapi (encapi_status / encapi_role / encapi_node, nodes FK-ordered after their role and status). - Add config/encapi leaf: 3 statuses, 51 roles, and 143 node assignments (130 container VMs env production + 13 prodnxsr physicals env develop), all YAML-driven. - Add config/root.hcl (consul backend infra/terraform/enc/<leaf>/state) and the encapi provider from the artifactapi registry (v0.1.0). - Add Makefile, Woodpecker pre-commit/plan/apply pipelines, pre-commit config, ci/extract_incus_nodes.py, and expand the README.
52 lines
1.7 KiB
Makefile
52 lines
1.7 KiB
Makefile
.PHONY: init plan apply apply-if-changes format pre-commit
|
|
|
|
VAULT_AUTH_METHOD ?= approle
|
|
VAULT_K8S_ROLE ?= woodpecker_terraform_enc
|
|
VAULT_K8S_MOUNT ?= auth/k8s/au/syd1
|
|
VAULT_K8S_JWT_PATH ?= /var/run/secrets/kubernetes.io/serviceaccount/token
|
|
|
|
define vault_env
|
|
@export VAULT_ADDR="https://vault.service.consul:8200" && \
|
|
if [ "$(VAULT_AUTH_METHOD)" = "kubernetes" ]; then \
|
|
export VAULT_TOKEN=$$(vault write -field=token $(VAULT_K8S_MOUNT)/login role=$(VAULT_K8S_ROLE) jwt=$$(cat $(VAULT_K8S_JWT_PATH))); \
|
|
else \
|
|
export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID); \
|
|
fi && \
|
|
export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-enc) && \
|
|
export ENCAPI_WRITE_TOKEN=$$(vault kv get -field=ENCAPI_WRITE_TOKEN kv/kubernetes/namespace/encapi/default/environment)
|
|
endef
|
|
|
|
init:
|
|
@$(call vault_env) && \
|
|
terragrunt run --all --non-interactive init -- -upgrade
|
|
|
|
plan: init
|
|
@$(call vault_env) && \
|
|
terragrunt run --all --parallelism 4 --non-interactive plan
|
|
|
|
apply-if-changes: init
|
|
@$(call vault_env) && \
|
|
terragrunt run --all --parallelism 4 --non-interactive plan -- -detailed-exitcode -out=tfplan; \
|
|
EXIT_CODE=$$?; \
|
|
if [ $$EXIT_CODE -eq 2 ]; then \
|
|
$(call vault_env) && \
|
|
terragrunt run --all --parallelism 2 --non-interactive apply -- tfplan; \
|
|
elif [ $$EXIT_CODE -eq 0 ]; then \
|
|
echo "No changes detected, skipping apply."; \
|
|
else \
|
|
exit $$EXIT_CODE; \
|
|
fi
|
|
|
|
apply: init
|
|
@$(call vault_env) && \
|
|
terragrunt run --all --parallelism 2 --non-interactive apply
|
|
|
|
format:
|
|
@echo "Formatting OpenTofu files..."
|
|
@tofu fmt -recursive .
|
|
@echo "Formatting Terragrunt files..."
|
|
@terragrunt hcl fmt
|
|
|
|
pre-commit:
|
|
@uvx pre-commit run --all-files
|