Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DOE-354 Add encryption to Terraform plan #major #11

Merged
merged 8 commits into from
Dec 11, 2024
Merged

DOE-354 Add encryption to Terraform plan #major #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
4586d89
DOE-354 Add encryption to Terraform plan
ntse Dec 6, 2024
c47754c
Use correct working directory
ntse Dec 6, 2024
9c52fc4
Add encryption passphrase secret to terraform core
ntse Dec 6, 2024
7e22ecb
Add ENC passphrase
ntse Dec 6, 2024
c1a94ff
Use GPG to encrypt
ntse Dec 6, 2024
1cfb618
decrypt during decrypt step
ntse Dec 6, 2024
d81fb25
tfplan gpg
ntse Dec 6, 2024
e5920d4
Correct encrypt command
ntse Dec 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .github/workflows/_test-terraform-destroy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,4 +28,5 @@ jobs:
REPO_SSH_DEPLOY_KEY: ${{ secrets.SSH_DEPLOY_KEY }}
AWS_ACCOUNT_ID: ${{ secrets.TEST_AWS_ACCOUNT_ID }}
AWS_ROLE_NAME: ${{ secrets.TEST_AWS_ROLE_NAME }}
TF_MODULES_SSH_DEPLOY_KEY: ${{ secrets.TF_MODULES_SSH_DEPLOY_KEY }}
TF_MODULES_SSH_DEPLOY_KEY: ${{ secrets.TF_MODULES_SSH_DEPLOY_KEY }}
TF_PLAN_ENCRYPTION_PASSPHRASE: ${{ secrets.TF_PLAN_ENCRYPTION_PASSPHRASE }}
3 changes: 2 additions & 1 deletion .github/workflows/_test-terraform-plan-apply.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,4 +31,5 @@ jobs:
REPO_SSH_DEPLOY_KEY: ${{ secrets.SSH_DEPLOY_KEY }}
AWS_ACCOUNT_ID: ${{ secrets.TEST_AWS_ACCOUNT_ID }}
AWS_ROLE_NAME: ${{ secrets.TEST_AWS_ROLE_NAME }}
TF_MODULES_SSH_DEPLOY_KEY: ${{ secrets.TF_MODULES_SSH_DEPLOY_KEY }}
TF_MODULES_SSH_DEPLOY_KEY: ${{ secrets.TF_MODULES_SSH_DEPLOY_KEY }}
TF_PLAN_ENCRYPTION_PASSPHRASE: ${{ secrets.TF_PLAN_ENCRYPTION_PASSPHRASE }}
24 changes: 23 additions & 1 deletion .github/workflows/terraform-core.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,9 @@ on:
SSH_DEPLOY_KEY:
required: false
description: "Deprecated: Use either TF_MODULES_SSH_DEPLOY_KEY or REPO_SSH_DEPLOY_KEY instead."
TF_PLAN_ENCRYPTION_PASSPHRASE:
required: true
description: "The passphrase used to encrypt Terraform Plans before uploading them as Github Artifacts"

jobs:
initialise:
Expand Down Expand Up @@ -311,6 +314,16 @@ jobs:
name: "${{ env.state_name }}-artefacts"
path: ${{ matrix.stack.directory }}

- name: Decrypt Terraform plan
if: steps.download_plan.conclusion == 'success'
working-directory: "${{ matrix.stack.directory }}"
env:
ENCRYPTION_PASSPHRASE: ${{ secrets.TF_PLAN_ENCRYPTION_PASSPHRASE }}
run: |
pass_file=$(mktemp)
printf "%s" "$ENCRYPTION_PASSPHRASE" > "$pass_file"
gpg --decrypt --batch --passphrase-file "$pass_file" --out tfplan tfplan.gpg

- name: Terraform Plan
id: tf_plan
working-directory: "${{ matrix.stack.directory }}"
Expand Down Expand Up @@ -399,13 +412,22 @@ jobs:

cat updated_matrix.json

- name: Encrypt Terraform plan
env:
ENCRYPTION_PASSPHRASE: ${{ secrets.TF_PLAN_ENCRYPTION_PASSPHRASE }}
working-directory: "${{ matrix.stack.directory }}"
run: |
pass_file=$(mktemp)
printf "%s" "$ENCRYPTION_PASSPHRASE" > "$pass_file"
gpg --batch --symmetric --passphrase-file "$pass_file" tfplan

- name: Upload Terraform Plan and matrix
uses: actions/upload-artifact@v4
if: ${{ inputs.upload_plan }}
with:
name: "${{ env.state_name }}-artefacts"
path: |
${{ matrix.stack.directory }}/tfplan*
${{ matrix.stack.directory }}/tfplan.gpg
${{ matrix.stack.directory }}/updated_matrix.json
if-no-files-found: warn
compression-level: 1
Expand Down
5 changes: 4 additions & 1 deletion .github/workflows/terraform-destroy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,10 @@ on:
SSH_DEPLOY_KEY:
required: false
description: "Deprecated: Use either TF_MODULES_SSH_DEPLOY_KEY or REPO_SSH_DEPLOY_KEY instead."

TF_PLAN_ENCRYPTION_PASSPHRASE:
required: true
description: "The passphrase used to encrypt Terraform Plans before uploading them as Github Artifacts"

jobs:
define_matrix:
name: Define directory matrix for destroy
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/terraform-plan-apply.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,10 @@ on:
SSH_DEPLOY_KEY:
required: false
description: "Deprecated: Use either TF_MODULES_SSH_DEPLOY_KEY or REPO_SSH_DEPLOY_KEY instead."
TF_PLAN_ENCRYPTION_PASSPHRASE:
required: true
description: "The passphrase used to encrypt Terraform Plans before uploading them as Github Artifacts"


jobs:
define_matrix:
Expand Down
Loading