36454b87d1
- New custom CI Docker image (ci/Dockerfile) with TF 1.5.7, TG 0.99.4, git-crypt, sops, kubectl pre-installed. Pushed to private registry. Eliminates 17 apk add calls + binary downloads per pipeline run. - Unified CI pipeline: merge default.yml + app-stacks.yml into one. Changed-stacks-only detection (git diff, with global-file fallback). Concurrency limit (xargs -P 4). Step consolidation (2 steps vs 4). Shallow clone (depth=2). Provider cache (TF_PLUGIN_CACHE_DIR). - Per-stack Vault advisory locks in scripts/tg. 30min TTL with stale lock detection. Blocks concurrent applies to same stack. - TF_PLUGIN_CACHE_DIR enabled by default in scripts/tg for local dev. - Daily drift detection pipeline (.woodpecker/drift-detection.yml). Runs terraform plan on all stacks, Slack alert on drift. - CI image build pipeline (.woodpecker/build-ci-image.yml). Expected speedup: ~5-10 min per pipeline run → ~2-4 min. [ci skip] Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
80 lines
2.8 KiB
YAML
80 lines
2.8 KiB
YAML
# Daily drift detection — runs terraform plan on all stacks and alerts on drift.
|
|
# Triggered by Woodpecker cron schedule "drift-detection" (must be registered in Woodpecker UI/API).
|
|
|
|
when:
|
|
event: cron
|
|
cron: drift-detection
|
|
|
|
clone:
|
|
git:
|
|
image: woodpeckerci/plugin-git
|
|
settings:
|
|
depth: 1
|
|
attempts: 3
|
|
|
|
steps:
|
|
- name: detect-drift
|
|
image: registry.viktorbarzin.me:5050/infra-ci:latest
|
|
pull: true
|
|
backend_options:
|
|
kubernetes:
|
|
resources:
|
|
requests:
|
|
memory: 2Gi
|
|
limits:
|
|
memory: 4Gi
|
|
environment:
|
|
SLACK_WEBHOOK:
|
|
from_secret: slack_webhook
|
|
commands:
|
|
# ── git-crypt unlock ──
|
|
- |
|
|
SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
|
|
curl -sk "https://10.0.20.100:6443/api/v1/namespaces/woodpecker/configmaps/git-crypt-key" \
|
|
-H "Authorization:Bearer $SA_TOKEN" | jq -r .data.key | base64 -d > /tmp/key
|
|
git-crypt unlock /tmp/key && rm /tmp/key
|
|
|
|
# ── Vault auth ──
|
|
- |
|
|
SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
|
|
export VAULT_ADDR=http://vault-active.vault.svc.cluster.local:8200
|
|
export VAULT_TOKEN=$(curl -s -X POST "$VAULT_ADDR/v1/auth/kubernetes/login" \
|
|
-d "{\"role\":\"ci\",\"jwt\":\"$SA_TOKEN\"}" | jq -r .auth.client_token)
|
|
|
|
# ── Run terraform plan on all stacks ──
|
|
- |
|
|
DRIFTED=""
|
|
CLEAN=0
|
|
ERRORS=""
|
|
|
|
for stack_dir in stacks/*/; do
|
|
stack=$(basename "$stack_dir")
|
|
[ -f "$stack_dir/terragrunt.hcl" ] || continue
|
|
|
|
echo -n "[$stack] planning... "
|
|
OUTPUT=$(cd "$stack_dir" && terragrunt plan -detailed-exitcode -input=false 2>&1)
|
|
EXIT=$?
|
|
|
|
case $EXIT in
|
|
0) echo "OK (no changes)"; CLEAN=$((CLEAN + 1)) ;;
|
|
1) echo "ERROR"; ERRORS="$ERRORS $stack" ;;
|
|
2) echo "DRIFT DETECTED"; DRIFTED="$DRIFTED $stack" ;;
|
|
esac
|
|
done
|
|
|
|
echo ""
|
|
echo "=== Drift Detection Summary ==="
|
|
echo "Clean: $CLEAN stacks"
|
|
echo "Drift: ${DRIFTED:-none}"
|
|
echo "Errors: ${ERRORS:-none}"
|
|
|
|
# ── Slack alert if drift found ──
|
|
if [ -n "$DRIFTED" ]; then
|
|
curl -s -X POST -H 'Content-type: application/json' \
|
|
--data "{\"channel\":\"general\",\"text\":\":warning: Drift detected in:${DRIFTED}\nClean: ${CLEAN} stacks. Errors:${ERRORS:-none}\"}" \
|
|
"$SLACK_WEBHOOK" || true
|
|
else
|
|
curl -s -X POST -H 'Content-type: application/json' \
|
|
--data "{\"channel\":\"general\",\"text\":\":white_check_mark: Drift detection: all ${CLEAN} stacks clean${ERRORS:+. Errors: $ERRORS}\"}" \
|
|
"$SLACK_WEBHOOK" || true
|
|
fi
|