mirror of
https://github.com/fleetdm/fleet
synced 2026-04-21 13:37:30 +00:00
e952ef06c0
# Github Actions (New)
- New workflow to deploy/destroy loadtest infrastructure with one-click
(Needs to be tested)
- Common inputs drive configuration and deployment of loadtest
infrastructure
- tag
- fleet_task_count
- fleet_task_memory
- fleet_task_cpu
- fleet_database_instance_size
- fleet_database_instance_count
- fleet_redis_instance_size
- fleet_redis_instance_count
- terraform_workspace
- terraform_action
- New workflow to deploy/destroy osquery-perf to loadtest infrastructure
with one-click (Needs to be tested)
- Common inputs drive configuration and deployment of osquery-perf
resources
- tag
- git_branch
- loadtest_containers
- extra_flags
- terraform_workspace
- terraform_action
- New workflow to deploy shared loadtest resources with one-click (Needs
to be tested)
# Loadtest Infrastructure (New)
- New directory (`infrastructure/loadtesting/terraform/infra`) for
one-click deployment
- Loadtest environment updated to use [fleet-terraform
modules](https://github.com/fleetdm/fleet-terraform)
- [Deployment documentation
updated](0c254bca40/infrastructure/loadtesting/terraform/infra/README.md)
to reflect new steps
# Osquery-perf deployment (New)
- New directory (`infrastructure/loadtesting/terraform/osquery-perf`)
for the deployment of osquery-perf
- osquery-perf updated to use [fleet-terraform
modules](https://github.com/fleetdm/fleet-terraform)
- [Deployment documentation
updated](0c254bca40/infrastructure/loadtesting/terraform/osquery_perf)
to reflect new steps
106 lines
2.4 KiB
HCL
106 lines
2.4 KiB
HCL
data "tls_certificate" "github" {
|
|
url = "https://token.actions.githubusercontent.com/.well-known/openid-configuration"
|
|
}
|
|
|
|
/*
|
|
It's possible to use the following to add Github as an OpenID Connect Provider and integrate
|
|
Github Actions as your CI/CD mechanism.
|
|
*/
|
|
|
|
resource "aws_iam_openid_connect_provider" "github" {
|
|
url = "https://token.actions.githubusercontent.com"
|
|
|
|
client_id_list = [
|
|
"sts.amazonaws.com",
|
|
]
|
|
|
|
thumbprint_list = [
|
|
data.tls_certificate.github.certificates[0].sha1_fingerprint
|
|
]
|
|
}
|
|
|
|
resource "aws_iam_role" "gha_role" {
|
|
name = "github-actions-role"
|
|
assume_role_policy = data.aws_iam_policy_document.gha_assume_role.json
|
|
}
|
|
|
|
resource "aws_iam_role_policy" "gha_role_policy" {
|
|
policy = data.aws_iam_policy_document.gha-permissions.json
|
|
role = aws_iam_role.gha_role.id
|
|
}
|
|
|
|
|
|
#####################
|
|
# AssumeRole
|
|
#
|
|
# Allow sts:AssumeRoleWithWebIdentity from GitHub via OIDC
|
|
# Customize your repository
|
|
#####################
|
|
data "aws_iam_policy_document" "gha_assume_role" {
|
|
statement {
|
|
effect = "Allow"
|
|
actions = ["sts:AssumeRoleWithWebIdentity"]
|
|
principals {
|
|
type = "Federated"
|
|
identifiers = [
|
|
"arn:aws:iam::${data.aws_caller_identity.current.account_id}:oidc-provider/token.actions.githubusercontent.com"
|
|
]
|
|
}
|
|
condition {
|
|
test = "StringLike"
|
|
variable = "token.actions.githubusercontent.com:sub"
|
|
values = ["repo:fleetdm/fleet:*"]
|
|
}
|
|
|
|
condition {
|
|
test = "StringEquals"
|
|
variable = "token.actions.githubusercontent.com:aud"
|
|
values = ["sts.amazonaws.com"]
|
|
}
|
|
}
|
|
}
|
|
// Customize the permissions for your deployment
|
|
data "aws_iam_policy_document" "gha-permissions" {
|
|
statement {
|
|
effect = "Allow"
|
|
actions = [
|
|
"ec2:*",
|
|
"cloudwatch:*",
|
|
"s3:*",
|
|
"lambda:*",
|
|
"ecs:*",
|
|
"rds:*",
|
|
"rds-data:*",
|
|
"secretsmanager:*",
|
|
"pi:*",
|
|
"ecr:*",
|
|
"iam:*",
|
|
"aps:*",
|
|
"vpc:*",
|
|
"kms:*",
|
|
"elasticloadbalancing:*",
|
|
"ce:*",
|
|
"cur:*",
|
|
"logs:*",
|
|
"cloudformation:*",
|
|
"ssm:*",
|
|
"sns:*",
|
|
"elasticache:*",
|
|
"application-autoscaling:*",
|
|
"acm:*",
|
|
"route53:*",
|
|
"dynamodb:*",
|
|
"kinesis:*",
|
|
"firehose:*",
|
|
"athena:*",
|
|
"glue:*",
|
|
"ses:*",
|
|
"wafv2:*",
|
|
"events:*",
|
|
"cloudfront:*",
|
|
"backup:*",
|
|
"backup-storage:*"
|
|
]
|
|
resources = ["*"]
|
|
}
|
|
}
|