drone ci service on premises

[Jean-Baptiste-Lasselle]

• https://medium.com/@cogarius/1-3-complete-guide-to-ci-cd-pipelines-with-drone-io-a53daaf28cf6
• create 1 k8s clusters with k3d :
  • one for CI/CD toolchain, :
  • one hashicorp vault, as a top secret manager for the whole CICD toolchain, in the cicd-vault namespace
  • one gitea in the gitea namespace : external access for drone
  • one drone in the drone namespace : external access for gitea webhooks
  • one atlantis service to operate deployment target the gitops way
  • one namespace cicd-dashboard will be dedicated to publishing the hugo-based github pages for each repo , containing the test results reports (its the CICD dashboard, just like the github pages, but a separate hugo git repo) :

add test report published to pull/merge request comments, and generate a hugo website for the github pages of this repo, with the new the test report, docker build the generated hugo website and deploy this new version of the github pages. Add link to the test report page of the gtihub pages website, in the pulll request comments.

• in the .drone.yml pipeline, the deployment target is terraformed using an ansible playbook to tear down setup the k3d cluster, onr the docker compose on the deployment target : so I need a REST API (typescript nodejs) that knows how to create my Virtual box VM (easy I can fork pokus REST API), and use that REST API to implement a Terraform provider.

[Jean-Baptiste-Lasselle]

• generate an SSH keypair, and secue it into HAshicorp vault
• use HashiCorp Packer to manufacture an ISO Image that has the desired OS with OS first user inside, and has the desired SSH public key inside this first user's ~/.ssh/authorized_keys file, see https://www.packer.io/docs/builders/virtualbox/iso . Once the hashicorp packer gets the SSH public key, inside hashicorp vault
• the Terraform provider (with hashicorp vault as secret manager):
  • REST API : very simple just use shelljs (just like pokus) and ./VBoxManage executable (should later add authentication with keycloak OIDC integration, terraform provider will authentifcate to the REST API using Keycloak) :

~/this-is-gravitee$ VBoxManage --version
6.0.16r135674

• Terraform provider : use the ISO image and execute provisioners, using the SSH credentials found in hashicorp vault.

OS must match the OS used on AWS when swiching to AWS deployment target

[Jean-Baptiste-Lasselle]

Useful to try and test everything without any AWS fees to think about.