Skip to content

Build OVA - Wazuh virtual machines branch 4.10.0 - Launched by @c-bordon #105

Build OVA - Wazuh virtual machines branch 4.10.0 - Launched by @c-bordon

Build OVA - Wazuh virtual machines branch 4.10.0 - Launched by @c-bordon #105

Workflow file for this run

run-name: Build OVA - Wazuh virtual machines branch ${{ inputs.WAZUH_VIRTUAL_MACHINES_REFERENCE }} - Launched by @${{ github.actor }}
name: Build OVA
on:
workflow_dispatch:
inputs:
WAZUH_VIRTUAL_MACHINES_REFERENCE:
description: 'Branch or tag of the wazuh-virtual-machines repository'
required: true
default: '4.10.0'
WAZUH_INSTALLATION_ASSISTANT_REFERENCE:
description: 'Branch or tag of the wazuh-installation-assistant repository'
required: true
default: '4.10.0'
WAZUH_AUTOMATION_REFERENCE:
description: 'Branch or tag of the wazuh-automation repository'
required: true
default: '4.10.0'
WAZUH_PACKAGE_REPOSITORY:
type: choice
description: 'Wazuh package repository from which to download the packages'
required: true
options:
- prod
- dev
- staging
S3_REPOSITORY:
type: choice
description: 'packages-dev repository to upload the OVA'
required: true
options:
- pre-release
- staging
DEBUG:
type: choice
description: 'Debug mode'
required: false
options:
- -v
- -vv
- -vvv
env:
COMPOSITE_NAME: "linux-amazon-2-amd64"
TEMPORAL_S3_BUCKET: "warehouse.wazuh.com"
S3_BUCKET: "packages-dev.wazuh.com"
OVA_ENVIRONMENT: "vmware"
CONTAINER_FORMAT: "ova"
TEMPORAL_S3_PATH: "trash/vm"
permissions:
id-token: write # This is required for requesting the JWT
contents: read # This is required for actions/checkout
jobs:
build_and_run:
runs-on: ubuntu-latest
steps:
- name: Install Ansible
run: sudo apt-get update && sudo apt install -y python3 jq && python3 -m pip install --user ansible-core==2.16
- name: Checkout code
uses: actions/checkout@v4
- name: Setting FILENAME var
run: |
WAZUH_VERSION=$(cat VERSION)
echo "WAZUH_VERSION=$WAZUH_VERSION" >> $GITHUB_ENV
FILENAME="wazuh-${WAZUH_VERSION}"
echo "FILENAME=$FILENAME" >> $GITHUB_ENV
FILENAME_OVA="${FILENAME}.ova"
echo "FILENAME_OVA=$FILENAME_OVA" >> $GITHUB_ENV
FILENAME_SHA="${FILENAME}.sha512"
echo "FILENAME_SHA=$FILENAME_SHA" >> $GITHUB_ENV
- name: View parameters
run: echo "${{ toJson(inputs) }}"
- name: configure aws credentials
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: ${{ secrets.AWS_IAM_OVA_ROLE }}
role-session-name: "OVA-Builder"
aws-region: "us-east-1"
role-duration-seconds: 10800 # Set the duration of the role session to 3 hours
- name: Checkout wazuh/wazuh-automation repository
uses: actions/checkout@v4
with:
repository: wazuh/wazuh-automation
ref: ${{ inputs.WAZUH_AUTOMATION_REFERENCE }}
token: ${{ secrets.GH_CLONE_TOKEN }}
path: wazuh-automation
- name: Install and set allocator requirements
run: |
pip3 install -r wazuh-automation/deployability/deps/requirements.txt
- name: Execute allocator module and set ssh variables to create OVA VM
id: alloc_vm_ova
run: |
python3 wazuh-automation/deployability/modules/allocation/main.py --action create --provider aws --size large --composite-name ${{ env.COMPOSITE_NAME }} --working-dir /tmp/allocatorvm_ova \
--track-output /tmp/allocatorvm_ova/track.yml --inventory-output /tmp/allocatorvm_ova/inventory.yml --instance-name gha_${{ github.run_id }}_ova_build \
--label-team devops --label-termination-date 1d
sed 's/: */=/g' /tmp/allocatorvm_ova/inventory.yml > /tmp/allocatorvm_ova/inventory_mod.yml
sed -i 's/-o StrictHostKeyChecking=no/\"-o StrictHostKeyChecking=no\"/g' /tmp/allocatorvm_ova/inventory_mod.yml
source /tmp/allocatorvm_ova/inventory_mod.yml
echo "[gha_instance]" > /tmp/allocatorvm_ova/inventory
echo "$ansible_host ansible_port=$ansible_port ansible_user=$ansible_user ansible_ssh_private_key_file=$ansible_ssh_private_key_file ansible_ssh_common_args='$ansible_ssh_common_args'" >> /tmp/allocatorvm_ova/inventory
echo "ansible_ssh_private_key_file=$ansible_ssh_private_key_file" >> $GITHUB_ENV;
- name: Run Ansible playbook to configure wazuh-user user
run: |
ansible-playbook -i /tmp/allocatorvm_ova/inventory .github/workflows/ansible_playbooks/ova_user_configuration.yaml ${{ inputs.DEBUG }}
- name: Update inventory with wazuh-user
run: |
sed -i 's|ec2-user|wazuh-user|g' /tmp/allocatorvm_ova/inventory
sed -i 's|ansible_ssh_private_key_file=${{ env.ansible_ssh_private_key_file }}||g' /tmp/allocatorvm_ova/inventory
sed -i '${s/$/ ansible_password=wazuh/}' /tmp/allocatorvm_ova/inventory
- name: Run Ansible playbook to generate the OVA
run: |
if [ "${{ inputs.WAZUH_PACKAGE_REPOSITORY }}" == "prod" ]; then
builder_args="-i"
elif [ "${{ inputs.WAZUH_PACKAGE_REPOSITORY }}" == "staging" ]; then
builder_args="-i -d staging"
elif [ "${{ inputs.WAZUH_PACKAGE_REPOSITORY }}" == "dev" ]; then
builder_args="-i -d"
fi
ansible-playbook -i /tmp/allocatorvm_ova/inventory .github/workflows/ansible_playbooks/ova_generator.yaml \
--extra-vars " \
wia_branch=${{ inputs.WAZUH_INSTALLATION_ASSISTANT_REFERENCE }} \
ova_branch=${{ inputs.WAZUH_VIRTUAL_MACHINES_REFERENCE }} \
repository=${{ inputs.WAZUH_PACKAGE_REPOSITORY }} \
builder_args='$builder_args' \
debug=yes" ${{ inputs.DEBUG }}
- name: Export Instance to create OVA
run: |
ID=$(grep -oP '^identifier: \K.*' /tmp/allocatorvm_ova/track.yml)
EXPORT=$(aws ec2 create-instance-export-task --instance-id "${ID}" --target-environment vmware \
--export-to-s3-task "ContainerFormat=${{ env.CONTAINER_FORMAT }},DiskImageFormat=VMDK,S3Bucket=${{ env.TEMPORAL_S3_BUCKET }},S3Prefix=${{ env.TEMPORAL_S3_PATH }}/${{ env.FILENAME }}")
EXPORT_ID=$(echo ${EXPORT} | jq -r '.ExportTask.ExportTaskId')
echo "EXPORT_ID=${EXPORT_ID}" >> $GITHUB_ENV
- name: Wait for export OVA
run: |
MAX_RETRIES=40
NUM_RETRIES=0
while true; do
STATUS=$(aws ec2 describe-export-tasks --export-task-ids ${{ env.EXPORT_ID }} | jq -r '.ExportTasks[0].State')
if [ "${STATUS}" == "completed" ]; then
break
fi
sleep 270
NUM_RETRIES=$((NUM_RETRIES+1))
if [ ${NUM_RETRIES} -eq ${MAX_RETRIES} ]; then
echo "Error exporting OVA"
exit 1
fi
done
- name: Getting OVA from temporal bucket
run: |
aws s3 --quiet cp "s3://${{ env.TEMPORAL_S3_BUCKET }}/${{ env.TEMPORAL_S3_PATH }}/${{ env.FILENAME }}${{ env.EXPORT_ID }}.ova" /tmp/${{ env.FILENAME_OVA }}
- name: Standarizing OVA
run: |
sed -i "s|ovf:capacity=\"40\"|ovf:capacity=\"50\"|g" ova/wazuh_ovf_template
bash ova/setOVADefault.sh "ova/" "/tmp/${{ env.FILENAME_OVA }}" "/tmp/${{ env.FILENAME_OVA }}" "ova/wazuh_ovf_template" "${{ env.WAZUH_VERSION }}"
- name: Exporting OVA to final repository
run: |
aws s3 cp --quiet --acl public-read /tmp/${{ env.FILENAME_OVA }} s3://${{ env.S3_BUCKET }}/${{ inputs.S3_REPOSITORY }}/vm/${{ env.FILENAME_OVA }}
- name: Generating sha512 file
run: |
sha512sum /tmp/${{ env.FILENAME_OVA }} > /tmp/${{ env.FILENAME_SHA }}
aws s3 cp --quiet --acl public-read /tmp/${{ env.FILENAME_SHA }} s3://${{ env.S3_BUCKET }}/${{ inputs.S3_REPOSITORY }}/checksums/wazuh/${{ env.WAZUH_VERSION }}/${{ env.FILENAME_SHA }}
- name: Removing temporal files
run: |
aws s3 rm --quiet s3://${{ env.TEMPORAL_S3_BUCKET }}/${{ env.TEMPORAL_S3_PATH }}/${{ env.FILENAME }}${{ env.EXPORT_ID }}.ova
- name: Delete allocated VM
if: always() && steps.alloc_vm_ova.outcome == 'success'
run: |
python3 wazuh-automation/deployability/modules/allocation/main.py --action delete --track-output /tmp/allocatorvm_ova/track.yml