Created placeholder for future folder structure

README.md

@@ -0,0 +1,37 @@
+# Terraform-Ansible-Helm Deployer
+[![Super-Linter](https://github.com/doddophonique/tah-deploy/actions/workflows/super-linter.yml/badge.svg)](https://github.com/marketplace/actions/super-linter)
+## Usage
+From the `terraform/` folder:
+```shell
+terraform init
+terraform plan
+terraform apply
+```
+
+## Decisions and goals
+The `terraform-provider-libvirt` has been chosen over Vagrant to deploy the VMs as a way to simplify the structure of the project. The choice over a cloud provider such as AWS or GCP has been done to not incur into billing cost during troubleshooting and deployments.
+### Terraform script
+The Terraform script roughly follows these steps:
+  1. Deploy 3 VMs (one master and two workers) with:
+     - 2 vCPUs;
+     - 2GB vRAM;
+     - 20GB of disk space;
+     - Ubuntu 24.04 LTS;
+     - An Ansible user.
+  2. Call an Ansible Playbook that:
+     1. Configures the master node and installs Kubernetes;
+     2. Configures the network for the Kubernetes cluster;
+     3. Configures the worker nodes and installs Kubernetes.
+  3. Create the `kiratech-test` namespace;
+  4. Run the CIS Kubernetes benchmark;
+  5. Copy the helm folder to the master node and install helm.
+### Next steps
+The script currently lacks:
+- [ ] Capability of deploying an Helm application;
+- [ ] Usage of Terraform outputs to populate Ansible files;
+
+### CIS Kubernetes Benchmark
+The CIS Benchamrk is one of (if not the) most popular benchmarks publicly available, and also has a simple way to implement it in a deployment pipeline using the [kube-bench](https://github.com/aquasecurity/kube-bench) implementation.
+
+## Linting
+The project uses GitHub Actions as a CI tool, running [super-linter](https://github.com/super-linter/super-linter) on the entire codebase.

terraform/main.tf

@@ -170,7 +170,7 @@ resource null_resource run_ansible {
     depends_on = [ 
       libvirt_domain.k8s_masters,
       libvirt_domain.k8s_workers
- ]     
+    ]     
 
     provisioner "local-exec" {
         command = "ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook -vvv -i ../ansible/inventory.ini ../ansible/k8s.yml -K"
@@ -180,15 +180,60 @@ resource null_resource run_ansible {
 resource null_resource create_namespace {
     depends_on = [ 
       null_resource.run_ansible
- ]
+    ]
     provisioner "remote-exec"  {
       inline = ["sudo mkdir ~/.kube", "sudo cp /etc/kubernetes/admin.conf ~/.kube/", "sudo mv ~/.kube/admin.conf ~/.kube/config", "sudo service kubelet restart", "sudo kubectl --kubeconfig ~/.kube/config create namespace kiratech-test"]
 
       connection {
           host        = libvirt_domain.k8s_masters[0].network_interface[0].addresses[0]
-		  type        = "ssh"
+          type        = "ssh"
           user        = "ansible"
           private_key = data.template_file.private_key.rendered
       } 
     }
 }
+
+resource null_resource run_benchmark {
+    depends_on = [  
+      null_resource.create_namespace
+    ] 
+    provisioner "remote-exec" {
+        inline = ["curl https://raw.githubusercontent.com/aquasecurity/kube-bench/refs/heads/main/job-master.yaml > job-master.yaml", "kubectl --kubeconfig ~/.kube/config apply -f job-master.yaml", "rm job-master.yaml"]
+        
+        
+        connection {
+            host        = libvirt_domain.k8s_masters[0].network_interface[0].addresses[0]
+	        type        = "ssh"
+            user        = "ansible"
+            private_key = data.template_file.private_key.rendered
+        } 
+    }
+}
+
+resource null_resource deploy_helm {
+    depends_on = [
+      null_resource.run_benchmark
+    ]
+    
+    provisioner "local-exec" {
+        command = "scp -i ${path.module}/.local/.ssh/id_rsa -r ../helm ansible@${libvirt_domain.k8s_masters[0].network_interface[0].addresses[0]}:/home/ansible/helm"
+    }
+    # https://helm.sh/docs/intro/install/#from-apt-debianubuntu
+    provisioner "remote-exec" {
+        inline = [
+          "curl https://baltocdn.com/helm/signing.asc | gpg --dearmor | sudo tee /usr/share/keyrings/helm.gpg > /dev/null",
+          "sudo apt-get install apt-transport-https --yes",
+          "echo \"deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/helm.gpg] https://baltocdn.com/helm/stable/debian/ all main\" | sudo tee /etc/apt/sources.list.d/helm-stable-debian.list",
+          "sudo apt-get update",
+          "sudo apt-get install helm"
+        ]
+            
+               
+        connection {
+            host        = libvirt_domain.k8s_masters[0].network_interface[0].addresses[0]
+	        type        = "ssh"
+            user        = "ansible"
+            private_key = data.template_file.private_key.rendered
+        } 
+    }
+}