Add S3 terraform backend

.github/workflows/ci.yaml

@@ -38,7 +38,7 @@ jobs:
         uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
           python-version: '3.x'
-    
+
       - name: Setup Terraform
         uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
         with:
@@ -66,7 +66,7 @@ jobs:
         run: |
           sudo apt-get install -y shellcheck
           find . -name "*.sh" -print0 | xargs -0 shellcheck
-  
+
       - name: Run terraform fmt
         run: terraform fmt -check -recursive
 
@@ -101,7 +101,7 @@ jobs:
           directory: ./terraform
           output_format: cli,sarif
           output_file_path: console,results.sarif
-        
+
       - name: Upload SARIF file
         uses: github/codeql-action/upload-sarif@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
         with:

.gitignore

@@ -10,3 +10,4 @@ contexts/**/.kube/
 contexts/**/.talos/
 contexts/**/.aws/
 contexts/**/.omni/
+contexts/**/.azure/

Taskfile.yaml

@@ -0,0 +1,7 @@
+version: '3'
+
+tasks:
+  scan:
+    desc: Scan for security vulnerabilities
+    cmds:
+      - source .venv/bin/activate && checkov -d {{.CLI_ARGS | default "terraform/"}} 2>/dev/null

contexts/.gitignore

@@ -0,0 +1 @@
+cloud/

contexts/local/blueprint.yaml

@@ -14,19 +14,24 @@ sources:
   ref:
     branch: main
 terraform:
-- path: cluster/talos
-- path: gitops/flux
+- source: core
+  path: cluster/talos
+- source: core
+  path: gitops/flux
 kustomize:
 - name: policy-base
   path: policy/base
+  source: core
   components:
   - kyverno
 - name: policy-resources
   path: policy/resources
+  source: core
   dependsOn:
   - policy-base
 - name: csi
   path: csi
+  source: core
   dependsOn:
   - policy-resources
   force: true
@@ -35,6 +40,7 @@ kustomize:
   - openebs/dynamic-localpv
 - name: ingress-base
   path: ingress/base
+  source: core
   dependsOn:
   - pki-resources
   force: true
@@ -46,6 +52,7 @@ kustomize:
   - nginx/web
 - name: pki-base
   path: pki/base
+  source: core
   dependsOn:
   - policy-resources
   force: true
@@ -54,6 +61,7 @@ kustomize:
   - trust-manager
 - name: pki-resources
   path: pki/resources
+  source: core
   dependsOn:
   - pki-base
   force: true
@@ -62,6 +70,7 @@ kustomize:
   - public-issuer/selfsigned
 - name: dns
   path: dns
+  source: core
   dependsOn:
   - ingress-base
   - pki-base
@@ -75,13 +84,15 @@ kustomize:
   - external-dns/ingress
 - name: gitops
   path: gitops/flux
+  source: core
   dependsOn:
   - ingress-base
   force: true
   components:
   - webhook
 - name: demo
   path: demo/bookinfo
+  source: core
   dependsOn:
   - ingress-base
   force: true