Skip to content

Commit 1ec463b

Browse files
author
Gordon Byers
authored
Merge pull request #187 from Azure/gb-certmanagerrefactor
Java sample App refactor
2 parents 46d39f4 + 798fdb4 commit 1ec463b

24 files changed

+432
-15
lines changed

‎.github/workflows/AppDeploy_JavaApp.yml

+5
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
# This file is now been transferred to a new repository.
2+
# https://github.com/Azure-Samples/java-aks-keyvault-tls/blob/0.9-preview/.github/workflows/deployapp.yml
3+
# Retarget any workflows to use the it instead of this one.
4+
# eg. uses: azure-samples/java-aks-keyvault-tls/.github/workflows/[email protected]
5+
16
on:
27
workflow_call:
38
inputs:

‎.github/workflows/ByoVnetCI.yml

+35-12
Original file line numberDiff line numberDiff line change
@@ -492,7 +492,7 @@ jobs:
492492
run:
493493
AKSNAME='${{ steps.deployAks.outputs.AKSNAME}}'
494494

495-
netpolicycmd="kubectl apply -f https://github.com/Azure/Aks-Construction/blob/0.4.2-preview/k8smanifests/networkpolicy-deny-all.yml?raw=true";
495+
netpolicycmd="kubectl apply -f https://raw.githubusercontent.com/Azure/Aks-Construction/0.4.3-preview/postdeploy/k8smanifests/networkpolicy-deny-all.yml";
496496
echo "Sending command $netpolicycmd to $AKSNAME in $RG";
497497
cmdOut=$(az aks command invoke -g $RG -n $AKSNAME -o json --command "${netpolicycmd}");
498498
echo $cmdOut;
@@ -518,26 +518,39 @@ jobs:
518518
run: echo "Resuable workflows can't be directly passed ENV/INPUTS (yet)"
519519
- name: Explain more
520520
run: echo "see https://github.community/t/reusable-workflow-env-context-not-available-in-jobs-job-id-with/206111"
521+
- name: Job parameter inspection
522+
run: echo ${{ github.event.inputs.doSmokeTestUninstall }}
523+
524+
Post-Deploy:
525+
needs: [Deploy, ReusableWF]
526+
uses: azure/aks-construction/.github/workflows/PostDeploy.yml@gb-certmanagerrefactor
527+
with:
528+
RG: ${{ needs.ReusableWF.outputs.RG }}
529+
AKSNAME: ${{needs.Deploy.outputs.AKSNAME}}
530+
DNSDOMAIN: azdemo.co.uk
531+
DNSRG: domainssl
532+
CERTMANAGEREMAIL: "[email protected]"
533+
secrets:
534+
AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}
521535

522536
SmokeTest_SimpleApp:
523537
needs: [Deploy, ReusableWF]
524538
uses: azure/aks-construction/.github/workflows/[email protected]
525-
#concurrency: "Ag-${{ inputs.AGNAME}}"
526539
with:
527540
RG: ${{ needs.ReusableWF.outputs.RG }} #Automation-Actions-AksDeployCI #$RG
528541
AKSNAME: ${{needs.Deploy.outputs.AKSNAME}}
529542
AGNAME: ${{ needs.Deploy.outputs.AGNAME}}
530543
APPNAME: avote-public
531544
INGRESSTYPE: "AGIC-Public-Ingress"
532545
FORCEHELMCLEANINSTALL: true
533-
UNINSTALLAFTERVERIFY: ${{ needs.ReusableWF.outputs.Uninstall == true }}
546+
UNINSTALLAFTERVERIFY: ${{ needs.ReusableWF.outputs.Uninstall == 'true' }}
534547
secrets:
535548
AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}
536549

537550
SmokeTest_JavaApp-certmgr:
538-
needs: [Deploy, ReusableWF]
539-
uses: azure/aks-construction/.github/workflows/[email protected]
540-
#concurrency: "Ag-${{ inputs.AGNAME}}"
551+
needs: [Deploy, ReusableWF, Post-Deploy]
552+
#uses: azure/aks-construction/.github/workflows/[email protected]
553+
uses: azure-samples/java-aks-keyvault-tls/.github/workflows/[email protected]
541554
with:
542555
RG: ${{ needs.ReusableWF.outputs.RG }} #Automation-Actions-AksDeployCI #'${{ env.RG }}' There seems to be an issue passing Env variables in reusable workflows
543556
AKSNAME: ${{needs.Deploy.outputs.AKSNAME}}
@@ -548,13 +561,15 @@ jobs:
548561
AGNAME: ${{ needs.Deploy.outputs.AGNAME}}
549562
APPNAME: openjdk-demo
550563
FRONTENDCERTTYPE: certmanager-staging
551-
UNINSTALLAFTERVERIFY: ${{ needs.ReusableWF.outputs.Uninstall == true }}
564+
FORCEHELMCLEANINSTALL: true
565+
UNINSTALLAFTERVERIFY: ${{ needs.ReusableWF.outputs.Uninstall == 'true' }}
552566
secrets:
553567
AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}
554568

555569
SmokeTest_JavaApp-appgw:
556-
needs: [Deploy, ReusableWF, SmokeTest_JavaApp-certmgr]
557-
uses: azure/aks-construction/.github/workflows/[email protected]
570+
needs: [Deploy, ReusableWF, Post-Deploy, SmokeTest_JavaApp-certmgr]
571+
#uses: azure/aks-construction/.github/workflows/[email protected]
572+
uses: azure-samples/java-aks-keyvault-tls/.github/workflows/[email protected]
558573
with:
559574
RG: ${{ needs.ReusableWF.outputs.RG }} #Automation-Actions-AksDeployCI #'${{ env.RG }}' There seems to be an issue passing Env variables in reusable workflows
560575
AKSNAME: ${{needs.Deploy.outputs.AKSNAME}}
@@ -565,6 +580,7 @@ jobs:
565580
AGNAME: ${{ needs.Deploy.outputs.AGNAME}}
566581
APPNAME: openjdk-kvssl
567582
FRONTENDCERTTYPE: appgw-selfsigned
583+
FORCEHELMCLEANINSTALL: true
568584
UNINSTALLAFTERVERIFY: ${{ needs.ReusableWF.outputs.Uninstall == true }}
569585
secrets:
570586
AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}
@@ -701,10 +717,10 @@ jobs:
701717
sudo mv bin/linux_amd64/kubelogin /usr/bin
702718
kubelogin convert-kubeconfig -l azurecli
703719
704-
- name: Kubectl get events
720+
- name: Kubectl get event Warnings
705721
if: github.event.inputs.doDebugSteps == 'true'
706722
run: |
707-
kubectl get events
723+
kubectl get events --sort-by='.metadata.creationTimestamp' -A | grep Warning
708724
709725
- name: Describe AGIC Pod
710726
env:
@@ -713,7 +729,14 @@ jobs:
713729
APPGWPODNAME=$(kubectl get pods -n $NAMESP -o json | jq -r '.items[] | select(.metadata.name | test("appgw-")).metadata.name')
714730
kubectl describe po -n $NAMESP $APPGWPODNAME
715731
716-
- name: Grab AGIC pod logs
732+
- name: Grab Invalid AGIC pod logs
733+
env:
734+
NAMESP: "kube-system"
735+
run: |
736+
APPGWPODNAME=$(kubectl get pods -n $NAMESP -o json | jq -r '.items[] | select(.metadata.name | test("appgw-")).metadata.name')
737+
kubectl logs -n $NAMESP $APPGWPODNAME | grep Invalid
738+
739+
- name: Grab full AGIC pod logs
717740
env:
718741
NAMESP: "kube-system"
719742
run: |

‎.github/workflows/ByoVnetPrivateCI.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,7 @@ jobs:
239239
run:
240240
AKSNAME='${{ steps.deployAks.outputs.AKSNAME}}'
241241

242-
netpolicycmd="kubectl apply -f https://raw.githubusercontent.com/Azure/Aks-Construction/0.4.2-preview/k8smanifests/networkpolicy-deny-all.yml";
242+
netpolicycmd="kubectl apply -f https://raw.githubusercontent.com/Azure/Aks-Construction/0.4.3-preview/postdeploy/k8smanifests/networkpolicy-deny-all.yml";
243243
echo "Sending command $netpolicycmd to $AKSNAME in $RG";
244244
cmdOut=$(az aks command invoke -g $RG -n $AKSNAME -o json --command "${netpolicycmd}");
245245
echo $cmdOut;

‎.github/workflows/PostDeploy.yml

+92
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
on:
2+
workflow_call:
3+
inputs:
4+
RG:
5+
required: true
6+
type: string
7+
AKSNAME:
8+
required: true
9+
type: string
10+
DNSDOMAIN:
11+
required: true
12+
type: string
13+
DNSRG:
14+
required: true
15+
type: string
16+
HELMCERTMANAGERISSUERURI:
17+
default: "postdeploy/helm/Az-CertManagerIssuer-0.3.0.tgz"
18+
required: false
19+
type: string
20+
HELMEXTERNALDNSURI:
21+
default: "postdeploy/helm/externaldns-0.2.0.tgz"
22+
required: false
23+
type: string
24+
CERTMANAGER:
25+
type: boolean
26+
default: true
27+
required: false
28+
CERTMANAGERVERSION:
29+
default: "v1.5.3"
30+
required: false
31+
type: string
32+
CERTMANAGEREMAIL:
33+
required: true
34+
type: string
35+
secrets:
36+
AZURE_CREDENTIALS:
37+
required: true
38+
39+
jobs:
40+
K8S:
41+
runs-on: ubuntu-latest
42+
env:
43+
RG: "${{ inputs.RG }}"
44+
AKSNAME: "${{ inputs.AKSNAME }}"
45+
steps:
46+
- uses: actions/checkout@v2
47+
name: Script file download
48+
49+
- name: Job parameter inspection
50+
run: |
51+
echo "RG is ${{ inputs.RG }}"
52+
echo "AKS name is ${{ inputs.AKSNAME }}"
53+
echo "CertManager version is ${{ inputs.CERTMANAGERVERSION }}"
54+
55+
- name: Azure Login
56+
uses: Azure/login@v1
57+
with:
58+
creds: ${{ secrets.AZURE_CREDENTIALS }}
59+
enable-AzPSSession: false
60+
environment: azurecloud
61+
allow-no-subscriptions: false
62+
63+
- name: AKS Connect
64+
run: az aks get-credentials -n $AKSNAME -g $RG --overwrite-existing
65+
66+
- name: Kubelogin
67+
env:
68+
kubeloginversion: 'v0.0.10'
69+
run: |
70+
wget https://github.com/Azure/kubelogin/releases/download/${{ env.kubeloginversion }}/kubelogin-linux-amd64.zip
71+
unzip kubelogin-linux-amd64.zip
72+
sudo mv bin/linux_amd64/kubelogin /usr/bin
73+
kubelogin convert-kubeconfig -l azurecli
74+
75+
- name: Install Cert Manager and ClusterIssuer
76+
if: inputs.CERTMANAGER
77+
env:
78+
CERTMANAGERURI: "https://github.com/jetstack/cert-manager/releases/download/${{ inputs.CERTMANAGERVERSION }}/cert-manager.yaml"
79+
CERTMANAGERISSUERURI: "${{ inputs.HELMCERTMANAGERISSUERURI }}"
80+
EMAILAD: "${{ inputs.CERTMANAGEREMAIL }}"
81+
run: sh postdeploy/scripts/certmanager-install.sh
82+
83+
- name: Verify Cert Manager ClusterIssuer
84+
if: inputs.CERTMANAGER
85+
run: kubectl describe clusterissuer
86+
87+
- name: Create azure-config secret and install externaldns
88+
env:
89+
EXTERNALDNSURI: "${{ inputs.HELMEXTERNALDNSURI }}"
90+
DNSDOMAIN: "${{ inputs.DNSDOMAIN }}"
91+
DNSRG: "${{ inputs.DNSRG }}"
92+
run: sh postdeploy/scripts/externaldns-config-install.sh

‎.github/workflows/Test_ReusableWorkflows.yml

+14-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,20 @@ jobs:
2727
- name: Dummy step
2828
run: echo "Resuable workflows can't be directly passed ENV/INPUTS (yet)"
2929

30+
Post-Deploy:
31+
needs: [ReusableWF]
32+
uses: azure/aks-construction/.github/workflows/PostDeploy.yml@gb-certmanagerrefactor
33+
with:
34+
RG: ${{ needs.ReusableWF.outputs.RG }}
35+
AKSNAME: aks-Byo
36+
DNSDOMAIN: azdemo.co.uk
37+
DNSRG: domainssl
38+
CERTMANAGEREMAIL: "[email protected]"
39+
secrets:
40+
AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}
41+
3042
byo-cluster:
43+
if: false
3144
needs: [ReusableWF]
3245
uses: azure/aks-construction/.github/workflows/[email protected]
3346
with:
@@ -65,7 +78,7 @@ jobs:
6578

6679
- name: Create Default Deny NetworkPolicy
6780
run:
68-
netpolicycmd="kubectl apply -f https://github.com/Azure/Aks-Construction/blob/0.4.2-preview/k8smanifests/networkpolicy-deny-all.yml?raw=true";
81+
netpolicycmd="kubectl apply -f https://raw.githubusercontent.com/Azure/Aks-Construction/0.4.3-preview/postdeploy/k8smanifests/networkpolicy-deny-all.yml";
6982

7083
if [ -z "$netpolicycmd" ];
7184
then

‎helper/src/components/deployTab.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,7 @@ ${cluster.apisecurity === "private" ? `"` : ``}
154154
# -----------------------------------
155155
# Create a default-deny network policy in your cluster to deny all traffic in the default namespace
156156
${cluster.apisecurity === "private" ? `az aks command invoke -g ${deploy.rg} -n ${aks} --command "` : ``}
157-
kubectl apply -f https://github.com/Azure/Aks-Construction/blob/main/k8smanifests/networkpolicy-deny-all.yml?raw=true
157+
kubectl apply -f https://raw.githubusercontent.com/Azure/Aks-Construction/0.4.3-preview/postdeploy/k8smanifests/networkpolicy-deny-all.yml
158158
${cluster.apisecurity === "private" ? `"` : ``}
159159
` : '') +
160160

‎postdeploy/helm/Az-CertManagerIssuer-0.3.0.tgz

1.08 KB
Binary file not shown.

‎postdeploy/helm/certmanagerissuer/Chart.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v2
2+
name: Az-CertManagerIssuer
3+
description: CertManager is an automated certificate manager for Kubernetes.
4+
type: application
5+
version: 0.3.0 #chart version
6+
appVersion: "1.0.1" #your app version (used as an image tag)

‎postdeploy/helm/certmanagerissuer/templates/clusterissuer-prod.yaml

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{{- if .Values.prod -}}
2+
apiVersion: cert-manager.io/v1
3+
kind: ClusterIssuer
4+
metadata:
5+
name: letsencrypt-prod
6+
spec:
7+
acme:
8+
# The ACME server URL
9+
server: https://acme-v02.api.letsencrypt.org/directory
10+
# Email address used for ACME registration
11+
email: {{ .Values.email }}
12+
# Name of a secret used to store the ACME account private key
13+
privateKeySecretRef:
14+
name: "letsencrypt-prod"
15+
# Enable the HTTP-01 challenge provider
16+
solvers:
17+
#- dns01:
18+
# Add azureDNS resolver for Private endpoints, but this need to be fixed: https://github.com/cert-manager/website/issues/662
19+
#azureDNS:
20+
# clientID: $(az aks show -g az-k8s-e0hm-rg -n aks-az-k8s-e0hm --query identityProfile.kubeletidentity.clientId -o tsv)
21+
# subscriptionID: 2d5bb2c8-8be8-4539-b48f-fbfd86852fa9
22+
# resourceGroupName: domainssl
23+
# hostedZoneName: azdemo.co.uk
24+
- http01:
25+
ingress:
26+
class: {{ .Values.ingressClass }}
27+
{{- end }}

‎postdeploy/helm/certmanagerissuer/templates/clusterissuer-staging.yaml

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{{- if .Values.staging -}}
2+
apiVersion: cert-manager.io/v1
3+
kind: ClusterIssuer
4+
metadata:
5+
name: letsencrypt-staging
6+
spec:
7+
acme:
8+
# The ACME server URL
9+
server: https://acme-staging-v02.api.letsencrypt.org/directory
10+
# Email address used for ACME registration
11+
email: {{ .Values.email }}
12+
# Name of a secret used to store the ACME account private key
13+
privateKeySecretRef:
14+
name: "letsencrypt-staging"
15+
# Enable the HTTP-01 challenge provider
16+
solvers:
17+
#- dns01:
18+
# Add azureDNS resolver for Private endpoints, but this need to be fixed: https://github.com/cert-manager/website/issues/662
19+
#azureDNS:
20+
# clientID: $(az aks show -g az-k8s-e0hm-rg -n aks-az-k8s-e0hm --query identityProfile.kubeletidentity.clientId -o tsv)
21+
# subscriptionID: 2d5bb2c8-8be8-4539-b48f-fbfd86852fa9
22+
# resourceGroupName: domainssl
23+
# hostedZoneName: azdemo.co.uk
24+
- http01:
25+
ingress:
26+
class: {{ .Values.ingressClass }}
27+
{{- end }}

‎postdeploy/helm/certmanagerissuer/templates/networkpolicy.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
kind: NetworkPolicy
2+
apiVersion: networking.k8s.io/v1
3+
metadata:
4+
name: allow-certmanager-httpsolver-inbound
5+
spec:
6+
podSelector:
7+
matchLabels:
8+
acme.cert-manager.io/http01-solver: "true"
9+
ingress:
10+
- {}

‎postdeploy/helm/certmanagerissuer/values.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
email: "[email protected]"
2+
ingressClass: azure/application-gateway
3+
staging: true
4+
prod : true

‎postdeploy/helm/externaldns-0.2.0.tgz

1.86 KB
Binary file not shown.

‎postdeploy/helm/externaldns/Chart.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v2
2+
name: externaldns
3+
description: A Helm chart for externaldns
4+
type: application
5+
version: 0.2.0 #chart version
6+
appVersion: "1.16.0" #your app version (used as an image tag)

0 commit comments

Comments
 (0)