Skip to content

Commit c77d8a1

Browse files
author
Gordon Byers
authored
Addressing Well Architected Framework gaps (#149)
* first cut of WAF rule gaps * introducing capturing of azcmds to file * updating ResourceGroup Name in UI * path problem and cmd replace * oops. token mistake * shifting to complete mode deployment * adding conditions to cover forks * Making full deployment optional in a manual run * Excluding Azure.AppGw.UseHTTPS rule as AGIC managed * More WAF param tweaks for better coverage * shifted disableLocalAccounts to param * param metadata * changing default of AksDisableLocalAccounts to false. * added ui and playwrite test for disabledlocalaccounts * disabling local accounts for basic cluster * removing the use of admin local account login * using aks-se * download kubelogin binary * Kubelogin * Changing RG used by Publish actions to be dedicated. * setting aksDisableLocalAccounts for the WAF param config * bumping template version in web app * case issue with aksDisableLocalAccounts * implementing keiths suggestion of default value cover on the new param. * removing invalid inputProps from TextFields * fixing != !== issue i spotted in the jscode * fixed up playwright test to be better * userauth cspell dictionary update
1 parent bc1b204 commit c77d8a1

25 files changed

+432
-49
lines changed

‎.github/workflows/AppDeploy_JavaApp.yml

+9-4
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ on:
4747
description: 'Uninstall app after tests [yes|no]'
4848
type: boolean
4949
default: true
50+
required: false
5051
secrets:
5152
AZURE_CREDENTIALS:
5253
required: true
@@ -136,12 +137,16 @@ jobs:
136137
RG: "${{ inputs.RG }}"
137138
AKSNAME: "${{ inputs.AKSNAME }}"
138139
run: |
139-
az aks get-credentials -n $AKSNAME -g $RG --admin --overwrite-existing
140+
az aks get-credentials -n $AKSNAME -g $RG --overwrite-existing
140141
141-
- name: Kubectl
142+
- name: Kubelogin
143+
env:
144+
kubeloginversion: 'v0.0.10'
142145
run: |
143-
#sudo az aks install-cli
144-
kubectl version
146+
wget https://github.com/Azure/kubelogin/releases/download/${{ env.kubeloginversion }}/kubelogin-linux-amd64.zip
147+
unzip kubelogin-linux-amd64.zip
148+
sudo mv bin/linux_amd64/kubelogin /usr/bin
149+
kubelogin convert-kubeconfig -l azurecli
145150
146151
- name: Observe Existing DNSConfig
147152
env:

‎.github/workflows/ByoVnetCI.yml

+16-10
Original file line numberDiff line numberDiff line change
@@ -543,13 +543,16 @@ jobs:
543543
- name: AKS Connect
544544
run: |
545545
AKSNAME='${{ needs.Deploy.outputs.AKSNAME}}'
546-
az aks get-credentials -n $AKSNAME -g $RG --admin --overwrite-existing
546+
az aks get-credentials -n $AKSNAME -g $RG --overwrite-existing
547547
548-
- name: Kubectl
549-
if: github.event.inputs.doDebugSteps != 'no'
548+
- name: Kubelogin
549+
env:
550+
kubeloginversion: 'v0.0.10'
550551
run: |
551-
#sudo az aks install-cli
552-
kubectl version
552+
wget https://github.com/Azure/kubelogin/releases/download/${{ env.kubeloginversion }}/kubelogin-linux-amd64.zip
553+
unzip kubelogin-linux-amd64.zip
554+
sudo mv bin/linux_amd64/kubelogin /usr/bin
555+
kubelogin convert-kubeconfig -l azurecli
553556
554557
- name: Deploy AGIC Public Facing Workload
555558
env:
@@ -726,13 +729,16 @@ jobs:
726729
- name: AKS Connect
727730
run: |
728731
AKSNAME='${{ needs.Deploy.outputs.AKSNAME}}'
729-
az aks get-credentials -n $AKSNAME -g $RG --admin --overwrite-existing
732+
az aks get-credentials -n $AKSNAME -g $RG --overwrite-existing
730733
731-
- name: Kubectl
732-
if: github.event.inputs.doDebugSteps != 'no'
734+
- name: Kubelogin
735+
env:
736+
kubeloginversion: 'v0.0.10'
733737
run: |
734-
#sudo az aks install-cli
735-
kubectl version
738+
wget https://github.com/Azure/kubelogin/releases/download/${{ env.kubeloginversion }}/kubelogin-linux-amd64.zip
739+
unzip kubelogin-linux-amd64.zip
740+
sudo mv bin/linux_amd64/kubelogin /usr/bin
741+
kubelogin convert-kubeconfig -l azurecli
736742
737743
- name: Kubectl get events
738744
if: github.event.inputs.doDebugSteps != 'no'

‎.github/workflows/ByoVnetPrivateCI.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -269,7 +269,7 @@ jobs:
269269
- name: AKS Connect
270270
run: |
271271
AKSNAME='${{ needs.Deploy.outputs.AKSNAME}}'
272-
az aks get-credentials -n $AKSNAME -g $RG --admin --overwrite-existing
272+
az aks get-credentials -n $AKSNAME -g $RG --overwrite-existing
273273
274274
- name: Kubectl
275275
run: |

‎.github/workflows/StandardCI.yml

+15-4
Original file line numberDiff line numberDiff line change
@@ -128,15 +128,26 @@ jobs:
128128
environment: azurecloud
129129
allow-no-subscriptions: false
130130

131+
# - name: AKS Connect
132+
# uses: Azure/aks-set-context@v1
133+
# with:
134+
# creds: '${{ secrets.AZURE_CREDENTIALS }}'
135+
# cluster-name: ${{ needs.Deploy.outputs.AKSNAME }}
136+
# resource-group: ${{ env.RG }}
137+
131138
- name: AKS Connect
132139
run: |
133140
AKSNAME='${{ needs.Deploy.outputs.AKSNAME}}'
134-
az aks get-credentials -n $AKSNAME -g $RG --admin --overwrite-existing
141+
az aks get-credentials -n $AKSNAME -g $RG --overwrite-existing
135142
136-
- name: Kubectl
143+
- name: Kubelogin
144+
env:
145+
kubeloginversion: 'v0.0.10'
137146
run: |
138-
#sudo az aks install-cli
139-
kubectl version
147+
wget https://github.com/Azure/kubelogin/releases/download/${{ env.kubeloginversion }}/kubelogin-linux-amd64.zip
148+
unzip kubelogin-linux-amd64.zip
149+
sudo mv bin/linux_amd64/kubelogin /usr/bin
150+
kubelogin convert-kubeconfig -l azurecli
140151
141152
- name: Deploy Simple Workload
142153
env:

‎.github/workflows/ghpages.yml

+71-2
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,17 @@ on:
1717
- "helper/**"
1818

1919
workflow_dispatch:
20+
inputs:
21+
doAzCmdDeployment:
22+
description: 'Test AZ Cmd by deploying to an Azure subscription'
23+
default: 'false'
24+
type: boolean
25+
required: false
2026

2127
env:
22-
templateRelease: 0.3.3
28+
templateRelease: 0.3.4-preview
29+
AZCLIVERSION: 2.30.0 #2.29.2 #2.26.0 #latest
30+
RG: "Automation-Actions-AksPublishCI"
2331

2432
jobs:
2533

@@ -81,12 +89,73 @@ jobs:
8189
8290
- name: Playwright - Run stable helper tests
8391
env:
84-
filenamewordmatch: 'helper'
92+
filenamewordmatch: 'helper-test'
8593
filenamewordexclude: 'fragile'
8694
run: |
8795
cd helper
8896
npx playwright test --browser chromium .playwrighttests/ -g '${{ env.filenamewordmatch }}' --grep-invert '${{ env.filenamewordexclude }}' --reporter list
8997
98+
- name: Playwright - Grab Az Commands
99+
env:
100+
filenamewordmatch: 'helper-export'
101+
run: |
102+
cd helper
103+
npx playwright test --browser chromium .playwrighttests/ -g '${{ env.filenamewordmatch }}' --reporter list
104+
105+
- name: Persist exported Az Commands for visibility
106+
if: ${{ github.event.pull_request.head.repo.fork }}
107+
uses: actions/upload-artifact@v2
108+
with:
109+
name: AzCmds
110+
path: helper/azcmd-*.sh
111+
112+
- name: Azure Login
113+
if: ${{ !github.event.pull_request.head.repo.fork }}
114+
uses: Azure/login@v1
115+
with:
116+
creds: ${{ secrets.AZURE_CREDENTIALS }}
117+
enable-AzPSSession: true
118+
environment: azurecloud
119+
allow-no-subscriptions: false
120+
121+
#TODO: If/When we capture more AZ CMD's, then we'll want to iterate over files beginning with "azcmd"
122+
- name: Verify AZ Commands
123+
if: ${{ !github.event.pull_request.head.repo.fork }}
124+
uses: Azure/[email protected]
125+
env:
126+
azcmdpath: "helper/azcmd-managed-private.sh"
127+
with:
128+
azcliversion: ${{ env.AZCLIVERSION }}
129+
inlineScript: |
130+
#Change the Create to a Validate statement
131+
sed -i 's/az deployment group create/az deployment group validate/' $azcmdpath
132+
133+
#Debug
134+
cat $azcmdpath
135+
136+
#Run the script
137+
sh $azcmdpath
138+
139+
- name: Full deploy test AZ Commands
140+
if: ${{ !github.event.pull_request.head.repo.fork && github.event.inputs.doAzCmdDeployment == 'true' }}
141+
uses: Azure/[email protected]
142+
env:
143+
azcmdpath: "helper/azcmd-managed-private.sh"
144+
with:
145+
azcliversion: ${{ env.AZCLIVERSION }}
146+
inlineScript: |
147+
#Change the Create to a Validate statement
148+
sed -i 's/az deployment group validate/az deployment group create --mode Complete --name ghpages/' $azcmdpath
149+
150+
#Debug
151+
cat $azcmdpath
152+
153+
#Run the script
154+
sh $azcmdpath
155+
156+
#Cleanup
157+
#az deploymentg group delete -n ghpages -g $RG
158+
90159
- name: Persist test failure screengrabs as artifacts
91160
uses: actions/upload-artifact@v2
92161
if: failure()

‎.github/workflows/regressionparams.yml

+21-6
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,8 @@ jobs:
6969
echo "RG is: $RG"
7070
echo "Param dir path is: ${{ env.ParamDir }}"
7171
echo "Param file is ${{ matrix.files }}"
72+
echo "Input path is ${{ env.ParamDir }}${{ matrix.files }}"
73+
echo "Do PS Rule is ${{ steps.paramfile.outputs.DOPSRULE }}"
7274
7375
- name: Arm Parameter file check
7476
shell: pwsh
@@ -130,10 +132,14 @@ jobs:
130132
RG='${{ env.RG }}'
131133
az deployment group validate -f bicep/main.bicep -g $RG -p ${{ env.ParamDir }}${{ matrix.files }}
132134
133-
- name: Debug
134-
run: |
135-
echo "Input path is ${{ env.ParamDir }}${{ matrix.files }}"
136-
echo "Do PS Rule is ${{ steps.paramfile.outputs.DOPSRULE }}"
135+
- name: WhatIf Infrastructure deployment
136+
if: steps.paramfile.outputs.DOPSRULE == 'true'
137+
uses: Azure/[email protected]
138+
with:
139+
azcliversion: ${{ env.AZCLIVERSION }}
140+
inlineScript: |
141+
RG='${{ env.RG }}'
142+
az deployment group what-if -f bicep/main.bicep -g $RG -p ${{ env.ParamDir }}${{ matrix.files }}
137143
138144
# PSRule does this cool thing where it traverse the parameter file through to the arm template
139145
# PSRule performs IaC recommendations of the template.
@@ -145,5 +151,14 @@ jobs:
145151
with:
146152
modules: 'PSRule.Rules.Azure'
147153
inputPath: "${{ env.ParamDir }}${{ matrix.files }}"
148-
prerelease: false
149-
baseline: 'Azure.Preview'
154+
#prerelease: false
155+
baseline: 'Azure.Default' #'Azure.Preview'
156+
157+
- name: PSRule - Analyze Azure parameter file including Preview feature rulesets
158+
if: steps.paramfile.outputs.DOPSRULE == 'true'
159+
uses: Microsoft/ps-rule@main
160+
continue-on-error: true #Preview feature checking means we need to suppress errors
161+
with:
162+
modules: 'PSRule.Rules.Azure'
163+
inputPath: "${{ env.ParamDir }}${{ matrix.files }}"
164+
baseline: 'Azure.All' #All includes preview and internal rules

‎.github/workflows_dep/AksDeploy-Basic.parameters.json

+3
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@
2323
"enableAzureRBAC": {
2424
"value": true
2525
},
26+
"aksDisableLocalAccounts": {
27+
"value": true
28+
},
2629
"omsagent": {
2730
"value": true
2831
},

‎.github/workflows_dep/AksDeploy-ByoVnetPrivate.parameters.json

+3
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@
2323
"enable_aad": {
2424
"value": true
2525
},
26+
"aksDisableLocalAccounts": {
27+
"value": true
28+
},
2629
"enableAzureRBAC": {
2730
"value": true
2831
},

‎.github/workflows_dep/regressionparams/managed-private.json

+3
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@
2020
"enable_aad": {
2121
"value": true
2222
},
23+
"aksDisableLocalAccounts": {
24+
"value": true
25+
},
2326
"enableAzureRBAC": {
2427
"value": true
2528
},

‎.github/workflows_dep/regressionparams/optimised-for-well-architected.json

+16
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,22 @@
8484
},
8585
"upgradeChannel": {
8686
"value": "stable"
87+
},
88+
"AksDiagCategories": {
89+
"value": [
90+
"cluster-autoscaler",
91+
"kube-apiserver",
92+
"kube-controller-manager",
93+
"kube-audit-admin",
94+
"kube-scheduler",
95+
"guard"
96+
]
97+
},
98+
"acrUntaggedRetentionPolicyEnabled": {
99+
"value": true
100+
},
101+
"aksDisableLocalAccounts": {
102+
"value": true
87103
}
88104
}
89105
}

‎.gitignore

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
*/node_modules
22
localdebug/*
3-
helper/*screengrabs/*
3+
helper/*screengrabs/*
4+
helper/azcmd*.sh

‎CONTRIBUTING.md

+15-2
Original file line numberDiff line numberDiff line change
@@ -83,11 +83,24 @@ When changing the Bicep code, try to build into your `developer inner loop` the
8383

8484
#### Breaking Changes
8585

86-
Should be avoided wherever possible, and where necessary highlight the breaking change in the release notes.
86+
Should be avoided wherever possible, and where necessary highlight the breaking change in the release notes. Version 1.0 will signify a stricter policy around breaking changes.
87+
88+
#### PSRule validation for Well Architected Analysis
89+
90+
[PSRule for Azure](https://azure.github.io/PSRule.Rules.Azure) provides analysis for IaC against the Well Architected Framework. It is leveraged in the GitHub actions that run on PR, but you can leverage it locally with the following script;
91+
92+
```powershell
93+
Install-Module -Name 'PSRule.Rules.Azure' -Repository PSGallery -Scope CurrentUser
94+
95+
$paramPath="./.github/workflows_dep/regressionparams/optimised-for-well-architected.json"
96+
test-path $paramPath
97+
Assert-PSRule -Module 'PSRule.Rules.Azure' -InputPath $paramPath -Format File -outcome Processed
98+
99+
```
87100

88101
### The Wizard Web App
89102

90-
The [configuration experience](https://azure.github.io/Aks-Construction/) is hosted in GitHub pages. It's a static web app, written in NodeJS using FluentUI.
103+
The [configuration experience](https://azure.github.io/Aks-Construction/) is hosted in GitHub pages. It's a static web app, written in NodeJS using [FluentUI](https://developer.microsoft.com/en-us/fluentui).
91104

92105
#### Playwright tests
93106

0 commit comments

Comments
 (0)