Merge pull request #300 from AmpersandTarski/issue/279-create-github-…

…actions-to-generate-docker-images

Issue/279 create GitHub actions to generate docker images

.github/workflows/Build_to_AKS.yml

@@ -0,0 +1,74 @@
+name: Build and Deploy
+
+on:
+  push:
+    branches:
+      - "issue/**"
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    environment: LocalFranSlot
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build and push
+        uses: docker/build-push-action@v4
+        with:
+          context: ./RAP4
+          file: ./RAP4/Dockerfile
+          push: true
+          tags: |
+            ${{ secrets.DOCKERHUB_USERNAME }}/rap:latest
+            ${{ secrets.DOCKERHUB_USERNAME }}/rap:${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  deploy:
+    name: Deploy
+    needs: build
+    runs-on: ubuntu-latest
+    environment: LocalFranSlot
+    permissions: write-all
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@v3
+
+      - name: "Az CLI login"
+        uses: azure/login@v1
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Set AKS context
+        id: set-context
+        uses: azure/aks-set-context@v3
+        with:
+          resource-group: "${{ vars.RG }}"
+          cluster-name: "${{ vars.AKSCLUSTER }}"
+
+      - name: Setup kubectl
+        id: install-kubectl
+        uses: azure/setup-kubectl@v3
+
+      - name: Deploy to AKS
+        id: deploy-aks
+        uses: Azure/k8s-deploy@v4
+        with:
+          namespace: "rap"
+          manifests: |
+            deployment/resources/rap-deployment.yaml
+          images: |
+            ${{ secrets.DOCKERHUB_USERNAME }}/rap:${{ github.sha }}

.github/workflows/CICD Pipeline.yml

@@ -1,30 +1,41 @@
-name: CICD Pipeline
+name: CI/CD Pipeline
 
 on:
   push:
     branches:
       - main
+      - "feature/**"
+      - "issue/**"
   pull_request:
   workflow_dispatch:
 
-
 jobs:
-
   Local:
     if: startsWith(github.ref_name, 'feature/')
     uses: ./.github/workflows/Deploy_workflow.yml
     with:
-      environment_name: 'Local${{ github.actor }}'
+      environment_name: "Local${{ github.actor }}"
+    secrets: inherit
 
   Development:
     if: github.ref_name == 'main'
     uses: ./.github/workflows/Deploy_workflow.yml
     with:
       environment_name: Development
+    secrets: inherit
 
   Staging:
     if: github.ref_name == 'main'
     needs: Development
     uses: ./.github/workflows/Deploy_workflow.yml
     with:
       environment_name: Staging
+    secrets: inherit
+
+  Production:
+    if: github.ref_name == 'main'
+    needs: Staging
+    uses: ./.github/workflows/Deploy_workflow.yml
+    with:
+      environment_name: Production
+    secrets: inherit

.github/workflows/Deploy_workflow.yml

@@ -9,9 +9,8 @@ on:
         type: string
 
 jobs:
-
   CheckEnvironment:
-    environment: '${{ inputs.environment_name }}'
+    environment: ${{ inputs.environment_name }}
     runs-on: ubuntu-latest
     outputs:
       environment-ok: ${{ steps.my-environment-check.outputs.defined }}
@@ -27,10 +26,72 @@ jobs:
             echo "defined=false" >> $GITHUB_OUTPUT;
           fi
 
+  CheckRAP4USER:
+    runs-on: ubuntu-latest
+    outputs:
+      hasChanged: ${{ steps.hasChanged.outputs.hasDiff }}
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          # Checkout as many commits as needed for the diff
+          fetch-depth: 2
+      - shell: pwsh
+        id: hasChanged
+        run: |
+          # Diff HEAD with the previous commit
+          $diff = git diff --name-only HEAD^ HEAD
+
+          # Check if a file under RAP4USER/ has changed (added, modified, deleted)
+          $SourceDiff = $diff | Where-Object { $_ -match '^RAP4USER/' }
+          $HasDiff = $SourceDiff.Length -gt 0
+
+          # Set the output named "hasDiff"
+          echo "hasDiff=$HasDiff" >> $Env:GITHUB_OUTPUT
+
+  Build:
+    environment: ${{ inputs.environment_name }}
+    needs: [CheckEnvironment, CheckRAP4USER]
+    if: ${{ needs.CheckEnvironment.outputs.environment-ok == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build and push RAP4USER
+        uses: docker/build-push-action@v4
+        if: ${{ needs.CheckRAP4USER.outputs.hasChanged == 'True' }}
+        with:
+          context: ./RAP4USER
+          file: ./RAP4USER/Dockerfile
+          push: true
+          tags: |
+            ampersandtarski/rap4-student-prototype:${{ inputs.environment_name }}-latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Build and push RAP4
+        uses: docker/build-push-action@v4
+        with:
+          context: ./RAP4
+          file: ./RAP4/Dockerfile
+          push: true
+          tags: |
+            ampersandtarski/ampersand-rap:${{ inputs.environment_name }}-latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
   Deploy:
-    environment: '${{ inputs.environment_name }}'
-    needs: [CheckEnvironment]
-    if: needs.CheckEnvironment.outputs.environment-ok == 'true'
+    environment: ${{ inputs.environment_name }}
+    needs: Build
     runs-on: ubuntu-latest
     steps:
       - name: Echoing variables
@@ -39,7 +100,6 @@ jobs:
           echo Echoing github.ref_name * ${{ github.ref_name }} *
           echo Echoing inputs.environment_name * ${{ inputs.environment_name }} *
           echo Echoing vars.ENVIRONMENT_NAME * ${{ vars.ENVIRONMENT_NAME }} *
-          echo Echoing environment-ok * ${{ needs.CheckEnvironment.outputs.environment-ok }} *
       - name: Deploy steps
         run: |
           echo Deploying to ${{ inputs.environment_name }} ...

docs/pipeline.md

@@ -0,0 +1,12 @@
+# CI/CD Pipeline
+
+To maintain the code and keep the RAP clusters updated a CI/CD pipeline was erected.
+It consists of two steps: Build and Deploy.
+
+## Build
+
+During this step the main branch is checked out and a docker image is composed. A new tag is generated and then this image is pushed to the DockerHub repository.
+
+## Deploy
+
+During this step a connection is made with the Azure account running RAP using Open ID Connect (OIDC). After a secure connection is made a new deployment is applied using the newly generated image.

docs/preparing-azure.md

@@ -91,6 +91,83 @@ kubectl config get-contexts
 kubectl config use-context 'NAME'
 ```
 
+## Open ID Connect
+
+To make use of Open ID Connect (OIDC) to allow GitHub Actions to apply new deployments to AKS the following steps are required.
+
+### Requirements
+
+The following permissions are required for registering an app:
+
+- You must have sufficient permissions to register an application with your Azure AD tenant, and assign to the application a role in your Azure subscription. To complete these tasks, you require `Application.ReadWrite.Allpermission`.
+
+### Azure:
+
+1. Login to Azure and set the right subscription
+
+```
+az login --tenant <TENANT_NAME>
+az account set -n <SUBSCRIPTION_NAME>
+```
+
+2. Create an Azure Active Directory Application then get the appId and save it in an environment variable:
+
+```
+az ad app create --display-name <APP_NAME>
+$appId = $(az ad app list --display-name <APP_NAME> --query "[].appId" -o tsv)
+```
+
+3. Create a service principal and save the id
+
+```
+az ad sp create --id $appId
+$assigneeObjectId = $(az ad sp show --id $appId --query id -o tsv)
+```
+
+4. Create a new role assignment
+
+```
+az role assignment create --role contributor --subscription $subscriptionId --assignee-object-id  $assigneeObjectId --assignee-principal-type ServicePrincipal --scope /subscriptions/$subscriptionId/resourceGroups/<RESOURCE_GROUP_NAME>
+```
+
+5. Create federated credentials for the active directory application
+
+```
+az ad app federated-credential create --id $appId --parameters credential.json
+
+credential.json
+{
+    "name": "<CREDENTIAL_NAME>",
+    "issuer": "https://token.actions.githubusercontent.com",
+    "subject": "<REPOSITORY_REFERENCE>",
+    "description": "<DESCRIPTION>",
+    "audiences": [
+        "api://AzureADTokenExchange"
+    ]
+}
+```
+
+6. Get the required ids:
+
+```
+$appId = $(az ad app list --display-name <APP_NAME> --query "[].appId" -o tsv)
+$tenantId = $(az account show --query tenantId -o tsv)
+$subscriptionId = $(az account show --query id -o tsv)
+```
+
+### GitHub:
+
+1. Go to **Settings** in the GitHub repository
+
+2. Navigate to **Security** > **Secrets and variables** > **Actions**
+
+3. Create and save the following three secrets
+   | GitHub secret | Copy value from |
+   | --- | --- |
+   | AZURE_CLIENT_ID | $appId |
+   | AZURE_TENANT_ID | $tenantId |
+   | AZURE_SUBSCRIPTION_ID | $subscriptionId |
+
 ## Next
 
 [Deploy Kubernetes](rap-deployment.md)