From d081e5ee0a065a418980acf93521d43536d49b19 Mon Sep 17 00:00:00 2001 From: Vinod Soni Date: Tue, 7 Mar 2023 09:41:33 -0500 Subject: [PATCH 1/8] json file --- tools/deploy/module0/credential.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/deploy/module0/credential.json b/tools/deploy/module0/credential.json index 648e7c4c..8083aeb9 100644 --- a/tools/deploy/module0/credential.json +++ b/tools/deploy/module0/credential.json @@ -1,7 +1,7 @@ { "name": "gha-oidc", "issuer": "https://token.actions.githubusercontent.com", - "subject": "repo:/AKS-DevSecOps-Workshop:ref:refs/heads/main", + "subject": "repo:vinod-soni-microsoft/AKS-DevSecOps-Workshop:ref:refs/heads/main", "audiences": ["api://AzureADTokenExchange"], "description": "Workload Identity for AKS DevSecOps repo - branch mod 4" } From 9fd21117722c5b7d7cf5ad7cadad2fabe26954dc Mon Sep 17 00:00:00 2001 From: Vinod Soni <117770765+vinod-soni-microsoft@users.noreply.github.com> Date: Tue, 7 Mar 2023 11:13:21 -0500 Subject: [PATCH 2/8] Create codeql.yml --- .github/workflows/codeql.yml | 79 ++++++++++++++++++++++++++++++++++++ 1 file changed, 79 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 00000000..4190ab81 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,79 @@ +# For most projects, this workflow file will not need changing; you simply need +# to commit it to your repository. +# +# You may wish to alter this file to override the set of languages analyzed, +# or to provide custom queries or build logic. +# +# ******** NOTE ******** +# We have attempted to detect the languages in your repository. Please check +# the `language` matrix defined below to confirm you have the correct set of +# supported CodeQL languages. +# +name: "CodeQL" + +on: + push: + branches: [ "main" ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ "main" ] + schedule: + - cron: '22 19 * * 5' + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + + strategy: + fail-fast: false + matrix: + language: [ 'java' ] + # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] + # Use only 'java' to analyze code written in Java, Kotlin or both + # Use only 'javascript' to analyze code written in JavaScript, TypeScript or both + # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support + + steps: + - name: Checkout repository + uses: actions/checkout@v3 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v2 + with: + languages: ${{ matrix.language }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + + # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs + # queries: security-extended,security-and-quality + + + # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java). + # If this step fails, then you should remove it and run the build manually (see below) + #- name: Autobuild + # uses: github/codeql-action/autobuild@v2 + - name: Build Java + run: | + mvn clean package -f tools/deploy/module2/pom.xml + + # ℹī¸ Command-line programs to run using the OS shell. + # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun + + # If the Autobuild fails above, remove it and uncomment the following three lines. + # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. + + # - run: | + # echo "Run, Build Application using script" + # ./location_of_script_within_repo/buildscript.sh + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v2 + with: + category: "/language:${{matrix.language}}" From 79b177b68096b49cf3daf37001a05fee49c1d2a1 Mon Sep 17 00:00:00 2001 From: Vinod Soni <117770765+vinod-soni-microsoft@users.noreply.github.com> Date: Tue, 7 Mar 2023 11:50:59 -0500 Subject: [PATCH 3/8] Create dependabot.yml --- dependabot.yml | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 dependabot.yml diff --git a/dependabot.yml b/dependabot.yml new file mode 100644 index 00000000..291e186c --- /dev/null +++ b/dependabot.yml @@ -0,0 +1,2 @@ +- package-ecosystem: "maven" # See documentation for possible values + directory: "/tools/deploy/module3" # Location of package manifests From 20ac4ceb91c48b6c67a6226cf8bc41b47f7d586f Mon Sep 17 00:00:00 2001 From: Vinod Soni <117770765+vinod-soni-microsoft@users.noreply.github.com> Date: Wed, 8 Mar 2023 10:16:36 -0500 Subject: [PATCH 4/8] Update mod4-credential.json --- tools/deploy/module4/mod4-credential.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/deploy/module4/mod4-credential.json b/tools/deploy/module4/mod4-credential.json index 6715443d..9d2aa426 100644 --- a/tools/deploy/module4/mod4-credential.json +++ b/tools/deploy/module4/mod4-credential.json @@ -1,7 +1,7 @@ { "name": "gha-mod4-oidc", "issuer": "https://token.actions.githubusercontent.com", - "subject": "repo:msmarti/AKS-DevSecOps-Workshop:environment:test", + "subject": "repo:vinod-soni-microsoft/AKS-DevSecOps-Workshop:environment:test", "audiences": ["api://AzureADTokenExchange"], "description": "Workload Identity for AKS DevSecOps repo - Mod 4" } From 0b9239b3dcffe4c1fe3d7dd658851e5e10fdd4f4 Mon Sep 17 00:00:00 2001 From: Vinod Soni <117770765+vinod-soni-microsoft@users.noreply.github.com> Date: Wed, 8 Mar 2023 10:23:53 -0500 Subject: [PATCH 5/8] Create mod4-lab1-deploy-test.yml --- .github/workflows/mod4-lab1-deploy-test.yml | 78 +++++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 .github/workflows/mod4-lab1-deploy-test.yml diff --git a/.github/workflows/mod4-lab1-deploy-test.yml b/.github/workflows/mod4-lab1-deploy-test.yml new file mode 100644 index 00000000..d09691bb --- /dev/null +++ b/.github/workflows/mod4-lab1-deploy-test.yml @@ -0,0 +1,78 @@ +on: + push: + branches: + - main + paths: + - 'tools/deploy/module4/*text*' + workflow_dispatch: + +env: + TEST_AZURE_CONTAINER_REGISTRY: ${{ vars.TEST_AZURE_CONTAINER_REGISTRY }} + TEST_RESOURCE_GROUP: ${{ vars.TEST_RESOURCE_GROUP }} + TEST_CLUSTER_NAME: ${{ vars.TEST_CLUSTER_NAME }} + TEST_DEPLOYMENT_MANIFEST_PATH: ${{ vars.TEST_DEPLOYMENT_MANIFEST_PATH }} + +permissions: + id-token: write # This is required for requesting the JWT + contents: read # This is required for actions/checkout +jobs: + PushImagetoACR: + name: Push Sample Image to ACR and AKS + environment: test + permissions: + contents: read + id-token: write + runs-on: ubuntu-latest + steps: + - name: Echo variables + run: | + echo "TEST_AZURE_CONTAINER_REGISTRY: ${{ env.TEST_AZURE_CONTAINER_REGISTRY }}"; + echo "TEST_RESOURCE_GROUP: ${{ env.TEST_RESOURCE_GROUP }}"; + echo "TEST_CLUSTER_NAME: ${{ env.TEST_CLUSTER_NAME }}"; + echo "TEST_DEPLOYMENT_MANIFEST_PATH: ${{ env.TEST_DEPLOYMENT_MANIFEST_PATH }}" + # Checks out the repository this file is in + - uses: actions/checkout@v3 + + # Logs in with your Azure credentials + - name: Azure login + uses: azure/login@v1 + with: + client-id: ${{ secrets.TEST_AZURE_CLIENT_ID }} + tenant-id: ${{ secrets.TEST_AZURE_TENANT_ID }} + subscription-id: ${{ secrets.TEST_AZURE_SUBSCRIPTION_ID }} + # Pulling an image from Docker Hub to ACR. In a common CD scenario, + # the build and push of developed code would be part of a controlled workflow. + # The intention here is to show how environment variables and secrets work. + # So we will simplify the process. + - name: Pull a sample image from Docker hub to ACR + run: | + az acr import --name ${{ env.TEST_AZURE_CONTAINER_REGISTRY }} --source docker.io/library/nginx:latest --image nginx:latest -g ${{ env.TEST_RESOURCE_GROUP }} + continue-on-error: true + # Builds and pushes an image up to your Azure Container Registry + - name: Build and push image to ACR + run: | + echo "You could build and push an image to ACR here by using the following commented commands" + ### az acr build --image "${{env.TEST_AZURE_CONTAINER_REGISTRY}}.azurecr.io/:${{ github.sha }}" -r "${{ env.TEST_AZURE_CONTAINER_REGISTRY }}" -g ${{ env.TEST_RESOURCE_GROUP }} . + - name: Checkout source code + uses: actions/checkout@v3 + # Use kubelogin to configure your kubeconfig for Azure auth + - name: Set up kubelogin for non-interactive login + uses: azure/use-kubelogin@v1 + with: + kubelogin-version: 'v0.0.25' + # Retrieves your Azure Kubernetes Service cluster's kubeconfig file + - name: Get K8s context + uses: azure/aks-set-context@v3 + with: + resource-group: ${{ env.TEST_RESOURCE_GROUP }} + cluster-name: ${{ env.TEST_CLUSTER_NAME }} + admin: 'true' + use-kubelogin: 'true' + # Deploys application based on given manifest file + - name: Deploys application + uses: Azure/k8s-deploy@v4 + with: + action: deploy + manifests: ${{ env.TEST_DEPLOYMENT_MANIFEST_PATH }} + images: | + ${{ env.TEST_AZURE_CONTAINER_REGISTRY }}.azurecr.io/nginx:latest From 8430e733050363db9d45dd03256b365af3da07d6 Mon Sep 17 00:00:00 2001 From: Vinod Soni <117770765+vinod-soni-microsoft@users.noreply.github.com> Date: Wed, 8 Mar 2023 10:24:22 -0500 Subject: [PATCH 6/8] Update text.txt --- tools/deploy/module4/text.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/deploy/module4/text.txt b/tools/deploy/module4/text.txt index 2e65efe2..10e18c41 100644 --- a/tools/deploy/module4/text.txt +++ b/tools/deploy/module4/text.txt @@ -1 +1 @@ -a \ No newline at end of file +some comments From 349fb25ca920880484886d72f26b327cf8fb5954 Mon Sep 17 00:00:00 2001 From: Vinod Soni <117770765+vinod-soni-microsoft@users.noreply.github.com> Date: Wed, 8 Mar 2023 10:27:41 -0500 Subject: [PATCH 7/8] Update text.txt --- tools/deploy/module4/text.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/deploy/module4/text.txt b/tools/deploy/module4/text.txt index 10e18c41..56ab4073 100644 --- a/tools/deploy/module4/text.txt +++ b/tools/deploy/module4/text.txt @@ -1 +1,2 @@ some comments +some comments From 7ee199a6a2f78b395f800e140cf70e89facf3032 Mon Sep 17 00:00:00 2001 From: Vinod Soni <117770765+vinod-soni-microsoft@users.noreply.github.com> Date: Wed, 8 Mar 2023 10:32:57 -0500 Subject: [PATCH 8/8] Update text.txt --- tools/deploy/module4/text.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/deploy/module4/text.txt b/tools/deploy/module4/text.txt index 56ab4073..91bca855 100644 --- a/tools/deploy/module4/text.txt +++ b/tools/deploy/module4/text.txt @@ -1,2 +1,3 @@ some comments some comments +some comments