-
Notifications
You must be signed in to change notification settings - Fork 232
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
a28fe0b
commit c9d5265
Showing
20 changed files
with
755 additions
and
30 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Empty file.
56 changes: 56 additions & 0 deletions
56
Scenarios/AKS-Secure-Baseline-Private-AVM/Apps/RatingsApp/1-ratings-api-deployment.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| # Before this deployment, ensure that MongoDB has been created using Helm. | ||
|
|
||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| name: ratings-api | ||
| spec: | ||
| selector: | ||
| matchLabels: | ||
| app: ratings-api | ||
| template: | ||
| metadata: | ||
| labels: | ||
| app: ratings-api # the label for the pods and the deployments | ||
| spec: | ||
| containers: | ||
| - name: ratings-api | ||
| image: eslzacreh7qp4jx57xkw.azurecr.io/ratings-api:v1 # IMPORTANT: update with your own repository, if using Azure Government, also update change the URI to end with *.us instead of *.io | ||
| imagePullPolicy: Always | ||
| volumeMounts: | ||
| - name: secrets-store-inline | ||
| mountPath: "/mnt/secrets-store" | ||
| readOnly: true | ||
| ports: | ||
| - containerPort: 3000 # the application listens to this port | ||
| env: | ||
| - name: MONGODB_URI # the application expects to find the MongoDB connection details in this environment variable | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: mongodburi # secret name in keyvault and secret provider class | ||
| key: MONGODBURI # key name in secret provider class | ||
| resources: | ||
| requests: # minimum resources required | ||
| cpu: 250m | ||
| memory: 64Mi | ||
| limits: # maximum resources allocated | ||
| cpu: 250m | ||
| memory: 256Mi | ||
| readinessProbe: # is the container ready to receive traffic? | ||
| initialDelaySeconds: 10 | ||
| httpGet: | ||
| port: 3000 | ||
| path: /healthz | ||
| livenessProbe: # is the container healthy? | ||
| initialDelaySeconds: 2 | ||
| periodSeconds: 5 | ||
| httpGet: | ||
| port: 3000 | ||
| path: /healthz | ||
| volumes: | ||
| - name: secrets-store-inline | ||
| csi: | ||
| driver: secrets-store.csi.k8s.io | ||
| readOnly: true | ||
| volumeAttributes: | ||
| secretProviderClass: "mongo-secret-csi" |
12 changes: 12 additions & 0 deletions
12
Scenarios/AKS-Secure-Baseline-Private-AVM/Apps/RatingsApp/2-ratings-api-service.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| apiVersion: v1 | ||
| kind: Service | ||
| metadata: | ||
| name: ratings-api | ||
| spec: | ||
| selector: | ||
| app: ratings-api | ||
| ports: | ||
| - protocol: TCP | ||
| port: 80 | ||
| targetPort: 3000 | ||
| type: ClusterIP |
29 changes: 29 additions & 0 deletions
29
Scenarios/AKS-Secure-Baseline-Private-AVM/Apps/RatingsApp/3a-ratings-web-deployment.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| name: ratings-web | ||
| spec: | ||
| selector: | ||
| matchLabels: | ||
| app: ratings-web | ||
| template: | ||
| metadata: | ||
| labels: | ||
| app: ratings-web # the label for the pods and the deployments | ||
| spec: | ||
| containers: | ||
| - name: ratings-web | ||
| image: <acr name>.azurecr.io/ratings-web:v1 # IMPORTANT: update with your own repository, if using Azure Government, also update change the URI to end with *.us instead of *.io | ||
| imagePullPolicy: Always | ||
| ports: | ||
| - containerPort: 8080 # the application listens to this port | ||
| env: | ||
| - name: API # the application expects to connect to the API at this endpoint | ||
| value: http://ratings-api.ratingsapp.svc.cluster.local | ||
| resources: | ||
| requests: # minimum resources required | ||
| cpu: 250m | ||
| memory: 64Mi | ||
| limits: # maximum resources allocated | ||
| cpu: 500m | ||
| memory: 512Mi |
40 changes: 40 additions & 0 deletions
40
Scenarios/AKS-Secure-Baseline-Private-AVM/Apps/RatingsApp/3b-ratings-web-deployment.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| name: ratings-web | ||
| spec: | ||
| selector: | ||
| matchLabels: | ||
| app: ratings-web | ||
| template: | ||
| metadata: | ||
| labels: | ||
| app: ratings-web # the label for the pods and the deployments | ||
| spec: | ||
| volumes: | ||
| - name: aks-tls-akv | ||
| csi: | ||
| driver: secrets-store.csi.k8s.io | ||
| readOnly: true | ||
| volumeAttributes: | ||
| secretProviderClass: "aks-tls-akv" | ||
| containers: | ||
| - name: ratings-web | ||
| image: <acr name>.azurecr.io/ratings-web:v1 # IMPORTANT: update with your own repository | ||
| imagePullPolicy: Always | ||
| ports: | ||
| - containerPort: 8080 # the application listens to this port | ||
| env: | ||
| - name: API # the application expects to connect to the API at this endpoint | ||
| value: http://ratings-api.ratingsapp.svc.cluster.local | ||
| resources: | ||
| requests: # minimum resources required | ||
| cpu: 250m | ||
| memory: 64Mi | ||
| limits: # maximum resources allocated | ||
| cpu: 500m | ||
| memory: 512Mi | ||
| volumeMounts: | ||
| - name: aks-tls-akv | ||
| mountPath: /mnt/secrets-store | ||
| readOnly: true |
12 changes: 12 additions & 0 deletions
12
Scenarios/AKS-Secure-Baseline-Private-AVM/Apps/RatingsApp/4-ratings-web-service.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| apiVersion: v1 | ||
| kind: Service | ||
| metadata: | ||
| name: ratings-web | ||
| spec: | ||
| selector: | ||
| app: ratings-web | ||
| ports: | ||
| - protocol: TCP | ||
| port: 80 | ||
| targetPort: 8080 | ||
| type: ClusterIP |
28 changes: 28 additions & 0 deletions
28
Scenarios/AKS-Secure-Baseline-Private-AVM/Apps/RatingsApp/5-https-ratings-web-ingress.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| kind: Ingress | ||
| apiVersion: networking.k8s.io/v1 | ||
| metadata: | ||
| name: ratings-web-https | ||
| namespace: ratingsapp | ||
| annotations: | ||
| kubernetes.io/ingress.class: azure/application-gateway | ||
| cert-manager.io/issuer: letsencrypt-staging | ||
| cert-manager.io/acme-challenge-type: http01 | ||
| # kubernetes.io/ingress.allow-http: 'false' | ||
| appgw.ingress.kubernetes.io/ssl-redirect: "true" | ||
| acme.cert-manager.io/http01-edit-in-place: "true" #Adding this to get the staging cert to work | ||
| spec: | ||
| tls: | ||
| - hosts: | ||
| - <fqdn> | ||
| secretName: aks-tls-akv | ||
| rules: | ||
| - host: <fqdn> | ||
| http: | ||
| paths: | ||
| - pathType: Prefix | ||
| path: / | ||
| backend: | ||
| service: | ||
| name: ratings-web | ||
| port: | ||
| number: 80 |
19 changes: 19 additions & 0 deletions
19
Scenarios/AKS-Secure-Baseline-Private-AVM/Apps/RatingsApp/5a-http-ratings-web-ingress.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| # NON-TLS - HTTP Only | ||
|
|
||
| apiVersion: networking.k8s.io/v1 | ||
| kind: Ingress | ||
| metadata: | ||
| name: ratings-web | ||
| annotations: | ||
| kubernetes.io/ingress.class: azure/application-gateway | ||
| spec: | ||
| rules: | ||
| - http: | ||
| paths: | ||
| - pathType: Prefix | ||
| path: / | ||
| backend: | ||
| service: | ||
| name: ratings-web | ||
| port: | ||
| number: 80 |
22 changes: 22 additions & 0 deletions
22
Scenarios/AKS-Secure-Baseline-Private-AVM/Apps/RatingsApp/5b-http-ratings-web-ingress.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| # NON-TLS - HTTP Only | ||
|
|
||
| apiVersion: networking.k8s.io/v1 | ||
| kind: Ingress | ||
| metadata: | ||
| name: ratings-web | ||
| annotations: | ||
| nginx.ingress.kubernetes.io/use-regex: "true" | ||
| nginx.ingress.kubernetes.io/rewrite-target: /$2 | ||
| nginx.ingress.kubernetes.io/ssl-redirect: "false" | ||
| spec: | ||
| ingressClassName: nginx | ||
| rules: | ||
| - http: | ||
| paths: | ||
| - pathType: Prefix | ||
| path: / | ||
| backend: | ||
| service: | ||
| name: ratings-web | ||
| port: | ||
| number: 80 |
33 changes: 33 additions & 0 deletions
33
Scenarios/AKS-Secure-Baseline-Private-AVM/Apps/RatingsApp/README.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| # Deploying the Workload | ||
|
|
||
| To deploy this workload, you will need to be able to access the Azure Container Registry that was deployed as part of the supporting infrastructure for AKS. The container registry was configured to only be accessible from a build agent on the private network. | ||
|
|
||
| If you use the Dev Server for this, the following tools must be installed: | ||
|
|
||
| 1. Azure CLI | ||
|
|
||
| ```bash | ||
| curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash | ||
| ``` | ||
|
|
||
| 2. Docker CLI | ||
|
|
||
| ```bash | ||
| apt install docker.io | ||
| ``` | ||
|
|
||
| You will need to clone the following repos: | ||
|
|
||
| 1. The public repo for the Fruit Smoothie API. | ||
|
|
||
| ```bash | ||
| git clone https://github.com/MicrosoftDocs/mslearn-aks-workshop-ratings-api.git | ||
| ``` | ||
|
|
||
| 2. The public repo for the Fruit Smoothie Web Frontend: | ||
|
|
||
| ```bash | ||
| git clone https://github.com/MicrosoftDocs/mslearn-aks-workshop-ratings-web.git | ||
| ``` | ||
|
|
||
| 3. This repo, for the application code - /AKS-Landing-Zone-Accelerator/Scenarios/Secure-Baseline/Apps/RatingsApp |
25 changes: 25 additions & 0 deletions
25
Scenarios/AKS-Secure-Baseline-Private-AVM/Apps/RatingsApp/api-secret-provider-class.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| apiVersion: secrets-store.csi.x-k8s.io/v1 | ||
| kind: SecretProviderClass | ||
| metadata: | ||
| name: mongo-secret-csi | ||
| spec: | ||
| provider: azure | ||
| secretObjects: | ||
| - secretName: mongodburi | ||
| type: Opaque | ||
| data: | ||
| - objectName: MONGODBURI | ||
| key: MONGODBURI | ||
| parameters: | ||
| keyvaultName: eslz-kv-eh7qp4jx57xkw | ||
| useVMManagedIdentity: "true" | ||
| userAssignedIdentityID: 7aaf7114-a1a5-4009-8771-a9cf4f7a4a5d # the client ID of the MSI | ||
| cloudName: "" #if deploying to Azure Government, specify "AzureUSGovernment" here, otherwise, it will default to "AzurePublicCloud" | ||
| objects: | | ||
| array: | ||
| - | | ||
| objectName: MONGODBURI | ||
| objectType: secret | ||
| objectVersion: "" | ||
| tenantId: 8b84e42e-feab-48d5-8b12-507ddfc88de6 | ||
|
|
14 changes: 14 additions & 0 deletions
14
Scenarios/AKS-Secure-Baseline-Private-AVM/Apps/RatingsApp/certificateIssuer.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| apiVersion: cert-manager.io/v1 | ||
| kind: Issuer | ||
| metadata: | ||
| name: letsencrypt-staging | ||
| spec: | ||
| acme: | ||
| server: https://acme-staging-v02.api.letsencrypt.org/directory | ||
| email: <your e-mail here> | ||
| privateKeySecretRef: | ||
| name: letsencrypt-staging | ||
| solvers: | ||
| - http01: | ||
| ingress: | ||
| class: azure/application-gateway |
4 changes: 4 additions & 0 deletions
4
Scenarios/AKS-Secure-Baseline-Private-AVM/Apps/RatingsApp/internal-ingress.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| controller: | ||
| service: | ||
| annotations: | ||
| service.beta.kubernetes.io/azure-load-balancer-internal: "true" |
29 changes: 29 additions & 0 deletions
29
Scenarios/AKS-Secure-Baseline-Private-AVM/Apps/RatingsApp/web-secret-provider-class.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| apiVersion: secrets-store.csi.x-k8s.io/v1 | ||
| kind: SecretProviderClass | ||
| metadata: | ||
| name: aks-tls-akv | ||
| namespace: ratingsapp | ||
| spec: | ||
| provider: azure | ||
| parameters: | ||
| keyvaultName: <Key vault> | ||
| useVMManagedIdentity: "true" | ||
| userAssignedIdentityID: <aks identity client ID> # the client ID of the MSI created by the | ||
| objects: | | ||
| array: | ||
| - | | ||
| objectName: aks-ingress-tls | ||
| objectAlias: aks-ingress-tls | ||
| objectType: secret | ||
| # The objectType above is "secret" even though the aks-ingress-tls Certificate in the keyvault is certificate type. | ||
| # Also, the appropriate identity will need acces to GET "secrets" from the KV, as well as GET for "certificates" | ||
| tenantId: <tenant id> | ||
| secretObjects: | ||
| - secretName: aks-tls-akv # k8s secret manifest will be generated and synced after mounting it from pod/deploy | ||
| type: kubernetes.io/tls | ||
| data: | ||
| - objectName: aks-ingress-tls # must match the name of certificate in kv | ||
| key: tls.crt | ||
| - objectName: aks-ingress-tls # must match the name of certificate in kv | ||
| key: tls.key | ||
|
|
Oops, something went wrong.