Skip to content

Commit 51fb8c4

Browse files
v-regandownerv-regandowner
authored
Merge pull request #271996 from roshair/fta-java-automate-github
Fta java automate GitHub: TomCat additions
2 parents 211be28 + f980873 commit 51fb8c4

File tree

4 files changed

+278
-78
lines changed

4 files changed

+278
-78
lines changed

‎articles/app-service/deploy-github-actions.md

Lines changed: 129 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ When you enable continuous deployment, the app creation wizard automatically pic
2828

2929
| Basic authentication selection | Authentication method |
3030
|-|-|
31-
|Disable| [User-assigned identity (OpenID Connect)](deploy-continuous-deployment.md#what-does-the-user-assigned-identity-option-do-for-github-actions) |
31+
|Disable| [User-assigned identity (OpenID Connect)](deploy-continuous-deployment.md#what-does-the-user-assigned-identity-option-do-for-github-actions) (recommended) |
3232
|Enable| [Basic authentication](configure-basic-auth-disable.md) |
3333

3434
> [!NOTE]
@@ -46,65 +46,21 @@ For more information, see [Continuous deployment to Azure App Service](deploy-co
4646

4747
## Set up a GitHub Actions workflow manually
4848

49-
You can also deploy a workflow without using the Deployment Center.
49+
You can also deploy a workflow without using the Deployment Center. In that case you need to perform 3 steps:
5050

5151
1. [Generate deployment credentials](#1-generate-deployment-credentials)
5252
1. [Configure the GitHub secret](#2-configure-the-github-secret)
5353
1. [Add the workflow file to your GitHub repository](#3-add-the-workflow-file-to-your-github-repository)
5454

5555
### 1. Generate deployment credentials
5656

57-
The recommended way to authenticate with Azure App Services for GitHub Actions is with a user-defined managed identity, and the easiest way for that is by [configuring GitHub Actions deployment directly in the portal](deploy-continuous-deployment.md) instead and selecting **User-assigned managed identity**.
57+
The recommended way to authenticate with Azure App Services for GitHub Actions is with OpenID Connect. This is an authentication method that uses short-lived tokens. Setting up [OpenID Connect with GitHub Actions](/azure/developer/github/connect-from-azure) is more complex but offers hardened security.
5858

59-
> [!NOTE]
60-
> Authentication using a user-assigned managed identity is currently in preview.
61-
62-
Alternatively, you can authenticate with a service principal, OpenID Connect, or a publish profile.
63-
64-
# [Publish profile](#tab/applevel)
65-
66-
> [!NOTE]
67-
> Publish profile requires [basic authentication](configure-basic-auth-disable.md) to be enabled.
68-
69-
A publish profile is an app-level credential. Set up your publish profile as a GitHub secret.
70-
71-
1. Go to your app service in the Azure portal.
72-
73-
1. On the **Overview** page, select **Get Publish profile**.
74-
75-
1. Save the downloaded file. You'll use the contents of the file to create a GitHub secret.
76-
77-
> [!NOTE]
78-
> As of October 2020, Linux web apps needs the app setting `WEBSITE_WEBDEPLOY_USE_SCM` set to `true` **before downloading the publish profile**. This requirement will be removed in the future.
79-
80-
# [Service principal](#tab/userlevel)
81-
82-
You can create a [service principal](../active-directory/develop/app-objects-and-service-principals.md#service-principal-object) with the [az ad sp create-for-rbac](/cli/azure/ad/sp#az-ad-sp-create-for-rbac) command in the [Azure CLI](/cli/azure/). Run this command with [Azure Cloud Shell](https://shell.azure.com/) in the Azure portal or by selecting the **Try it** button.
83-
84-
```azurecli-interactive
85-
az ad sp create-for-rbac --name "myApp" --role contributor \
86-
--scopes /subscriptions/<subscription-id>/resourceGroups/<group-name>/providers/Microsoft.Web/sites/<app-name> \
87-
--json-auth
88-
```
89-
90-
In the previous example, replace the placeholders with your subscription ID, resource group name, and app name. The output is a JSON object with the role assignment credentials that provide access to your App Service app similar to the following JSON snippet. Copy this JSON object for later.
91-
92-
```output
93-
{
94-
"clientId": "<GUID>",
95-
"clientSecret": "<GUID>",
96-
"subscriptionId": "<GUID>",
97-
"tenantId": "<GUID>",
98-
(...)
99-
}
100-
```
101-
102-
> [!IMPORTANT]
103-
> It is always a good practice to grant minimum access. The scope in the previous example is limited to the specific App Service app and not the entire resource group.
59+
Alternatively, you can authenticate with a User-assigned Managed Identity, a service principal, or a publish profile.
10460

10561
# [OpenID Connect](#tab/openid)
10662

107-
OpenID Connect is an authentication method that uses short-lived tokens. Setting up [OpenID Connect with GitHub Actions](/azure/developer/github/connect-from-azure) is more complex but offers hardened security.
63+
The below runs you through the steps for creating an active directory application, service principal, and federated credentials using Azure CLI statements. To learn how to create an active directory application, service principal, and federated credentials in Azure portal, see [Connect GitHub and Azure](/azure/developer/github/connect-from-azure#use-the-azure-login-action-with-openid-connect).
10864

10965
1. If you don't have an existing application, register a [new Active Directory application and service principal that can access resources](../active-directory/develop/howto-create-service-principal-portal.md). Create the Active Directory application.
11066

@@ -126,15 +82,15 @@ OpenID Connect is an authentication method that uses short-lived tokens. Setting
12682
az ad sp create --id $appId
12783
```
12884
129-
1. Create a new role assignment by subscription and object. By default, the role assignment is tied to your default subscription. Replace `$subscriptionId` with your subscription ID, `$resourceGroupName` with your resource group name, and `$assigneeObjectId` with the generated `assignee-object-id`. Learn [how to manage Azure subscriptions with the Azure CLI](/cli/azure/manage-azure-subscriptions-azure-cli).
85+
1. Create a new role assignment by subscription and object. By default, the role assignment is tied to your default subscription. Replace `$subscriptionId` with your subscription ID, `$resourceGroupName` with your resource group name, `$webappName` with your web app name, and `$assigneeObjectId` with the generated `id`. Learn [how to manage Azure subscriptions with the Azure CLI](/cli/azure/manage-azure-subscriptions-azure-cli).
13086
13187
```azurecli-interactive
132-
az role assignment create --role contributor --subscription $subscriptionId --assignee-object-id $assigneeObjectId --scope /subscriptions/$subscriptionId/resourceGroups/$resourceGroupName/providers/Microsoft.Web/sites/ --assignee-principal-type ServicePrincipal
88+
az role assignment create --role contributor --subscription $subscriptionId --assignee-object-id $assigneeObjectId --scope /subscriptions/$subscriptionId/resourceGroups/$resourceGroupName/providers/Microsoft.Web/sites/$webappName --assignee-principal-type ServicePrincipal
13389
```
13490
13591
1. Run the following command to [create a new federated identity credential](/graph/api/application-post-federatedidentitycredentials?view=graph-rest-beta&preserve-view=true) for your active directory application.
13692
137-
* Replace `APPLICATION-OBJECT-ID` with the **objectId (generated while creating app)** for your Active Directory application.
93+
* Replace `APPLICATION-OBJECT-ID` with the **appId (generated while creating app)** for your Active Directory application.
13894
* Set a value for `CREDENTIAL-NAME` to reference later.
13995
* Set the `subject`. Its value is defined by GitHub depending on your workflow:
14096
* Jobs in your GitHub Actions environment: `repo:< Organization/Repository >:environment:< Name >`
@@ -154,14 +110,69 @@ OpenID Connect is an authentication method that uses short-lived tokens. Setting
154110
]
155111
}
156112
```
157-
158-
To learn how to create a Create an active directory application, service principal, and federated credentials in Azure portal, see [Connect GitHub and Azure](/azure/developer/github/connect-from-azure#use-the-azure-login-action-with-openid-connect).
113+
114+
# [Publish profile](#tab/applevel)
115+
116+
> [!NOTE]
117+
> Publish profile requires [basic authentication](configure-basic-auth-disable.md) to be enabled.
118+
119+
A publish profile is an app-level credential. Set up your publish profile as a GitHub secret.
120+
121+
1. Go to your app service in the Azure portal.
122+
123+
1. On the **Overview** page, select **Get Publish profile**.
124+
125+
1. Save the downloaded file. You'll use the contents of the file to create a GitHub secret.
126+
127+
> [!NOTE]
128+
> As of October 2020, Linux web apps needs the app setting `WEBSITE_WEBDEPLOY_USE_SCM` set to `true` **before downloading the publish profile**. This requirement will be removed in the future.
129+
130+
# [Service principal](#tab/userlevel)
131+
132+
You can create a [service principal](../active-directory/develop/app-objects-and-service-principals.md#service-principal-object) with the [az ad sp create-for-rbac](/cli/azure/ad/sp#az-ad-sp-create-for-rbac) command in the [Azure CLI](/cli/azure/). Run this command with [Azure Cloud Shell](https://shell.azure.com/) in the Azure portal or by selecting the **Try it** button.
133+
134+
```azurecli-interactive
135+
az ad sp create-for-rbac --name "myApp" --role contributor \
136+
--scopes /subscriptions/<subscription-id>/resourceGroups/<group-name>/providers/Microsoft.Web/sites/<app-name> \
137+
--json-auth
138+
```
139+
140+
In the previous example, replace the placeholders with your subscription ID, resource group name, and app name. The output is a JSON object with the role assignment credentials that provide access to your App Service app similar to the following JSON snippet. Copy this JSON object for later.
141+
142+
```output
143+
{
144+
"clientId": "<GUID>",
145+
"clientSecret": "<GUID>",
146+
"subscriptionId": "<GUID>",
147+
"tenantId": "<GUID>",
148+
(...)
149+
}
150+
```
151+
152+
> [!IMPORTANT]
153+
> It is always a good practice to grant minimum access. The scope in the previous example is limited to the specific App Service app and not the entire resource group.
159154
160155
---
161156

162157
### 2. Configure the GitHub secret
163158

164159

160+
# [OpenID Connect](#tab/openid)
161+
162+
You need to provide your application's **Client ID**, **Tenant ID** and **Subscription ID** to the [Azure/login](https://github.com/marketplace/actions/azure-login) action. These values can either be provided directly in the workflow or can be stored in GitHub secrets and referenced in your workflow. Saving the values as GitHub secrets is the more secure option.
163+
164+
1. Open your GitHub repository and go to **Settings > Security > Secrets and variables > Actions > New repository secret**.
165+
166+
1. Create secrets for `AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, and `AZURE_SUBSCRIPTION_ID`. Use these values from your Active Directory application for your GitHub secrets:
167+
168+
|GitHub Secret | Active Directory Application |
169+
|---------|---------|
170+
|AZURE_CLIENT_ID | Application (client) ID |
171+
|AZURE_TENANT_ID | Directory (tenant) ID |
172+
|AZURE_SUBSCRIPTION_ID | Subscription ID |
173+
174+
1. Save each secret by selecting **Add secret**.
175+
165176
# [Publish profile](#tab/applevel)
166177

167178
In [GitHub](https://github.com/), browse your repository. Select **Settings > Security > Secrets and variables > Actions > New repository secret**.
@@ -190,22 +201,6 @@ When you configure the GitHub workflow file later, you use the secret for the in
190201
creds: ${{ secrets.AZURE_CREDENTIALS }}
191202
```
192203

193-
# [OpenID Connect](#tab/openid)
194-
195-
You need to provide your application's **Client ID**, **Tenant ID** and **Subscription ID** to the [Azure/login](https://github.com/marketplace/actions/azure-login) action. These values can either be provided directly in the workflow or can be stored in GitHub secrets and referenced in your workflow. Saving the values as GitHub secrets is the more secure option.
196-
197-
1. Open your GitHub repository and go to **Settings > Security > Secrets and variables > Actions > New repository secret**.
198-
199-
1. Create secrets for `AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, and `AZURE_SUBSCRIPTION_ID`. Use these values from your Active Directory application for your GitHub secrets:
200-
201-
|GitHub Secret | Active Directory Application |
202-
|---------|---------|
203-
|AZURE_CLIENT_ID | Application (client) ID |
204-
|AZURE_TENANT_ID | Directory (tenant) ID |
205-
|AZURE_SUBSCRIPTION_ID | Subscription ID |
206-
207-
1. Save each secret by selecting **Add secret**.
208-
209204
---
210205

211206
### 3. Add the workflow file to your GitHub repository
@@ -222,6 +217,10 @@ To deploy your code to an App Service app, you use the [azure/webapps-deploy@v3]
222217

223218
The following examples show the part of the workflow that builds the web app, in different supported languages.
224219

220+
# [OpenID Connect](#tab/openid)
221+
222+
[!INCLUDE [deploy-github-actions-openid-connect](includes/deploy-github-actions/deploy-github-actions-openid-connect.md)]
223+
225224
# [Publish profile](#tab/applevel)
226225

227226
[!INCLUDE [deploy-github-actions-publish-profile](includes/deploy-github-actions/deploy-github-actions-publish-profile.md)]
@@ -230,11 +229,67 @@ The following examples show the part of the workflow that builds the web app, in
230229

231230
[!INCLUDE [deploy-github-actions-service-principal](includes/deploy-github-actions/deploy-github-actions-service-principal.md)]
232231

233-
# [OpenID Connect](#tab/openid)
232+
-----
234233

235-
[!INCLUDE [deploy-github-actions-openid-connect](includes/deploy-github-actions/deploy-github-actions-openid-connect.md)]
236234

237-
-----
235+
## Frequently Asked Questions
236+
237+
- [How do I deploy a WAR file through Maven plugin and OpenID Connect](#how-do-i-deploy-a-war-file-through-maven-plugin-and-openid-connect)
238+
- [How do I deploy a WAR file through Az CLI and OpenID Connect](#how-do-i-deploy-a-war-file-through-az-cli-and-openid-connect)
239+
- [How do I deploy to a Container](#how-do-i-deploy-to-a-container)
240+
- [How do I update the Tomcat configuration after deployment](#how-do-i-update-the-tomcat-configuration-after-deployment)
241+
242+
### How do I deploy a WAR file through Maven plugin and OpenID Connect
243+
244+
In case you configured your Java Tomcat project with the [Maven plugin](https://github.com/microsoft/azure-maven-plugins), you can also deploy to Azure App Service through this plugin. If you use the [Azure CLI GitHub action](https://github.com/Azure/cli) it will make use of your Azure login credentials.
245+
246+
```yaml
247+
- name: Azure CLI script file
248+
uses: azure/cli@v2
249+
with:
250+
inlineScript: |
251+
mvn package azure-webapp:deploy
252+
```
253+
254+
More information on the Maven plugin and how to use and configure it can be found in the [Maven plugin wiki for Azure App Service](https://github.com/microsoft/azure-maven-plugins/wiki/Azure-Web-App).
255+
256+
257+
### How do I deploy a WAR file through Az CLI and OpenID Connect
258+
259+
If you use prefer the Azure CLI to deploy to App Service, you can use the GitHub Action for CLI.
260+
261+
```yaml
262+
- name: Azure CLI script
263+
uses: azure/cli@v2
264+
with:
265+
inlineScript: |
266+
az webapp deploy --src-path '${{ github.workspace }}/target/yourpackage.war' --name ${{ env.AZURE_WEBAPP_NAME }} --resource-group ${{ env.RESOURCE_GROUP }} --async true --type war
267+
```
268+
269+
More information on the GitHub Action for CLI and how to use and configure it can be found in the [Azure CLI GitHub action](https://github.com/Azure/cli).
270+
More information on the az webapp deploy command, how to use and the parameter details can be found in the [az webapp deploy documentation](/cli/azure/webapp?view=azure-cli-latest#az-webapp-deploy).
271+
272+
### How do I deploy to a Container
273+
274+
With the Azure Web Deploy action, you can automate your workflow to deploy custom containers to App Service using GitHub Actions. Detailed information on the steps to deploy using GitHub Actions, can be found in the [Deploy to a Container](/azure/app-service/deploy-container-github-action).
275+
276+
### How do I update the Tomcat configuration after deployment
277+
278+
In case you would like to update any of your web apps settings after deployment, you can use the [App Service Settings](https://github.com/Azure/appservice-settings) action.
279+
280+
```yaml
281+
- uses: azure/appservice-settings@v1
282+
with:
283+
app-name: 'my-app'
284+
slot-name: 'staging' # Optional and needed only if the settings have to be configured on the specific deployment slot
285+
app-settings-json: '[{ "name": "CATALINA_OPTS", "value": "-Dfoo=bar" }]'
286+
connection-strings-json: '${{ secrets.CONNECTION_STRINGS }}'
287+
general-settings-json: '{"alwaysOn": "false", "webSocketsEnabled": "true"}' #'General configuration settings as Key Value pairs'
288+
id: settings
289+
```
290+
291+
More information on this action and how to use and configure it can be found in the [App Service Settings](https://github.com/Azure/appservice-settings) repository.
292+
238293

239294
## Next steps
240295

@@ -246,4 +301,4 @@ Check out references on Azure GitHub Actions and workflows:
246301
- [Azure/k8s-deploy action](https://github.com/Azure/k8s-deploy)
247302
- [Actions workflows to deploy to Azure](https://github.com/Azure/actions-workflow-samples)
248303
- [Starter Workflows](https://github.com/actions/starter-workflows)
249-
- [Events that trigger workflows](https://docs.github.com/en/actions/reference/events-that-trigger-workflows)
304+
- [Events that trigger workflows](https://docs.github.com/en/actions/reference/events-that-trigger-workflows)

‎articles/app-service/includes/deploy-github-actions/deploy-github-actions-openid-connect.md

Lines changed: 51 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ jobs:
120120
az logout
121121
```
122122

123-
# [Java](#tab/java)
123+
# [Java SE](#tab/java)
124124

125125
Build and deploy a Java Spring app to Azure using an Azure service principal. The example uses GitHub secrets for the `client-id`, `tenant-id`, and `subscription-id` values. You can also pass these values directly in the login action.
126126

@@ -164,6 +164,56 @@ jobs:
164164
az logout
165165
```
166166

167+
# [Tomcat](#tab/tomcat)
168+
169+
```yaml
170+
name: Build and deploy WAR app to Azure Web App using OpenID Connect
171+
172+
env:
173+
JAVA_VERSION: '11' # set this to the Java version to use
174+
DISTRIBUTION: microsoft # set this to the Java distribution
175+
AZURE_WEBAPP_NAME: sampleapp # set this to the name of your web app
176+
177+
on: [push]
178+
179+
permissions:
180+
id-token: write
181+
contents: read
182+
183+
jobs:
184+
build:
185+
runs-on: ubuntu-latest
186+
187+
steps:
188+
- uses: actions/checkout@v4
189+
190+
- name: Set up Java version
191+
uses: actions/[email protected]
192+
with:
193+
java-version: ${{ env.JAVA_VERSION }}
194+
distribution: ${{ env.DISTRIBUTION }}
195+
cache: 'maven'
196+
197+
- name: Build with Maven
198+
run: mvn clean install
199+
200+
- name: Login to Azure
201+
uses: azure/login@v2
202+
with:
203+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
204+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
205+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
206+
207+
- name: Deploy to Azure Web App
208+
id: deploy-to-webapp
209+
uses: azure/webapps-deploy@v3
210+
with:
211+
app-name: ${{ env.AZURE_WEBAPP_NAME }}
212+
package: '*.war'
213+
```
214+
215+
You can find this full example using multiple jobs for build and deploy [here](https://github.com/Azure-Samples/onlinebookstore/blob/master/.github/workflows/azure-webapps-java-war-oidc.yml) as well.
216+
167217
# [Node.js](#tab/nodejs)
168218

169219
```yaml

0 commit comments

Comments
 (0)