Skip to content

Commit 8b5f6be

Browse files
TedA-MTedA-M
authored
Merge pull request #101308 from MikeDodaro/gitHubCICDActions
Git hub CICD actions
2 parents d5e168e + 34f7ff1 commit 8b5f6be

File tree

10 files changed

+326
-8
lines changed

10 files changed

+326
-8
lines changed

‎articles/spring-cloud/media/github-actions/actions1.png

74.1 KB
Loading

‎articles/spring-cloud/media/github-actions/actions2.png

149 KB
Loading

‎articles/spring-cloud/media/github-actions/actions3.png

53.2 KB
Loading

‎articles/spring-cloud/media/github-actions/actions4.png

42.7 KB
Loading

‎articles/spring-cloud/media/github-actions/key-vault1.png

106 KB
Loading

‎articles/spring-cloud/media/github-actions/key-vault2.png

57 KB
Loading

‎articles/spring-cloud/media/github-actions/key-vault3.png

39.2 KB
Loading

‎articles/spring-cloud/spring-cloud-github-actions-key-vault.md

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
---
2+
title: Authenticate Azure Spring Cloud with Key Vault in GitHub Actions
3+
description: How to use key vault with CI/CD workflow for Azure Spring Cloud with GitHub Actions
4+
author: MikeDodaro
5+
ms.author: barbkess
6+
ms.service: spring-cloud
7+
ms.topic: how-to
8+
ms.date: 01/20/2019
9+
---
10+
11+
# Authenticate Azure Spring Cloud with Key Vault in GitHub Actions
12+
Key vault is a secure place to store keys. Enterprise users need to store credentials for CI/CD environments in scope that they control. The key to get credentials in the key vault should be limited to resource scope. It has access to only the key vault scope, not the entire Azure scope. It's like a key that can only open a strong box not a master key that can open all doors in a building. It's a way to get a key with another key, which is useful in a CICD workflow.
13+
14+
## Generate Credential
15+
To generate a key to access the key vault, execute command below on your local machine:
16+
```
17+
az ad sp create-for-rbac --role contributor --scopes /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.KeyVault/vaults/<KEY_VAULT> --sdk-auth
18+
```
19+
The scope specified by the `--scopes` parameter limits the key access to the resource. It can only access the strong box.
20+
21+
With results:
22+
```
23+
{
24+
"clientId": "<GUID>",
25+
"clientSecret": "<GUID>",
26+
"subscriptionId": "<GUID>",
27+
"tenantId": "<GUID>",
28+
"activeDirectoryEndpointUrl": "https://login.microsoftonline.com",
29+
"resourceManagerEndpointUrl": "https://management.azure.com/",
30+
"activeDirectoryGraphResourceId": "https://graph.windows.net/",
31+
"sqlManagementEndpointUrl": "https://management.core.windows.net:8443/",
32+
"galleryEndpointUrl": "https://gallery.azure.com/",
33+
"managementEndpointUrl": "https://management.core.windows.net/"
34+
}
35+
```
36+
Then save the results to GitHub **secrets** as described in [Set up your GitHub repository and authenticate with Azure](./spring-cloud-howto-github-actions.md#set-up-github-repository-and-authenticate).
37+
38+
## Add Access Policies for the Credential
39+
The credential you created above can get only general information about the Key Vault, not the contents it stores. To get secrets stored in the Key Vault, you need set access policies for the credential.
40+
41+
Go to the **Key Vault** dashboard in Azure portal, click the **Access control** menu, then open the **Role assignments** tab. Select **Apps** for **Type** and `This resource` for **scope**. You should see the credential you created in previous step:
42+
43+
![Set access policy](./media/github-actions/key-vault1.png)
44+
45+
Copy the credential name, for example, `azure-cli-2020-01-19-04-39-02`. Open the **Access policies** menu, click **+Add Access Policy** link. Select `Secret Management` for **Template**, then select **Principal**. Paste the credential name in **Principal**/**Select** input box:
46+
47+
![Select](./media/github-actions/key-vault2.png)
48+
49+
Click the **Add** button in the **Add access policy** dialog, then click **Save**.
50+
51+
## Generate full-scope Azure Credential
52+
This is the master key to open all doors in the building. The procedure is similar to the previous step, but here we change the scope to generate the master key:
53+
54+
```
55+
az ad sp create-for-rbac --role contributor --scopes /subscriptions/<SUBSCRIPTION_ID> --sdk-auth
56+
```
57+
58+
Again, results:
59+
```
60+
{
61+
"clientId": "<GUID>",
62+
"clientSecret": "<GUID>",
63+
"subscriptionId": "<GUID>",
64+
"tenantId": "<GUID>",
65+
"activeDirectoryEndpointUrl": "https://login.microsoftonline.com",
66+
"resourceManagerEndpointUrl": "https://management.azure.com/",
67+
"activeDirectoryGraphResourceId": "https://graph.windows.net/",
68+
"sqlManagementEndpointUrl": "https://management.core.windows.net:8443/",
69+
"galleryEndpointUrl": "https://gallery.azure.com/",
70+
"managementEndpointUrl": "https://management.core.windows.net/"
71+
}
72+
```
73+
Copy the entire JSON string. Bo back to **Key Vault** dashboard. Open the **Secrets** menu, then click the **Generate/Import** button. Input the secret name, such as `AZURE-CRENDENTIALS-FOR-SPRING`. Paste the JSON credential string to the **Value** input box. You may notice the value input box is a one-line text field, rather than a multi-line text area. You can paste the complete JSON string there.
74+
75+
![Full scope credential](./media/github-actions/key-vault3.png)
76+
77+
## Combine credentials in GitHub Actions
78+
Set the credentials used when the CICD pipeline executes:
79+
80+
```
81+
on: [push]
82+
83+
jobs:
84+
build:
85+
runs-on: ubuntu-latest
86+
steps:
87+
- uses: azure/login@v1
88+
with:
89+
creds: ${{ secrets.AZURE_CREDENTIALS }} # Strong box key you generated in the first step
90+
- uses: Azure/[email protected]
91+
with:
92+
keyvault: "zlhe-test"
93+
secrets: "AZURE-CREDENTIALS-FOR-SPRING" # Master key to open all doors in the building
94+
id: keyvaultaction
95+
- uses: azure/login@v1
96+
with:
97+
creds: ${{ steps.keyvaultaction.outputs.AZURE-CREDENTIALS-FOR-SPRING }}
98+
- name: Azure CLI script
99+
uses: azure/CLI@v1
100+
with:
101+
azcliversion: 2.0.75
102+
inlineScript: |
103+
az extension add --name spring-cloud # Spring CLI commands from here
104+
az spring-cloud list
105+
106+
```
107+
108+
## Next steps
109+
* [Spring Cloud GitHub Actions](./spring-cloud-howto-github-actions.md)

‎articles/spring-cloud/spring-cloud-howto-github-actions.md

Lines changed: 205 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
---
2+
title: Azure Spring Cloud CI/CD with GitHub Actions
3+
description: How to build up CI/CD workflow for Azure Spring Cloud with GitHub Actions
4+
author: MikeDodaro
5+
ms.author: barbkess
6+
ms.service: spring-cloud
7+
ms.topic: how-to
8+
ms.date: 01/15/2019
9+
---
10+
# Azure Spring Cloud CI/CD with GitHub Actions
11+
12+
GitHub Actions support an automated software development lifecycle workflow. With GitHub Actions for Azure Spring Cloud you can create workflows in your repository to build, test, package, release, and deploy to Azure.
13+
14+
## Prerequisites
15+
This example requires the [Azure CLI](https://docs.microsoft.com/cli/azure/install-azure-cli?view=azure-cli-latest).
16+
17+
## Set up GitHub repository and authenticate
18+
You need an Azure service principle credential to authorize Azure login action. To get an Azure credential, execute the following commands on your local machine:
19+
```
20+
az login
21+
az ad sp create-for-rbac --role contributor --scopes /subscriptions/<SUBSCRIPTION_ID> --sdk-auth
22+
```
23+
To access to a specific resource group, you can reduce the scope:
24+
```
25+
az ad sp create-for-rbac --role contributor --scopes /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP> --sdk-auth
26+
```
27+
The command should output a JSON object:
28+
```JSON
29+
{
30+
"clientId": "<GUID>",
31+
"clientSecret": "<GUID>",
32+
"subscriptionId": "<GUID>",
33+
"tenantId": "<GUID>",
34+
...
35+
}
36+
```
37+
38+
This example uses the [Piggy Metrics](https://github.com/Azure-Samples/piggymetrics) sample on GitHub. Fork the sample, open GitHub repository page, and click **Settings** tab. Open **Secrets** menu, and click **Add a new secret**:
39+
40+
![Add new secret](./media/github-actions/actions1.png)
41+
42+
Set the secret name to `AZURE_CREDENTIALS` and its value to the JSON string that you found under the heading *Set up your GitHub repository and authenticate*.
43+
44+
![Set secret data](./media/github-actions/actions2.png)
45+
46+
You can also get the Azure login credential from Key Vault in GitHub actions as explained in [Authenticate Azure Spring with Key Vault in GitHub Actions](./spring-cloud-github-actions-key-vault.md).
47+
48+
## Provision service instance
49+
To provision your Azure Spring Cloud service instance, run the following commands using the Azure CLI.
50+
```
51+
az extension add --name spring-cloud
52+
az group create --location eastus --name <resource group name>
53+
az spring-cloud create -n <service instance name> -g <resource group name>
54+
az spring-cloud config-server git set -n <service instance name> --uri https://github.com/xxx/piggymetrics --label config
55+
```
56+
## Build the workflow
57+
The workflow is defined using the following options.
58+
59+
### Prepare for deployment with Azure CLI
60+
The command `az spring-cloud app create` is currently not idempotent. We recommend this workflow on existing Azure Spring Cloud apps and instances.
61+
62+
Use the following Azure CLI commands for preparation:
63+
```
64+
az configure --defaults group=<service group name>
65+
az configure --defaults spring-cloud=<service instance name>
66+
az spring-cloud app create --name gateway
67+
az spring-cloud app create --name auth-service
68+
az spring-cloud app create --name account-service
69+
```
70+
71+
### Deploy with Azure CLI directly
72+
Create the `.github/workflow/main.yml` file in the repository:
73+
74+
```
75+
name: AzureSpringCloud
76+
77+
env:
78+
GROUP: <resource group name>
79+
SERVICE_NAME: <service instance name>
80+
81+
jobs:
82+
build-and-deploy:
83+
runs-on: ubuntu-latest
84+
steps:
85+
86+
- uses: actions/checkout@master
87+
88+
- name: Set up JDK 1.8
89+
uses: actions/setup-java@v1
90+
with:
91+
java-version: 1.8
92+
93+
- name: maven build, clean
94+
run: |
95+
mvn clean package -D skipTests
96+
97+
- name: Azure Login
98+
uses: azure/login@v1
99+
with:
100+
creds: ${{ secrets.AZURE_CREDENTIALS }}
101+
102+
- name: Install ASC AZ extension
103+
run: az extension add --name spring-cloud
104+
105+
- name: Deploy with AZ CLI commands
106+
run: |
107+
az configure --defaults group=$GROUP
108+
az configure --defaults spring-cloud=$SERVICE_NAME
109+
az spring-cloud app deploy -n gateway --jar-path ${{ github.workspace }}/gateway/target/gateway.jar
110+
az spring-cloud app deploy -n account-service --jar-path ${{ github.workspace }}/account-service/target/account-service.jar
111+
az spring-cloud app deploy -n auth-service --jar-path ${{ github.workspace }}/auth-service/target/auth-service.jar
112+
```
113+
### Deploy with Azure CLI action
114+
The az `run` command will use the latest version of Azure CLI. If there are breaking changes, you can also use a specific version of Azure CLI with azure/CLI `action`.
115+
116+
> [!Note]
117+
> This command will run in a new container, so `env` will not work, and cross action file access may have extra restrictions.
118+
119+
Create the .github/workflow/main.yml file in the repository:
120+
```
121+
name: AzureSpringCloud
122+
123+
jobs:
124+
build-and-deploy:
125+
runs-on: ubuntu-latest
126+
steps:
127+
128+
- uses: actions/checkout@master
129+
130+
- name: Set up JDK 1.8
131+
uses: actions/setup-java@v1
132+
with:
133+
java-version: 1.8
134+
135+
- name: maven build, clean
136+
run: |
137+
mvn clean package -D skipTests
138+
139+
- name: Azure Login
140+
uses: azure/login@v1
141+
with:
142+
creds: ${{ secrets.AZURE_CREDENTIALS }}
143+
144+
- name: Azure CLI script
145+
uses: azure/CLI@v1
146+
with:
147+
azcliversion: 2.0.75
148+
inlineScript: |
149+
az extension add --name spring-cloud
150+
az configure --defaults group=<service group name>
151+
az configure --defaults spring-cloud=<service instance name>
152+
az spring-cloud app deploy -n gateway --jar-path $GITHUB_WORKSPACE/gateway/target/gateway.jar
153+
az spring-cloud app deploy -n account-service --jar-path $GITHUB_WORKSPACE/account-service/target/account-service.jar
154+
az spring-cloud app deploy -n auth-service --jar-path $GITHUB_WORKSPACE/auth-service/target/auth-service.jar
155+
```
156+
157+
## Deploy with Maven Plugin
158+
Another option is to use the [Maven Plugin](https://docs.microsoft.com/azure/spring-cloud/spring-cloud-quickstart-launch-app-maven) for deploying the Jar and updating App settings. The command `mvn azure-spring-cloud:deploy` is idempotent and will automatically create Apps if needed. You don't need to create corresponding apps in advance.
159+
160+
```
161+
name: AzureSpringCloud
162+
163+
jobs:
164+
build-and-deploy:
165+
runs-on: ubuntu-latest
166+
steps:
167+
168+
- uses: actions/checkout@master
169+
170+
- name: Set up JDK 1.8
171+
uses: actions/setup-java@v1
172+
with:
173+
java-version: 1.8
174+
175+
- name: maven build, clean
176+
run: |
177+
mvn clean package -D skipTests
178+
179+
# Maven plugin can cosume this authentication method automatically
180+
- name: Azure Login
181+
uses: azure/login@v1
182+
with:
183+
creds: ${{ secrets.AZURE_CREDENTIALS }}
184+
185+
# Maven deploy, make sure you have correct configurations in your pom.xml
186+
- name: deploy to Azure Spring Cloud using Maven
187+
run: |
188+
mvn azure-spring-cloud:deploy
189+
```
190+
191+
## Run the workflow
192+
GitHub **Actions** should be enabled automatically after you push `.github/workflow/main.yml` to GitHub. The action will be triggered when you push a new commit. If you create this file in the browser, your action should have already run.
193+
194+
To verify that the action has been enabled, click **Actions** tab on the GitHub repository page:
195+
196+
![Verify action enabled](./media/github-actions/actions3.png)
197+
198+
If your action runs in error, for example, if you haven't set the Azure credential, you can rerun checks after fixing the error. On the GitHub repository page, click **Actions**, select the specific workflow task, and then click the **Rerun checks** button to rerun checks:
199+
200+
![Rerun checks](./media/github-actions/actions4.png)
201+
202+
## Next steps
203+
* [Key Vault for Spring Cloud GitHub actions](./spring-cloud-github-actions-key-vault.md)
204+
* [Azure Active Directory service principals](https://docs.microsoft.com/cli/azure/ad/sp?view=azure-cli-latest#az-ad-sp-create-for-rbac)
205+
* [GitHub Actions for Azure](https://github.com/Azure/actions/)

‎articles/spring-cloud/toc.yml

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,6 @@
3434
href: spring-cloud-tutorial-bind-redis.md
3535
- name: Bind your application to Azure MySQL
3636
href: spring-cloud-tutorial-bind-mysql.md
37-
- name: Deploy apps to Azure Spring Cloud using Jenkins and the Azure CLI
38-
href: /azure/jenkins/tutorial-jenkins-deploy-cli-spring-cloud-service
3937
- name: Concepts
4038
items:
4139
- name: Understanding Azure Spring Cloud quotas and limits
@@ -55,11 +53,19 @@
5553
- name: Analyze application logs and Metrics
5654
href: diagnostic-services.md
5755
- name: Stream Azure Spring Cloud app logs in real-time
58-
href: spring-cloud-howto-log-streaming.md
59-
- name: Automate your CI/CD pipeline in Azure Spring Cloud
60-
href: spring-cloud-howto-cicd.md
56+
href: spring-cloud-howto-log-streaming.md
6157
- name: Use persistent storage in Azure Spring Cloud
62-
href: spring-cloud-howto-persistent-storage.md
58+
href: spring-cloud-howto-persistent-storage.md
59+
- name: DevOps Deployment to Azure Spring Cloud
60+
items:
61+
- name: CI/CD with Azure DevOps
62+
href: spring-cloud-howto-cicd.md
63+
- name: CI/CD with GitHub Actions
64+
href: spring-cloud-howto-github-actions.md
65+
- name: Auth Azure Spring Cloud with Key Vault in GitHub actions
66+
href: spring-cloud-github-actions-key-vault.md
67+
- name: CI/CD with Jenkins
68+
href: /azure/jenkins/tutorial-jenkins-deploy-cli-spring-cloud-service
6369
- name: Reference
6470
items:
6571
- name: Azure CLI Plugin
@@ -70,5 +76,3 @@
7076
href: spring-cloud-faq.md
7177
- name: Troubleshooting Guide
7278
href: spring-cloud-troubleshoot.md
73-
74-

0 commit comments

Comments
 (0)