Skip to content

Fix all services failing in AKS: add missing secrets, fix image refs #530

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aurelianware merged 1 commit into from
Mar 20, 2026
Merged

Fix all services failing in AKS: add missing secrets, fix image refs #530

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 47 additions & 0 deletions .github/workflows/deploy-azure-aks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -325,12 +325,58 @@ jobs:
-n ${{ env.NAMESPACE }} \
--dry-run=client -o yaml | kubectl apply -f -

- name: Create MongoDB secret (Cosmos DB MongoDB API)
run: |
kubectl create secret generic mongodb-secret \
--from-literal=connectionString="${{ secrets.COSMOS_DB_CONNECTION_STRING }}" \
-n ${{ env.NAMESPACE }} \
--dry-run=client -o yaml | kubectl apply -f -
Comment on lines +328 to +333
Copy link

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow is interpolating GitHub secrets directly into the shell script (e.g., "${{ secrets.COSMOS_DB_CONNECTION_STRING }}"). If any secret contains characters like $( or backticks, bash will evaluate them during script parsing, and even benign characters can cause quoting/escaping issues. Prefer passing secrets via the step env: block and referencing them as normal shell variables when building kubectl create secret commands (this avoids re-parsing secret contents by the shell).

Copilot uses AI. Check for mistakes.

- name: Create Cosmos DB endpoint/key secret
run: |
kubectl create secret generic cosmos-db-secret \
--from-literal=endpoint="${{ secrets.COSMOS_DB_ENDPOINT }}" \
--from-literal=key="${{ secrets.COSMOS_DB_KEY }}" \
-n ${{ env.NAMESPACE }} \
--dry-run=client -o yaml | kubectl apply -f -
Comment on lines +335 to +341
Copy link

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These secret-creation steps will still succeed if the required GitHub secrets are missing (GitHub expressions become empty strings), resulting in Kubernetes Secrets with empty values and hard-to-diagnose runtime failures. Add an explicit validation/guard in the run block (or a dedicated step) to fail the job when required values like COSMOS_DB_ENDPOINT/COSMOS_DB_KEY are unset or empty before calling kubectl create secret.

Copilot uses AI. Check for mistakes.

- name: Create Cosmos config secret (trading-partner)
run: |
kubectl create secret generic cosmos-config \
--from-literal=endpoint="${{ secrets.COSMOS_DB_ENDPOINT }}" \
--from-literal=key="${{ secrets.COSMOS_DB_KEY }}" \
-n ${{ env.NAMESPACE }} \
--dry-run=client -o yaml | kubectl apply -f -

- name: Create Redis secret
run: |
kubectl create secret generic redis-secret \
--from-literal=connectionString="${{ secrets.REDIS_CONNECTION_STRING }}" \
-n ${{ env.NAMESPACE }} \
--dry-run=client -o yaml | kubectl apply -f -

- name: Create Kafka secret
run: |
kubectl create secret generic kafka-secret \
--from-literal=saslUsername="${{ secrets.KAFKA_SASL_USERNAME }}" \
--from-literal=saslPassword="${{ secrets.KAFKA_SASL_PASSWORD }}" \
-n ${{ env.NAMESPACE }} \
--dry-run=client -o yaml | kubectl apply -f -

- name: Create Azure Storage secret
run: |
kubectl create secret generic azure-storage-secret \
--from-literal=connectionString="${{ secrets.AZURE_STORAGE_CONNECTION_STRING }}" \
-n ${{ env.NAMESPACE }} \
--dry-run=client -o yaml | kubectl apply -f -

- name: Create Azure AD secret
run: |
kubectl create secret generic azure-ad-config \
--from-literal=TenantId="${{ secrets.AZURE_AD_TENANT_ID }}" \
--from-literal=ClientId="${{ secrets.AZURE_AD_CLIENT_ID }}" \
--from-literal=ClientSecret="${{ secrets.AZURE_AD_CLIENT_SECRET }}" \
--from-literal=Audience="${{ secrets.AZURE_AD_AUDIENCE }}" \
-n ${{ env.NAMESPACE }} \
--dry-run=client -o yaml | kubectl apply -f -

Expand Down Expand Up @@ -380,6 +426,7 @@ jobs:
echo "Applying ${manifest}..."
sed \
-e "s|choacrhy6h2vdulfru6.azurecr.io/cloudhealthoffice-|${ACR}/cloudhealthoffice-|g" \
-e "s|ghcr.io/aurelianware/cloudhealthoffice-|${ACR}/cloudhealthoffice-|g" \
-e "s|:latest|:${SHA}|g" \
"$manifest" \
| kubectl apply -f -
Expand Down
2 changes: 1 addition & 1 deletion src/services/trading-partner-service/k8s/trading-partner-service-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ spec:
image: ghcr.io/aurelianware/cloudhealthoffice-trading-partner-service:latest
imagePullPolicy: Always
ports:
- containerPort: 80
- containerPort: 8080
name: http
env:
- name: ASPNETCORE_ENVIRONMENT
Expand Down
Loading