Skip to content

Commit 74c45f4

Browse files
damienjburksdamienjburks
committed
updating latest for now
1 parent bb7974b commit 74c45f4

File tree

9 files changed

+180
-62
lines changed

9 files changed

+180
-62
lines changed

‎.github/workflows/main.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
on:
2+
push:
3+
branches:
4+
- main
5+
workflow_dispatch:
6+
7+
jobs:
8+
terraform-apply-eks:
9+
uses: ./.github/workflows/terraform-apply-eks.yml
10+
permissions:
11+
contents: read
12+
secrets: inherit
13+
terraform-apply-pipelines:
14+
needs: terraform-apply-eks
15+
uses: ./.github/workflows/terraform-apply-pipelines.yml
16+
permissions:
17+
contents: read
18+
secrets: inherit

‎.github/workflows/terraform-apply.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: "Terraform Apply"
2+
3+
on:
4+
workflow_call:
5+
6+
env:
7+
TF_CLOUD_ORGANIZATION: "DSB"
8+
TF_API_TOKEN: "${{ secrets.TF_API_TOKEN }}"
9+
TF_WORKSPACE: "azure-devsecops-pipelines"
10+
CONFIG_DIRECTORY: "./terraform/pipelines"
11+
12+
jobs:
13+
terraform:
14+
name: "Terraform Apply"
15+
runs-on: ubuntu-latest
16+
permissions:
17+
contents: read
18+
steps:
19+
- name: Checkout
20+
uses: actions/checkout@v4
21+
22+
- name: Upload Configuration
23+
uses: hashicorp/tfc-workflows-github/actions/upload-configuration@v1.3.1
24+
id: apply-upload
25+
with:
26+
workspace: ${{ env.TF_WORKSPACE }}
27+
directory: ${{ env.CONFIG_DIRECTORY }}
28+
29+
- name: Create Apply Run
30+
uses: hashicorp/tfc-workflows-github/actions/create-run@v1.3.1
31+
id: apply-run
32+
with:
33+
workspace: ${{ env.TF_WORKSPACE }}
34+
configuration_version: ${{ steps.apply-upload.outputs.configuration_version_id }}
35+
36+
- name: Apply
37+
uses: hashicorp/tfc-workflows-github/actions/apply-run@v1.3.1
38+
if: fromJSON(steps.apply-run.outputs.payload).data.attributes.actions.IsConfirmable
39+
id: apply
40+
with:
41+
run: ${{ steps.apply-run.outputs.run_id }}
42+
comment: "Apply Run from GitHub Actions CI ${{ github.sha }}"

‎.github/workflows/terraform-lint.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: Terraform Linting and Formatting
2+
3+
on:
4+
workflow_call:
5+
6+
jobs:
7+
lint-and-format:
8+
name: Lint and Format Terraform Files
9+
runs-on: ubuntu-latest
10+
11+
steps:
12+
- name: Checkout repository
13+
uses: actions/checkout@v3
14+
15+
- name: Set up Terraform
16+
uses: hashicorp/setup-terraform@v2
17+
with:
18+
terraform_version: latest
19+
20+
- name: Format Terraform files
21+
run: terraform fmt -check

‎README.md‎

Lines changed: 94 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,98 @@
1-
# Azure DevSecOps Pipeline
1+
# Azure DevSecOps Pipeline - Terraform
22

3-
:construction: Still a work in progress :construction:
3+
![License](https://img.shields.io/github/license/devsecblueprint/azure-devsecops-pipeline?logo=license&style=for-the-badge)
4+
![Terraform Cloud](https://img.shields.io/badge/Terraform-Registry-purple?logo=terraform&style=for-the-badge)
5+
![GitHub Issues](https://img.shields.io/github/issues/devsecblueprint/azure-devsecops-pipeline?logo=github&style=for-the-badge)
6+
![GitHub Forks](https://img.shields.io/github/forks/devsecblueprint/azure-devsecops-pipeline?logo=github&style=for-the-badge)
7+
![GitHub Stars](https://img.shields.io/github/stars/devsecblueprint/azure-devsecops-pipeline?logo=github&style=for-the-badge)
8+
![GitHub Last Commit](https://img.shields.io/github/last-commit/devsecblueprint/azure-devsecops-pipeline?logo=github&style=for-the-badge)
9+
![CI Status](https://img.shields.io/github/actions/workflow/status/devsecblueprint/azure-devsecops-pipeline/main.yml?style=for-the-badge&logo=github)
410

5-
## References
11+
## Overview
12+
13+
This project provides an automated **DevSecOps pipeline** for deploying and securing infrastructure on **Azure** using **Terraform** and **Terraform Cloud**. The pipeline is defined in `azure-pipelines.yml` and leverages reusable templates under `.azdo-pipelines/pipeline_templates/` for modular, secure, and maintainable builds.
14+
15+
## Requirements
16+
17+
- **Terraform** (latest stable version)
18+
- **Terraform Cloud** account
19+
- **Azure** subscription with appropriate RBAC permissions
20+
- **Azure DevOps** account for running pipelines
21+
22+
## Pipeline Workflow
23+
24+
The main pipeline (`azure-pipelines.yml`) orchestrates the following stages:
25+
26+
1. **Build Docker Image**
27+
Uses [`build-image.yml`](.azdo-pipelines/pipeline_templates/build-image.yml) to build container images from source code using Azure DevOps agents.
28+
29+
2. **Lint and Format**
30+
Uses [`linting.yml`](.azdo-pipelines/pipeline_templates/linting.yml) to enforce Python code formatting and linting (Python 3.12.6 by default).
31+
32+
3. **Unit & Security Testing**
33+
Uses [`unit-sec-scan.yml`](.azdo-pipelines/pipeline_templates/unit-sec-scan.yml) to run unit tests and basic security checks before publishing artifacts.
34+
35+
4. **Push Docker Image**
36+
Uses [`push-image.yml`](.azdo-pipelines/pipeline_templates/push-image.yml) to push the validated image to Azure Container Registry (ACR).
37+
38+
## Repository Structure
39+
40+
```bash
41+
.azdo-pipelines/
42+
├── azure-pipelines.yml # Main Azure DevOps pipeline
43+
└── pipeline_templates/ # Modular templates
44+
├── build-image.yml # Build container images
45+
├── linting.yml # Code linting & formatting
46+
├── push-image.yml # Push image to ACR
47+
├── sample-push.yml # Example template for image push
48+
└── unit-sec-scan.yml # Unit + security testing
49+
50+
terraform/
51+
├── main.tf # Core Terraform configuration
52+
├── acr_aks.tf # Azure Container Registry + AKS
53+
├── providers.tf # Provider configuration
54+
├── variables.tf # Input variables
55+
├── variable-group.tf # Variable groups integration
56+
└── outputs.tf # Outputs
57+
```
58+
59+
## Setup Instructions
660

7-
https://dev.to/this-is-learning/deploy-azure-infrastructure-using-terraform-cloud-3j9d
61+
### 1. **Terraform Cloud Setup**
62+
63+
- Create an account on [Terraform Cloud](https://app.terraform.io/).
64+
- Generate an API key and store it in Azure DevOps as a secure variable.
65+
- Create workspaces for your infrastructure modules.
66+
67+
### 2. **Configure Azure Credentials**
68+
69+
- Follow [Terraform Dynamic Provider Credentials](https://developer.hashicorp.com/terraform/cloud-docs/workspaces/dynamic-provider-credentials/azure-configuration).
70+
- Ensure your Service Principal or Managed Identity has proper roles (Contributor, AcrPush, AKS permissions).
71+
72+
### 3. **Initialize Terraform**
73+
74+
From the `terraform/` folder:
75+
76+
```bash
77+
terraform init
78+
terraform plan
79+
```
80+
81+
### 4. **Run the Pipeline**
82+
83+
- Connect your repository to Azure DevOps.
84+
- Trigger the pipeline defined in `.azdo-pipelines/azure-pipelines.yml`.
85+
86+
## Environment Variables
87+
88+
Configure the following in **Terraform Cloud** or **Azure DevOps Variable Groups**:
89+
90+
- `ARM_CLIENT_ID`
91+
- `ARM_CLIENT_SECRET`
92+
- `ARM_SUBSCRIPTION_ID`
93+
- `ARM_TENANT_ID`
94+
95+
## References
896

9-
https://developer.hashicorp.com/terraform/cloud-docs/workspaces/dynamic-provider-credentials/azure-configuration#configure-hcp-terraform
97+
- [Deploy Azure Infrastructure using Terraform Cloud](https://dev.to/this-is-learning/deploy-azure-infrastructure-using-terraform-cloud-3j9d)
98+
- [Terraform Cloud: Dynamic Provider Credentials for Azure](https://developer.hashicorp.com/terraform/cloud-docs/workspaces/dynamic-provider-credentials/azure-configuration#configure-hcp-terraform)

‎main.tf‎

Lines changed: 0 additions & 18 deletions
This file was deleted.

‎provider.tf‎

Lines changed: 0 additions & 21 deletions
This file was deleted.

‎terraform/acr_aks.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ resource "azurerm_kubernetes_cluster" "this_aks_cluster" {
2828
}
2929

3030
identity {
31-
type = "UserAssigned"
31+
type = "UserAssigned"
3232
identity_ids = [azurerm_user_assigned_identity.this_uaid.id]
3333
}
3434

@@ -39,6 +39,6 @@ resource "azurerm_kubernetes_cluster" "this_aks_cluster" {
3939
azurerm_role_assignment.uaid_contributor,
4040
azurerm_role_assignment.acr_pull,
4141
azurerm_role_assignment.acr_push
42-
]
42+
]
4343
}
4444

‎terraform/variable-group.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ resource "azuredevops_variable_group" "infra_variable_group" {
2929

3030
}
3131

32-
variable {
32+
variable {
3333
name = "ACR_SERVICE_CONNECTION"
3434
secret_value = azuredevops_serviceendpoint_azurecr.acr_registry_endpoint.id
3535
is_secret = true
@@ -43,9 +43,9 @@ resource "azuredevops_variable_group" "infra_variable_group" {
4343
# }
4444

4545
variable {
46-
name = "image_repo"
46+
name = "image_repo"
4747
secret_value = var.fast_api_git_repo
48-
is_secret = true
48+
is_secret = true
4949

5050
}
5151

‎variables.tf‎

Lines changed: 0 additions & 13 deletions
This file was deleted.

0 commit comments

Comments
 (0)