KasVisie/azure-pipelines.yml at main · MinFin-NL/KasVisie · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
trigger:
  branches:
    include:
      - main

pool:
  name: alz-p-mgmt-we-ccoe-pool

variables:
  - group: kasvisie_secrets
  # Provides ALLOWED_IP_1 and ALLOWED_IP_2 (IPs/CIDRs for the ingress
  # access-restriction rules), same convention as invulhulp.
  - name: IMAGE_NAME
    value: kasvisie
  - name: RESOURCE_GROUP
    value: rg-kasvisie-inno-d
  - name: LOCATION
    value: westeurope
  - name: ACR_NAME
    value: acrkasvisieinnod
  - name: CONTAINER_APP_ENV
    value: cae-invulhulp-inno-d
  - name: CONTAINER_APP_ENV_RESOURCE_GROUP
    # cae-invulhulp-inno-d is owned by the invulhulp app and lives in its own
    # resource group. westeurope has been rejecting new managed environments
    # (ManagedEnvironmentCapacityHeavyUsageError), so kasvisie deploys into this
    # existing shared environment instead of creating its own.
    value: rg-invulhulp-inno-d
  - name: CONTAINER_APP
    value: ca-kasvisie-inno-d

stages:
  - stage: Build
    displayName: Build and push image
    jobs:
      - job: Build
        displayName: Docker build and push to ACR
        steps:
          - task: AzureCLI@2
            displayName: Ensure ACR exists
            env:
              RESOURCE_GROUP: $(RESOURCE_GROUP)
              ACR_NAME: $(ACR_NAME)
              LOCATION: $(LOCATION)
            inputs:
              azureSubscription: ccoe-ipf-d-inno-spn-cicd
              scriptType: bash
              scriptLocation: inlineScript
              inlineScript: |
                set -euo pipefail
                # Idempotent: create returns the existing registry unchanged.
                az acr create \
                  --name "$ACR_NAME" \
                  --resource-group "$RESOURCE_GROUP" \
                  --location "$LOCATION" \
                  --sku Basic \
                  --admin-enabled true \
                  --output none

          - task: AzureCLI@2
            displayName: Build and push image
            env:
              IMAGE_TAG: $(Build.SourceVersion)
              IMAGE_NAME: $(IMAGE_NAME)
              ACR_NAME: $(ACR_NAME)
            inputs:
              azureSubscription: ccoe-ipf-d-inno-spn-cicd
              scriptType: bash
              scriptLocation: inlineScript
              inlineScript: |
                set -euo pipefail
                ACR_LOGIN_SERVER=$(az acr show --name "$ACR_NAME" --query loginServer -o tsv)
                az acr login --name "$ACR_NAME"
                docker build \
                  -t "$ACR_LOGIN_SERVER/$IMAGE_NAME:$IMAGE_TAG" \
                  -t "$ACR_LOGIN_SERVER/$IMAGE_NAME:latest" .
                docker push "$ACR_LOGIN_SERVER/$IMAGE_NAME:$IMAGE_TAG"
                docker push "$ACR_LOGIN_SERVER/$IMAGE_NAME:latest"

  - stage: Deploy
    displayName: Deploy to Container Apps
    dependsOn: Build
    jobs:
      - job: Deploy
        displayName: Deploy container app
        steps:
          - task: AzureCLI@2
            displayName: Resolve shared Container Apps environment
            env:
              CONTAINER_APP_ENV: $(CONTAINER_APP_ENV)
              CONTAINER_APP_ENV_RESOURCE_GROUP: $(CONTAINER_APP_ENV_RESOURCE_GROUP)
            inputs:
              azureSubscription: ccoe-ipf-d-inno-spn-cicd
              scriptType: bash
              scriptLocation: inlineScript
              inlineScript: |
                set -euo pipefail
                # Only reads the existing environment - it belongs to invulhulp and
                # is never created/modified from this pipeline.
                ENV_ID=$(az containerapp env show \
                  --name "$CONTAINER_APP_ENV" \
                  --resource-group "$CONTAINER_APP_ENV_RESOURCE_GROUP" \
                  --query id -o tsv)
                echo "##vso[task.setvariable variable=CONTAINER_APP_ENV_ID]$ENV_ID"

          - task: AzureCLI@2
            displayName: Deploy container app
            env:
              IMAGE_TAG: $(Build.SourceVersion)
              IMAGE_NAME: $(IMAGE_NAME)
              ACR_NAME: $(ACR_NAME)
              RESOURCE_GROUP: $(RESOURCE_GROUP)
              CONTAINER_APP_ENV_ID: $(CONTAINER_APP_ENV_ID)
              CONTAINER_APP: $(CONTAINER_APP)
            inputs:
              azureSubscription: ccoe-ipf-d-inno-spn-cicd
              scriptType: bash
              scriptLocation: inlineScript
              inlineScript: |
                set -euo pipefail
                ACR_LOGIN_SERVER=$(az acr show --name "$ACR_NAME" --query loginServer -o tsv)
                ACR_USER=$(az acr credential show --name "$ACR_NAME" --query username -o tsv)
                ACR_PASS=$(az acr credential show --name "$ACR_NAME" --query "passwords[0].value" -o tsv)

                if az containerapp show --name "$CONTAINER_APP" --resource-group "$RESOURCE_GROUP" &>/dev/null; then
                  az containerapp update \
                    --name "$CONTAINER_APP" \
                    --resource-group "$RESOURCE_GROUP" \
                    --image "$ACR_LOGIN_SERVER/$IMAGE_NAME:$IMAGE_TAG" \
                    --min-replicas 1 \
                    --max-replicas 2
                else
                  az containerapp create \
                    --name "$CONTAINER_APP" \
                    --resource-group "$RESOURCE_GROUP" \
                    --environment "$CONTAINER_APP_ENV_ID" \
                    --image "$ACR_LOGIN_SERVER/$IMAGE_NAME:$IMAGE_TAG" \
                    --registry-server "$ACR_LOGIN_SERVER" \
                    --registry-username "$ACR_USER" \
                    --registry-password "$ACR_PASS" \
                    --ingress external \
                    --target-port 8000 \
                    --cpu 0.5 --memory 1.0Gi \
                    --min-replicas 1 --max-replicas 2
                fi

          - task: AzureCLI@2
            displayName: Apply firewall rules
            env:
              CONTAINER_APP: $(CONTAINER_APP)
              RESOURCE_GROUP: $(RESOURCE_GROUP)
              ALLOWED_IP_1: $(ALLOWED_IP_1)
              ALLOWED_IP_2: $(ALLOWED_IP_2)
            inputs:
              azureSubscription: ccoe-ipf-d-inno-spn-cicd
              scriptType: bash
              scriptLocation: inlineScript
              inlineScript: |
                az containerapp ingress access-restriction set \
                  --name "$CONTAINER_APP" \
                  --resource-group "$RESOURCE_GROUP" \
                  --rule-name "allowed-ip-1" \
                  --ip-address "$ALLOWED_IP_1" \
                  --action Allow
                az containerapp ingress access-restriction set \
                  --name "$CONTAINER_APP" \
                  --resource-group "$RESOURCE_GROUP" \
                  --rule-name "allowed-ip-2" \
                  --ip-address "$ALLOWED_IP_2" \
                  --action Allow