deploy-app-ui.yml

name: Deploy API-Gateway
env:

  # ==== Versions ====
  
  DEPLOYMENT_VERSION: 2.6.13
  AZ_CLI_VERSION: 2.45.0
  JAVA_VERSION: 11

  # ==== General settings  ====

  APP_NAME: tap42
  LOCATION: westeurope # francecentral
  RG_KV: rg-kv-tanzu101 # RG where to deploy KV
  RG_APP: rg-aks-tap-apps # RG where to deploy the other Azure services: AKS, TAP, ACR, MySQL, etc.
  
  #DNS
  DNS_ZONE: cloudapp.azure.com
  APP_DNS_ZONE: tap.westeurope.cloudapp.azure.com
  CUSTOM_DNS: javaonazurehandsonlabs.com
  AZURE_DNS_LABEL_NAME: petclinictapsaks
  
  TAP_NAMESPACE: tanzu
  PETCLINIC_NAMESPACE: petclinic
  REPOSITORY: tap                   # set this to your ACR repository

  ################################## DO NOT CHANGE params below   ##################################

  # ==== Azure storage ====:
  
  # https://learn.microsoft.com/en-us/rest/api/storageservices/setting-timeouts-for-blob-service-operations
  AZ_BLOB_MAX_CONNECTIONS: 5
  AZ_BLOB_MAXSIZE_CONDITION: 104857600
  AZ_BLOB_TIMEOUT: 600
  
  # ==== APPS ====

  CLOUD_PROVIDER_ENV: azure
  PRJ_PREFIX: spring-petclinic

  API_GATEWAY: api-gateway
  ADMIN_SERVER: admin-server
  CUSTOMERS_SERVICE: customers-service
  VETS_SERVICE: vets-service
  VISITS_SERVICE: visits-service

  CONFIG_SERVER: config-server
  DISCOVERY_SERVER: discovery-server

  # ==== Secrets ====

  credentials: ${{ secrets.AZURE_CREDENTIALS }}
  AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
  AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

  SPRING_CLOUD_AZURE_KEY_VAULT_ENDPOINT: ${{ secrets.SPRING_CLOUD_AZURE_KEY_VAULT_ENDPOINT }}
  SPRING_CLOUD_AZURE_TENANT_ID: ${{ secrets.SPRING_CLOUD_AZURE_TENANT_ID }}

on:
  workflow_call:
    inputs: # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onworkflow_callinputs
      tag_id:
        description: the Image Tag ID
        required: true
        type: string  
  workflow_dispatch:
    inputs: # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onworkflow_dispatchinputs
      tag_id:
        description: the Image Tag ID
        required: true
        type: string


jobs:
  deploy-ui:
    runs-on: ubuntu-latest
    steps:

    - name: Checkout
      uses: actions/checkout@v3

    - name: Azure Login
      uses: azure/login@v1 # https://github.com/marketplace/actions/azure-login
      with:
        creds: ${{ env.credentials }}

    # https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#environment-files
    # /!\ IMPORTANT:  The step that creates or updates the environment variable does not have access to the new value, but all subsequent steps in a job will have access.
    - name: Set Base environment variables
      run: |

        echo "API_GATEWAY_FOLDER=${{ env.PRJ_PREFIX }}-${{ env.API_GATEWAY }}" >> $GITHUB_ENV
        echo "GH_WORKSPACE=${{ github.workspace }}" >> $GITHUB_ENV # "/github/workspace"

        storage_name=$(az deployment group show --name storage -g ${{ env.RG_APP }} --query properties.outputs.azurestorageName.value -o tsv)
        echo "storage_name=" $storage_name
        echo "AZ_STORAGE_NAME="$storage_name >> $GITHUB_ENV

        blobContainerName=$(az deployment group show --name storage -g ${{ env.RG_APP }} --query properties.outputs.blobcontainerName.value -o tsv)
        echo "blobContainerName=" $blobContainerName
        echo "AZ_BLOB_CONTAINER_NAME="$blobContainerName >> $GITHUB_ENV

        REGISTRY_URL=$(az deployment group show --name acr -g ${{ env.RG_APP }} --query properties.outputs.acrRegistryUrl.value -o tsv)
        echo "REGISTRY_URL="$REGISTRY_URL
        echo "REGISTRY_URL="$REGISTRY_URL >> $GITHUB_ENV

        AZURE_CONTAINER_REGISTRY=$(az deployment group show --name acr -g ${{ env.RG_APP }} --query properties.outputs.acrName.value -o tsv)
        echo "AZURE_CONTAINER_REGISTRY="$AZURE_CONTAINER_REGISTRY
        echo "AZURE_CONTAINER_REGISTRY="$AZURE_CONTAINER_REGISTRY >> $GITHUB_ENV

        KV_NAME=$(az deployment group show --name aks-tap-kv -g ${{ env.RG_KV }} --query properties.outputs.keyVaultName.value -o tsv)
        echo "KV_NAME=$KV_NAME" >> $GITHUB_ENV 
        echo "KV_NAME=$KV_NAME"

        AKS_CLUSTER_NAME=$(az deployment group show --name aks-main -g ${{ env.RG_APP }} --query properties.outputs.aksName.value -o tsv | tr -d '\r' | tr -d '"')
        echo "AKS_CLUSTER_NAME=" $AKS_CLUSTER_NAME
        echo "AKS_CLUSTER_NAME=$AKS_CLUSTER_NAME" >> $GITHUB_ENV 

        echo "LOCAL_IP=$(curl whatismyip.akamai.com)" >> $GITHUB_ENV

      shell: bash

    - name: Display environment variables
      run: |

        echo "Checking GITHUB_ENV"
        echo "API_GATEWAY_FOLDER=$API_GATEWAY_FOLDER"
        echo "GH_WORKSPACE=$GH_WORKSPACE"
        echo "AZ_STORAGE_NAME="$AZ_STORAGE_NAME
        echo "AZ_BLOB_CONTAINER_NAME=$AZ_BLOB_CONTAINER_NAME
        echo "REGISTRY_URL="$REGISTRY_URL
        echo "AZURE_CONTAINER_REGISTRY="$AZURE_CONTAINER_REGISTRY
        echo "LOCAL_IP=$LOCAL_IP"

      shell: bash


    # https://github.com/Azure/aks-set-context/tree/releases/v1
    - name: AKS Set Context
      uses: azure/aks-set-context@v1
      with:
          creds: '${{ secrets.AZURE_CREDENTIALS }}' # Azure credentials
          resource-group: ${{ env.RG_APP }} 
          cluster-name: ${{ env.AKS_CLUSTER_NAME }}
      id: akslogin

    - name: Prepare Manifests to deploy UI + API Gateway to aks
      # with: # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepswith
      run: |

          echo "About to deploy the API-Gateway UI ..." 
          tag_id=${{ inputs.tag_id }}
          echo "Image Build tag ID:"$tag_id

          managed_rg=$(az aks show --resource-group ${{ env.RG_APP }} --name ${{ env.AKS_CLUSTER_NAME }} --query nodeResourceGroup -o tsv)
          echo "CLUSTER_RESOURCE_GROUP:" $managed_rg

          # az aks get-credentials --name ${{ env.AKS_CLUSTER_NAME }} -g ${{ env.RG_APP }} --admin

          export CONTAINER_REGISTRY=${{ env.AZURE_CONTAINER_REGISTRY }}
          export REPO=${{ env.REPOSITORY }} 
          export IMAGE_TAG=$tag_id
          export DNS_LABEL=${{ env.AZURE_DNS_LABEL_NAME }}

          export ING_HOST=${{ env.APP_DNS_ZONE }}
          echo "INGRESS HOST " $ING_HOST

          mkdir $API_GATEWAY_FOLDER/k8s/deploy

          echo "Cheking folder " $API_GATEWAY_FOLDER
          ls -al $API_GATEWAY_FOLDER/k8s

          envsubst < $API_GATEWAY_FOLDER/k8s/petclinic-ui-deployment.yaml > $API_GATEWAY_FOLDER/k8s/deploy/petclinic-ui-deployment.yaml
          envsubst < $API_GATEWAY_FOLDER/k8s/petclinic-ui-ingress.yaml > $API_GATEWAY_FOLDER/k8s/deploy/petclinic-ui-ingress.yaml 
          envsubst < $API_GATEWAY_FOLDER/k8s/petclinic-ui-cluster-ip.yaml > $API_GATEWAY_FOLDER/k8s/deploy/petclinic-ui-cluster-ip.yaml 

          echo "Cheking folder " $API_GATEWAY_FOLDER
          ls -al $API_GATEWAY_FOLDER/k8s/deploy

          set -euo pipefail
          access_token=$(az account get-access-token --query accessToken -o tsv)
          refresh_token=$(curl https://${{ env.REGISTRY_URL }}/oauth2/exchange -v -d "grant_type=access_token&service=${{ env.REGISTRY_URL }}&access_token=$access_token" | jq -r .refresh_token)
          docker login ${{ env.REGISTRY_URL }} -u 00000000-0000-0000-0000-000000000000 --password-stdin <<< "$refresh_token"

          az configure --defaults acr=${{ env.AZURE_CONTAINER_REGISTRY }}

      shell: bash


      # https://github.com/marketplace/actions/deploy-to-kubernetes-cluster#build-container-image-and-deploy-to-any-azure-kubernetes-service-cluster
            # https://github.com/Azure/k8s-deploy/issues/278
            # $API_GATEWAY_FOLDER/k8s/deploy
    - name: Deploy Manifests to AKS
      uses: Azure/k8s-deploy@v4
      with:
        namespace: ${{ env.PETCLINIC_NAMESPACE }}
        manifests: |
            spring-petclinic-api-gateway/k8s/deploy
          # images: 'contoso.azurecr.io/myapp:${{ event.run_id }}'

    # security hardening for self-hosted agents: https://github.com/marketplace/actions/azure-login
    # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#hardening-for-self-hosted-runners
    # if the runner is self-hosted which is not github provided it is recommended to manually logout at the end of the workflow as shown below.
    - name: Azure Logout security hardening
      run: |
          az logout
          az cache purge
          az account clear
      shell: bash