deploy-iac-pre-req.yml

# This workflow will deploy the Azure services pre-req, including KV & secrets, MYSQL (eventually with a Firewall rule to allow your workstation IP)
# eventually if DEPLOY_TO_VNET is set to true : also VNet, private DNS-Zone, client VM deployed to the VNet

name: Deploy IaC Pre-Req with Azure Bicep

env:

  # ==== Versions ====

  DEPLOYMENT_VERSION: 2.6.13
  AZ_CLI_VERSION: 2.45.0
  JAVA_VERSION: 11

  # ==== General settings  ====

  APP_NAME: tap42
  LOCATION: westeurope # francecentral
  RG_KV: rg-kv-tanzu101 # RG where to deploy KV
  RG_APP: rg-aks-tap-apps # RG where to deploy the other Azure services: AKS, TAP, ACR, MySQL, etc.

  ACR_NAME: tap42
  KV_NAME: kv-tap42 # The name of the KV, must be UNIQUE. A vault name must be between 3-24 alphanumeric characters
  #SPN_APP_NAME: gha_aks_tap_run # A Service Principal required for GitHub Action Runner
  #VM_ADMIN_USER_NAME: adm_aks

  # ==== Azure storage to store Artifacts , values must be consistent with the ones in storage.bicep ====:
  AZ_STORAGE_NAME : statap42 # customize this
  AZ_BLOB_CONTAINER_NAME: tap42-blob # customize this
    
  # Network
  VNET_NAME: vnet-aks
  VNET_CIDR: 172.16.0.0/16
  AKS_SUBNET_CIDR: 172.16.0.0/21
  AKS_SUBNET_NAME: snet-aks

  # MySQL
  MYSQL_SERVER_NAME: tap42
  MYSQL_DB_NAME: petclinic
  MYSQL_ADM_USR: mys_adm
  MYSQL_TIME_ZONE: Europe/Paris
  MYSQL_CHARACTER_SET: utf8
  MYSQL_COLLATION: utf8_general_ci  
  MYSQL_PORT: 3306
  MYSQL_VERSION: "5.7" # "8.0.21"

  # SKU common for MySQL & PG
  DB_SKU_NAME: Standard_B1ms
  DB_SKU_TIER : Burstable

  # PG
  PG_SERVER_NAME: tap42
  PG_DB_NAME: tap
  PG_ADM_USR: pg_adm
  PG_TIME_ZONE: Europe/Paris
  PG_CHARACTER_SET: utf8
  PG_COLLATION: fr_FR.utf8 # select * from pg_collation ;   
  PG_PORT: 5432
  PG_VERSION: "13"

  # ==== Secrets ====

  # https://learn.microsoft.com/en-us/azure/key-vault/secrets/secrets-best-practices#secrets-rotation
  # Because secrets are sensitive to leakage or exposure, it's important to rotate them often, at least every 60 days. 
  # Expiry date in seconds since 1970-01-01T00:00:00Z. Ex: 1672444800 ==> 31/12/2022'
  SECRET_EXPIRY_DATE: 1703980800 # ==> 31/12/2023


  ################################## DO NOT CHANGE params below   ##################################

  # ==== Secrets ====
  
  # /!\ In Bicep : RBAC ==> GH Runner SPN must have "Storage Blob Data Contributor" Role on the storage Account"
  # /!\ The Id is NOT the App Registration Object ID, but the Enterprise Registration Object ID"
  SPN_APP_ID: ${{ secrets.SPN_APP_ID }} # This the App clientID
  SPN_OBJECT_ID: ${{ secrets.SPN_OBJECT_ID }}  # A Service Principal required for GitHub Action Runner
  SPN_PWD : ${{ secrets.SPN_PWD  }} # the Client secret

  # https://github.com/Azure/actions-workflow-samples/blob/master/assets/create-secrets-for-GitHub-workflows.md#consume-secrets-in-your-workflow
  # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-secrets

  # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
  # Never use structured data as a secret
  # Structured data can cause secret redaction within logs to fail, because redaction largely relies on finding an exact match for 
  # the specific secret value. For example, do not use a blob of JSON, XML, or YAML (or similar) to encapsulate a secret value, 
  # as this significantly reduces the probability the secrets will be properly redacted. Instead, create individual secrets for each sensitive value.

  TANZU_NET_USER: ${{ secrets.TANZU_NET_USER }}
  TANZU_NET_PASSWORD: ${{ secrets.TANZU_NET_PASSWORD }}
  PG_ADM_PWD: ${{ secrets.PG_ADM_PWD }}

  SPRING_DATASOURCE_PASSWORD: ${{ secrets.SPRING_DATASOURCE_PASSWORD }}
  SPRING_CLOUD_AZURE_TENANT_ID: ${{ secrets.SPRING_CLOUD_AZURE_TENANT_ID }}

  VM_ADMIN_PASSWORD: ${{ secrets.VM_ADMIN_PASSWORD }}

  SSH_PRV_KEY: ${{ secrets.SSH_PRV_KEY }}
  SSH_PUB_KEY: ${{ secrets.SSH_PUB_KEY }}
  SSH_KEY: aksadm

  credentials: ${{ secrets.AZURE_CREDENTIALS }}
  AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
  AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

on:
  workflow_dispatch:
  workflow_call:

jobs:
  deploy-kv:
    runs-on: ubuntu-latest
    steps:

    # https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#environment-files
    # /!\ IMPORTANT: The step that creates or updates the environment variable does not have access to the new value, but all subsequent steps in a job will have access.
    - name: Set Base environment variables
      run: |

        az version
        # ip addr show eth3 | grep inet
        # ifconfig -a
        # hostname -I
        # host myip.opendns.com resolver1.opendns.com | grep "myip.opendns.com has address"
        # myip=$(curl icanhazip.com)
        # myip=$(dig +short myip.opendns.com @resolver1.opendns.com)      
        echo "LOCAL_IP=$(curl whatismyip.akamai.com)" >> $GITHUB_ENV

      shell: bash

    - name: Login with GHA Runner SP
      uses: azure/login@v1 # https://github.com/marketplace/actions/azure-login
      with:
        creds: ${{ env.credentials }} # ${{ secrets.AZURE_CREDENTIALS }}

    - name: Checkout
      uses: actions/checkout@v3 # https://github.com/actions/checkout

    - name: Deploy Azure Key Vault      
      # uses: azure/CLI@v1.0.6 # https://github.com/marketplace/actions/azure-cli-action
      # with:
        #azcliversion: ${{ env.AZ_CLI_VERSION }}
        # inlineScript: |
      shell: bash
      run: |

          pwd
          ls -al
           echo "LOCAL_IP=$LOCAL_IP"

          az deployment group create --name aks-tap-kv -f iac/bicep/modules/kv/kv.bicep -g ${{ env.RG_KV }} \
            -p appName=${{ env.APP_NAME }} \
            -p kvName=${{ env.KV_NAME }} \
            -p location=${{ env.LOCATION }}
    
    # Allow GH Runner to access KV
    # When Public access is disabled on KV, you need to add a network rule in the KV Firewall
    - name: Authorize local IP to access the Azure Key Vault
      run: |
          az keyvault network-rule add --ip-address $LOCAL_IP --name ${{ env.KV_NAME }} -g ${{ env.RG_KV }} --only-show-errors
          sleep 30
      shell: bash

    - name: Create SPRING-DATASOURCE-PASSWORD secret in Azure Key Vault
      run: |
          az deployment group create --name aks-tap-kv-db-pwd -f iac/bicep/modules/kv/kv_sec_key.bicep -g ${{ env.RG_KV }} \
            -p appName=${{ env.APP_NAME }} \
            -p kvName=${{ env.KV_NAME }} \
            -p secretName="SPRING-DATASOURCE-PASSWORD" \
            -p secretValue=${{ secrets.SPRING_DATASOURCE_PASSWORD }} \
            -p secretExpiryDate=${{ env.SECRET_EXPIRY_DATE }}
      shell: bash

    - name: Create SPRING-CLOUD-AZURE-TENANT-ID secret in Azure Key Vault
      run: |
          az deployment group create --name aks-tap-kv-tenant -f iac/bicep/modules/kv/kv_sec_key.bicep -g ${{ env.RG_KV }} \
            -p appName=${{ env.APP_NAME }} \
            -p kvName=${{ env.KV_NAME }} \
            -p secretName="SPRING-CLOUD-AZURE-TENANT-ID" \
            -p secretValue=${{ secrets.SPRING_CLOUD_AZURE_TENANT_ID }} \
            -p secretExpiryDate=${{ env.SECRET_EXPIRY_DATE }} 
      shell: bash

    - name: Create TANZU-NET-PASSWORD secret in Azure Key Vault
      run: |
          az deployment group create --name aks-tap-kv-tanzu-pwd -f iac/bicep/modules/kv/kv_sec_key.bicep -g ${{ env.RG_KV }} \
            -p appName=${{ env.APP_NAME }} \
            -p kvName=${{ env.KV_NAME }} \
            -p secretName="TANZU-NET-PASSWORD" \
            -p secretValue=${{ secrets.TANZU_NET_PASSWORD }} \
            -p secretExpiryDate=${{ env.SECRET_EXPIRY_DATE }}
      shell: bash

    - name: Create TANZU-NET-USER secret in Azure Key Vault
      run: |
          az deployment group create --name aks-tap-kv-tanzu-usr -f iac/bicep/modules/kv/kv_sec_key.bicep -g ${{ env.RG_KV }} \
            -p appName=${{ env.APP_NAME }} \
            -p kvName=${{ env.KV_NAME }} \
            -p secretName="TANZU-NET-USER" \
            -p secretValue=${{ secrets.TANZU_NET_USER}} \
            -p secretExpiryDate=${{ env.SECRET_EXPIRY_DATE }}
      shell: bash

    # https://learn.microsoft.com/en-us/samples/azure/azure-quickstart-templates/deployment-script-ssh-key-gen/
    # https://github.com/azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.resources/deployment-script-ssh-key-gen
    - name: Create SSH-PRV-KEY secret in Azure Key Vault
      run: |

          # workaround using --file to fix this error : Unable to parse parameter: OPENSSH
          echo "${{ env.SSH_PRV_KEY }}" > ${{ env.SSH_KEY }}
          ls -al ${{ env.SSH_KEY }}
          az keyvault secret set --name "SSH-PRV-KEY" --vault-name ${{ env.KV_NAME }} --file ${{ env.SSH_KEY }}
      shell: bash

    - name: Create SSH-PUB-KEY secret in Azure Key Vault
      run: |
          echo "${{ secrets.SSH_PUB_KEY }}" > ${{ env.SSH_KEY }}.pub
          ls -al ${{ env.SSH_KEY }}.pub
          az keyvault secret set --name "SSH-PUB-KEY" --vault-name ${{ env.KV_NAME }} --file ${{ env.SSH_KEY }}.pub
      shell: bash


    - name: Create SPN-PWD secret in Azure Key Vault
      run: |
          az deployment group create --name aks-tap-spn-pwd -f iac/bicep/modules/kv/kv_sec_key.bicep -g ${{ env.RG_KV }} \
            -p appName=${{ env.APP_NAME }} \
            -p kvName=${{ env.KV_NAME }} \
            -p secretName="SPN-PWD" \
            -p secretValue=${{ secrets.SPN_PWD}} \
            -p secretExpiryDate=${{ env.SECRET_EXPIRY_DATE }}
      shell: bash

    - name: Create SPN-PWD secret in Azure Key Vault
      run: |
          az deployment group create --name aks-tap-pg-pwd -f iac/bicep/modules/kv/kv_sec_key.bicep -g ${{ env.RG_KV }} \
            -p appName=${{ env.APP_NAME }} \
            -p kvName=${{ env.KV_NAME }} \
            -p secretName="PG-ADM-PWD" \
            -p secretValue=${{ secrets.PG_ADM_PWD}} \
            -p secretExpiryDate=${{ env.SECRET_EXPIRY_DATE }}
      shell: bash

    - name: Disable local IP access to the Key Vault
      if: ${{ always() }}
      run: |
          az keyvault network-rule remove --ip-address $LOCAL_IP --name ${{ env.KV_NAME }} -g ${{ env.RG_KV }} --only-show-errors
      shell: bash

  deploy-iac:
    runs-on: ubuntu-latest
    needs: deploy-kv
    steps:

    - name: Login with GHA Runner SP
      uses: azure/login@v1 # fails https://github.com/marketplace/actions/azure-login
      with:
        creds: ${{ secrets.AZURE_CREDENTIALS }} # ${{ env.credentials }}

    - name: Set Base environment variables
      run: |

        echo "LOCAL_IP=$(curl whatismyip.akamai.com)" >> $GITHUB_ENV
        az version

        KV_NAME=$(az deployment group show --name aks-tap-kv -g ${{ env.RG_KV }} --query properties.outputs.keyVaultName.value -o tsv)
        echo "KV_NAME=$KV_NAME" >> $GITHUB_ENV 
        echo "KV_NAME=$KV_NAME"

      shell: bash
        
    - name: Checkout
      uses: actions/checkout@v3 # https://github.com/actions/checkout

    - name: Deploy the pre-req
      run: |

          # --debug # --what-if to test like a dry-run
          echo "LOCAL_IP=$LOCAL_IP"
           
          az deployment group create --name aks-tap-pre-req -f iac/bicep/pre-req.bicep -g ${{ env.RG_APP }} \
            -p appName=${{ env.APP_NAME }} \
            -p location=${{ env.LOCATION }} \
            -p ghRunnerSpnPrincipalId=${{ env.SPN_OBJECT_ID }} \
            -p kvName=${{ env.KV_NAME }} \
            -p kvRGName=${{ env.RG_KV }} \
            -p vnetName=${{ env.VNET_NAME }} \
            -p vnetCidr=${{ env.VNET_CIDR }} \
            -p aksSubnetCidr=${{ env.AKS_SUBNET_CIDR }} \
            -p aksSubnetName=${{ env.AKS_SUBNET_NAME }} \
            -p databaseSkuName=${{ env.DB_SKU_NAME }} \
            -p databaseSkuTier=${{ env.DB_SKU_TIER }} \
            -p mySQLServerName=${{ env.MYSQL_SERVER_NAME }} \
            -p mySqlVersion=${{ env.MYSQL_VERSION }} \
            -p postgreSQLServerName=${{ env.PG_SERVER_NAME }} \
            -p postgreSQLVersion=${{ env.PG_VERSION }} \
            -p pgDbName=${{ env.PG_DB_NAME }} \
            -p pgCharset=${{ env.PG_CHARACTER_SET }} \
            -p pgCollation=${{ env.PG_COLLATION }} \
            -p acrName=${{ env.ACR_NAME }} \
            -p azureStorageName=${{ env.AZ_STORAGE_NAME }}  \
            -p blobContainerName=${{ env.AZ_BLOB_CONTAINER_NAME }}

          vetsServicePrincipalId=$(az deployment group show --name aks-identities -g ${{ env.RG_APP }} --query properties.outputs.vetsServicePrincipalId.value -o tsv)
          vetsServiceClientId=$(az deployment group show --name aks-identities -g ${{ env.RG_APP }} --query properties.outputs.vetsServiceClientId.value -o tsv)

          visitsServicePrincipalId=$(az deployment group show --name aks-identities -g ${{ env.RG_APP }} --query properties.outputs.visitsServicePrincipalId.value -o tsv)
          visitsServiceClientId=$(az deployment group show --name aks-identities -g ${{ env.RG_APP }} --query properties.outputs.visitsServiceClientId.value -o tsv)

          configServerPrincipalId=$(az deployment group show --name aks-identities -g ${{ env.RG_APP }} --query properties.outputs.configServerPrincipalId.value -o tsv)
          configServerClientId=$(az deployment group show --name aks-identities -g ${{ env.RG_APP }} --query properties.outputs.configServerClientId.value -o tsv)

          customersServicePrincipalId=$(az deployment group show --name aks-identities -g ${{ env.RG_APP }} --query properties.outputs.customersServicePrincipalId.value -o tsv)
          customersServiceClientId=$(az deployment group show --name aks-identities -g ${{ env.RG_APP }} --query properties.outputs.customersServiceClientId.value -o tsv)

          aksClusterPrincipalId=$(az deployment group show --name aks-identities -g ${{ env.RG_APP }} --query properties.outputs.aksIdentityPrincipalId.value -o tsv)
          aksClusterClientId=$(az deployment group show --name aks-identities -g ${{ env.RG_APP }} --query properties.outputs.aksIdentityClientId.value -o tsv)

          az deployment group create --name kv-role-assignments -f iac/bicep/modules/kv/kvRoleAssignments.bicep -g ${{ env.RG_KV }} \
            -p kvName=${{ env.KV_NAME }} \
            -p configServerIdentityId=$configServerPrincipalId \
            -p vetsIdentityId=$vetsServicePrincipalId \
            -p visitsIdentityId=$visitsServicePrincipalId \
            -p customersIdentityId=$customersServicePrincipalId \
            -p kvRoleType=KeyVaultSecretsUser

          storage_name=$(az deployment group show --name storage  -g ${{ env.RG_APP }} --query properties.outputs.azureStorageName.value -o tsv)
          echo "storage_name" $storage_name
          echo "AZ_STORAGE_NAME="$storage_name >> $GITHUB_ENV

      shell: bash

    - name: Azure Logout security hardening
      run: |
          az logout
          az cache purge
          az account clear             
      shell: bash