1-actions-ci-cd-aks.yml

name: 1-actions-ci-cd-aks

on:
  push:
    branches: [ main ]
    paths: .github/workflows/1-actions-ci-cd-aks.yml
  pull_request:
    branches:  none # [ main ]
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

jobs:

  build-deploy-aks:
    runs-on: ubuntu-latest
    env:
      DOCKER_REPOSITORY: houssemdocker # name of Docker Hub ID
      IMAGE_NAME: webapp
      IMAGE_TAG: ${{ github.run_number }} # $GITHUB_RUN_NUMBER
      
      CLUSTER_NAME: aks-cluster
      RESOURSE_GROUP: rg-aks-cluster
    
    steps:

    - name: Git Checkout
      uses: actions/checkout@v2
  
    - name: Build Docker Image
      run:
        docker build ./MvcApp/ --file ./MvcApp/Dockerfile --tag $DOCKER_REPOSITORY/$IMAGE_NAME:$GITHUB_RUN_NUMBER --build-arg=token=ZGEzNTQ5Y2QyNjAx --no-cache

    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      continue-on-error: true
      with:
        image-ref: 'docker.io/${{ env.DOCKER_REPOSITORY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}'
        format: 'table'
        exit-code: '1'
        ignore-unfixed: true
        vuln-type: 'os,library'
        severity: 'MEDIUM,HIGH,CRITICAL'

    - name: Login to Docker Hub
      run: |
        echo "${{ secrets.DOCKER_REPOSITORY_PASSWORD }}" | docker login -u $DOCKER_REPOSITORY --password-stdin
  
    - name: Push Image to Docker Hub
      run:
        docker push $DOCKER_REPOSITORY/$IMAGE_NAME:$GITHUB_RUN_NUMBER
   
    - uses: cschleiden/replace-tokens@v1
      with:
        files: '["kubernetes/*.yaml"]'
        tokenPrefix: __ # optional, default is #{
        tokenSuffix: __ # optional, default is }#
      env:
        DOCKER_REPOSITORY: ${{ env.DOCKER_REPOSITORY }}
        IMAGE_NAME: ${{ env.IMAGE_NAME }}
        IMAGE_TAG: ${{ env.IMAGE_TAG }}
        
    # Set the target AKS cluster.
    - uses: Azure/aks-set-context@v1
      with:
        creds: ${{ secrets.AZURE_CREDENTIALS }}
        cluster-name: ${{ env.CLUSTER_NAME }}
        resource-group: ${{ env.RESOURSE_GROUP }}

    - uses: Azure/k8s-deploy@v1
      with:
        manifests: |
          kubernetes/mssql-pv.azure.yaml
          kubernetes/mssql-configmap.yaml
          kubernetes/mssql-secret.yaml
          kubernetes/mssql-deployment.yaml
          kubernetes/mvc-deployment.azure.yaml
    
    - name: Run Kube-Bench to check cluster config
      continue-on-error: true
      run: |
        kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job-aks.yaml
        sleep 30s
        kubectl logs job.batch/kube-bench
        kubectl delete job.batch/kube-bench