Skip to content

Commit 37b2e3e

Browse files
stevendongatmsftstevendongatmsft
committed
adding kafka demo pipeline
1 parent 3fb0377 commit 37b2e3e

File tree

9 files changed

+683
-0
lines changed

9 files changed

+683
-0
lines changed

‎.github/workflows/_cleanup.yml

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
name: Cleanup
2+
3+
on:
4+
workflow_call:
5+
schedule:
6+
- cron: "0 0 * * *"
7+
8+
jobs:
9+
remove-workload-and-cluster:
10+
name: Clean Up
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Log into Azure
14+
run: |
15+
az login --service-principal \
16+
--username ${{ secrets.AZURE_SERVICE_PRINCIPAL_APP_ID }} \
17+
--password ${{ secrets.AZURE_SERVICE_PRINCIPAL_PASSWORD }} \
18+
--tenant ${{ secrets.AZURE_SERVICE_PRINCIPAL_TENANT }}
19+
20+
- name: Clean Up
21+
id: cleanup
22+
env:
23+
RESOURCE_GROUP: ${{ vars.RESOURCE_GROUP }}
24+
run: |
25+
result=$(az aks list -g $RESOURCE_GROUP --query "[].name" -otsv)
26+
27+
for name in $result
28+
do
29+
max_retries=5
30+
retries=0
31+
while [ $retries -lt $max_retries ]; do
32+
echo "Querying for cluster state"
33+
clusterstate=$(az aks show -g $RESOURCE_GROUP -n $name --query 'provisioningState' -otsv)
34+
if [[ $clusterstate == *"Succeeded"* ]]; then
35+
echo "Returned result is $clusterstate"
36+
echo "Cluster is ready to be deleted."
37+
az aks stop --resource-group $RESOURCE_GROUP --name $name 2>&1
38+
az aks delete --resource-group $RESOURCE_GROUP --name $name --no-wait --yes
39+
break # Exit the loop on successful attempt
40+
elif [[ $clusterstate == *"Stopped"* ]] || [[ $clusterstate == *"Failed"* ]]; then
41+
az aks delete --resource-group $RESOURCE_GROUP --name $name --no-wait --yes
42+
break # Exit the loop on successful attempt
43+
else
44+
echo "Returned cluster provisioning state is $clusterstate"
45+
echo "Retrying in 3 minutes..."
46+
retries=$((retries+1))
47+
sleep 180
48+
fi
49+
done
50+
if [ $retries -eq $max_retries ]; then
51+
echo "The operation has been tried 5 times without success."
52+
exit 1
53+
fi
54+
done

‎.github/workflows/_create_aks_cluster.yml

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: Create AKS Cluster
2+
3+
on:
4+
workflow_call:
5+
outputs:
6+
cluster-name:
7+
description: AKS Cluster Name
8+
value: ${{ jobs.create-aks-cluster.outputs.cluster-name }}
9+
workflow_dispatch:
10+
11+
jobs:
12+
create-aks-cluster:
13+
name: Create AKS Cluster
14+
runs-on: ubuntu-latest
15+
env:
16+
RESOURCE_GROUP: ${{ vars.RESOURCE_GROUP }}
17+
KUBERNETES_VERSION: ${{ vars.KUBERNETES_VERSION }}
18+
outputs:
19+
cluster-name: ${{ steps.create-aks-cluster.outputs.cluster-name }}
20+
steps:
21+
- name: Checkout
22+
uses: actions/checkout@v4
23+
24+
- name: Get Workflow ID
25+
id: generate-id
26+
run: echo "id=$(openssl rand -hex 8 | tr -d '\n')" >> $GITHUB_OUTPUT
27+
28+
- name: Log into Azure
29+
run: |
30+
az login --service-principal \
31+
--username ${{ secrets.AZURE_SERVICE_PRINCIPAL_APP_ID }} \
32+
--password ${{ secrets.AZURE_SERVICE_PRINCIPAL_PASSWORD }} \
33+
--tenant ${{ secrets.AZURE_SERVICE_PRINCIPAL_TENANT }}
34+
35+
- name: Install Dependencies
36+
id: install-dependencies
37+
run: |
38+
result=$(az extension list -o table 2>&1 || true)
39+
if [[ $result == *"aks-preview"* ]]; then
40+
echo "aks-preview already installed, upgrading aks-preview version."
41+
az extension update --name aks-preview
42+
else
43+
echo "aks-preview extension not found. Installing aks-preview..."
44+
az extension add --name aks-preview
45+
fi
46+
47+
- name: Create AKS Cluster
48+
id: create-aks-cluster
49+
if: steps.install-dependencies.outcome == 'success'
50+
env:
51+
RUN_ID: ${{ steps.generate-id.outputs.id}}
52+
run: |
53+
az aks create --resource-group $RESOURCE_GROUP \
54+
--name skr-kafka-demo-${RUN_ID} \
55+
--kubernetes-version $KUBERNETES_VERSION \
56+
--os-sku AzureLinux \
57+
--node-vm-size Standard_DC4as_cc_v5 \
58+
--tags "Owner=accct" \
59+
--enable-oidc-issuer \
60+
--enable-workload-identity \
61+
--workload-runtime KataCcIsolation \
62+
--node-count 1 \
63+
--generate-ssh-keys
64+
echo "cluster-name=skr-kafka-demo-${RUN_ID}" >> $GITHUB_OUTPUT

‎.github/workflows/_deploy_kafka_test.yml

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
name: Deploy Kafka Test
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
cluster-name:
7+
required: true
8+
description: AKS Cluster Name
9+
type: string
10+
key-release-image:
11+
required: true
12+
description: "The image of the SKR sidecar to use"
13+
type: string
14+
consumer-image:
15+
description: "Consumer Image"
16+
required: true
17+
type: string
18+
producer-image:
19+
description: "Producer Image"
20+
required: true
21+
type: string
22+
jobs:
23+
deploy-kafka:
24+
name: Deploy Kafka Test
25+
runs-on: ubuntu-latest
26+
steps:
27+
- name: Checkout
28+
uses: actions/checkout@v4
29+
with:
30+
path: main
31+
32+
- name: Log into Azure
33+
run: |
34+
az login --service-principal \
35+
--username ${{ secrets.AZURE_SERVICE_PRINCIPAL_APP_ID }} \
36+
--password ${{ secrets.AZURE_SERVICE_PRINCIPAL_PASSWORD }} \
37+
--tenant ${{ secrets.AZURE_SERVICE_PRINCIPAL_TENANT }}
38+
39+
- name: Install Dependencies
40+
id: install-dependencies
41+
run: |
42+
curl -L https://github.com/a8m/envsubst/releases/download/v1.2.0/envsubst-`uname -s`-`uname -m` -o envsubst --fail-with-body
43+
chmod +x envsubst
44+
sudo mv envsubst /usr/local/bin
45+
46+
result=$(az extension list -o table 2>&1 || true)
47+
if [[ $result == *"confcom"* ]]; then
48+
echo "confcom already installed, upgrading confcom version."
49+
az extension update --name confcom
50+
else
51+
echo "confcom extension not found. Installing confcom..."
52+
az extension add --name confcom
53+
fi
54+
55+
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" --fail-with-body
56+
chmod +x kubectl
57+
sudo mv kubectl /usr/local/bin
58+
kubectl version 2>&1 || true
59+
60+
- name: Run Workload
61+
env:
62+
AZURE_AKV_RESOURCE_ENDPOINT: ${{ secrets.SKR_CLIENT_AKV_ENDPOINT }}
63+
MAA_ENDPOINT: ${{ secrets.SKR_CLIENT_MAA_ENDPOINT }}
64+
CLUSTER_NAME: ${{ inputs.cluster-name }}
65+
RESOURCE_GROUP: ${{ vars.RESOURCE_GROUP }}
66+
SIDECAR_IMAGE: ${{ inputs.key-release-image }}
67+
CONSUMER_IMAGE: ${{ inputs.consumer-image }}
68+
PRODUCER_IMAGE: ${{ inputs.producer-image }}
69+
id: run-workload
70+
run: |
71+
az aks get-credentials --name $CLUSTER_NAME --resource-group $RESOURCE_GROUP --overwrite-existing
72+
cd main/kafka
73+
chmod +x test-setup.sh
74+
bash test-setup.sh kafka-demo-pipeline $AZURE_AKV_RESOURCE_ENDPOINT
75+
76+
77+

‎.github/workflows/_setup_aks_cluster.yml

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
name: Create and Prepare AKS Cluster
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
cluster-name:
7+
required: true
8+
description: AKS Cluster Name
9+
type: string
10+
workflow_dispatch:
11+
12+
jobs:
13+
setup-aks-cluster:
14+
name: Setup AKS Cluster
15+
runs-on: ubuntu-latest
16+
env:
17+
RESOURCE_GROUP: ${{ vars.RESOURCE_GROUP }}
18+
USER_ASSIGNED_IDENTITY_NAME: ${{ vars.USER_ASSIGNED_IDENTITY_NAME }}
19+
steps:
20+
- name: Checkout
21+
uses: actions/checkout@v4
22+
23+
- name: Log into Azure
24+
run: |
25+
az login --service-principal \
26+
--username ${{ secrets.AZURE_SERVICE_PRINCIPAL_APP_ID }} \
27+
--password ${{ secrets.AZURE_SERVICE_PRINCIPAL_PASSWORD }} \
28+
--tenant ${{ secrets.AZURE_SERVICE_PRINCIPAL_TENANT }}
29+
30+
- name: Install Dependencies
31+
id: install-dependencies
32+
run: |
33+
result=$(az extension list -o table 2>&1 || true)
34+
if [[ $result == *"aks-preview"* ]]; then
35+
echo "aks-preview already installed, upgrading aks-preview version."
36+
az extension update --name aks-preview
37+
else
38+
echo "aks-preview extension not found. Installing aks-preview..."
39+
az extension add --name aks-preview
40+
fi
41+
42+
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" --fail-with-body
43+
chmod +x kubectl
44+
sudo mv kubectl /usr/local/bin
45+
kubectl version 2>&1 || true
46+
47+
- name: Prepare Workload Identity Env Var
48+
id: prepare-workload-identity-env-vars
49+
env:
50+
CLUSTER_NAME: ${{ inputs.cluster-name}}
51+
run: |
52+
az aks get-credentials --name $CLUSTER_NAME --resource-group $RESOURCE_GROUP --overwrite-existing
53+
export AKS_OIDC_ISSUER="$(az aks show -n $CLUSTER_NAME -g $RESOURCE_GROUP --query "oidcIssuerProfile.issuerUrl" -otsv)"
54+
echo "Setting AKS_OIDC_ISSUER to $AKS_OIDC_ISSUER"
55+
56+
export USER_ASSIGNED_CLIENT_ID="$(az identity show --resource-group $RESOURCE_GROUP --name $USER_ASSIGNED_IDENTITY_NAME --query 'clientId' -otsv)"
57+
echo "Setting USER_ASSIGNED_CLIENT_ID to $USER_ASSIGNED_CLIENT_ID"
58+
59+
echo "AKS_OIDC_ISSUER=$AKS_OIDC_ISSUER" >> $GITHUB_OUTPUT
60+
echo "USER_ASSIGNED_CLIENT_ID=$USER_ASSIGNED_CLIENT_ID" >> $GITHUB_OUTPUT
61+
62+
- name: Create Kafka Namespace
63+
id: create-kafka-namespace
64+
if: steps.prepare-workload-identity-env-vars.outcome == 'success'
65+
run: |
66+
result=$(kubectl get namespace kafka 2>&1 || true)
67+
if [[ $result == *"not found"* ]]; then
68+
echo "kafka namespace not found. Create kafka namespace..."
69+
kubectl create namespace kafka
70+
else
71+
echo "kafka namespace already exists."
72+
fi
73+
74+
- name: Create Service Account
75+
id: create-service-account
76+
if: steps.create-kafka-namespace.outcome == 'success'
77+
run: |
78+
kubectl delete sa -n kafka workload-identity-sa 2>&1 || true
79+
cat <<EOF | kubectl apply -f -
80+
apiVersion: v1
81+
kind: ServiceAccount
82+
metadata:
83+
annotations:
84+
azure.workload.identity/client-id: ${{ steps.prepare-workload-identity-env-vars.outputs.USER_ASSIGNED_CLIENT_ID }}
85+
name: workload-identity-sa
86+
namespace: kafka
87+
EOF
88+
89+
- name: Setup Workload Identity
90+
id: setup-workload-identity
91+
if: steps.create-service-account.outcome == 'success'
92+
run: |
93+
result=$(az identity federated-credential show --name myFedIdentity --identity-name $USER_ASSIGNED_IDENTITY_NAME --resource-group $RESOURCE_GROUP 2>&1 || true)
94+
if [[ $result == *${{ steps.prepare-workload-identity-env-vars.outputs.AKS_OIDC_ISSUER }}* ]]; then
95+
echo "Federated identity already exists"
96+
else
97+
echo "Federated identity not found. Creating... "
98+
az identity federated-credential create --name myFedIdentity --identity-name $USER_ASSIGNED_IDENTITY_NAME --resource-group $RESOURCE_GROUP --issuer ${{ steps.prepare-workload-identity-env-vars.outputs.AKS_OIDC_ISSUER }} --subject system:serviceaccount:kafka:workload-identity-sa
99+
fi
100+
101+
- name: Setup Kafka Cluster
102+
id: apply-kafka-cr-files
103+
if: steps.setup-workload-identity.outcome == 'success'
104+
run: |
105+
kubectl create -f 'https://strimzi.io/install/latest?namespace=kafka' -n kafka 2>&1
106+
# Apply the `Kafka` Cluster CR file
107+
kubectl apply -f https://strimzi.io/examples/latest/kafka/kafka-persistent-single.yaml -n kafka 2>&1
108+
109+
echo "Sleep for 3 minutes and wait for Kafka cluster to be created and fully working..."
110+
sleep 180

‎.github/workflows/_test_workload.yml

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
name: Test Workload
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
cluster-name:
7+
required: true
8+
description: AKS Cluster Name
9+
type: string
10+
11+
jobs:
12+
test-workload:
13+
name: Test Workload
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Checkout
17+
uses: actions/checkout@v4
18+
with:
19+
path: main
20+
21+
- name: Log into Azure
22+
run: |
23+
az login --service-principal \
24+
--username ${{ secrets.AZURE_SERVICE_PRINCIPAL_APP_ID }} \
25+
--password ${{ secrets.AZURE_SERVICE_PRINCIPAL_PASSWORD }} \
26+
--tenant ${{ secrets.AZURE_SERVICE_PRINCIPAL_TENANT }}
27+
28+
- name: Install Dependencies
29+
id: install-dependencies
30+
run: |
31+
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" --fail-with-body
32+
chmod +x kubectl
33+
sudo mv kubectl /usr/local/bin
34+
kubectl version 2>&1 || true
35+
36+
- name: Test Workload
37+
env:
38+
CLUSTER_NAME: ${{ inputs.cluster-name }}
39+
RESOURCE_GROUP: ${{ vars.RESOURCE_GROUP }}
40+
id: test-workload
41+
run: |
42+
az aks get-credentials --name $CLUSTER_NAME --resource-group $RESOURCE_GROUP --overwrite-existing
43+
44+
echo "Wait for 120 sec before checking expected Kafka message."
45+
sleep 120
46+
47+
max_retries=5
48+
retries=0
49+
while [ $retries -lt $max_retries ]; do
50+
echo "Querying for the decrypted message from $ConsumerIP"
51+
result=$(kubectl logs -n kafka kafka-golang-consumer -c kafka-golang-consumer)
52+
53+
if [[ $result == *"Azure Confidential Computing"* ]]; then
54+
echo "Returned result is $result"
55+
echo "Found decrypted message, workload is successful."
56+
break # Exit the loop on successful attempt
57+
else
58+
echo "Returned result is $result"
59+
echo "Returned result does not contain text that indicates successful execution, retrying in 5 seconds..."
60+
retries=$((retries+1))
61+
fi
62+
sleep 5
63+
done
64+
65+
if [ $retries -eq $max_retries ]; then
66+
echo "The operation has been tried 3 times without success."
67+
exit 1
68+
fi

0 commit comments

Comments
 (0)