julie-ng/cloud-architecture-review

Cloud Architecture Review App

Hallo! Follow Me on YouTube to learn more about cloud engineering best practices and watch me code 👩‍💻 🎥

cloud-architecture-review's Issues

Pipelines: fix staging deployment

Current setup-kubelogin.yaml is hard-coded to use dev credentials

env:
    AAD_SERVICE_PRINCIPAL_CLIENT_ID:     $(aks-architect-ci-dev-sp-client-id)
    AAD_SERVICE_PRINCIPAL_CLIENT_SECRET: $(aks-architect-ci-dev-sp-client-secret)

This is separate depending on the environment

workflow - add scheduled container registry cleanup

Problem

Azure Container Registry will get full if we don't clean up unused

Solution

• Create a GitHub Workflow to regularly purge images except for last 5, e.g. below
• Prefer GitHub over Azure feature to have automation transparency and records here

DRY_RUN="acr purge \
  --filter 'frontend:dev-*' \
  --untagged \
  --ago 14d \
  --keep 5 \
  --dry-run"

echo $DRY_RUN

az acr run \
  --cmd "$DRY_RUN" \
  --registry aksarchitect \
  /dev/null

References

• https://docs.microsoft.com/en-us/azure/container-registry/container-registry-auto-purge

github workflows - rename 'target' to github environment

Problem

Right now we have

on:
  workflow_call:
    outputs:
      target:
        description: 'GitHub Environment for deployment'
        value: ${{ jobs.setup-variables.outputs.target }}

and it's not clear that target refers to a GitHub Environment boundary

on:
  # ...
  jobs:
    # Dev
    # ===
    - id: is-dev
      if: github.ref == 'refs/heads/aks-architect/main' # <== CONFIGURE (1)
      name: 'DEV: set vars'
      run: |
        echo "target=aks-architect-dev" >> $GITHUB_ENV

Solution

Rename target to github-environment

Reset scores between different radio button selections

If the user toggles between radio buttons for the same question we need to reset the score. Otherwise, multiple options with +10 will add up to 10*3 although they are only allowed to select 1 for max 10 relative increase.

Swap Azure Defender Scan for Snyk

Expected Behavior - can scan Docker image before pushing to registry

According to this Azure doc, it should be possible to scan the Docker image before pushing it
https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-cicd#step-2-add-the-necessary-lines-to-your-github-workflow-and-perform-a-scan

Actual Behavior - fails

The last few lines in the action throw an error

/usr/bin/tar xz --warning=no-unknown-keyword -C /home/runner/work/_temp/b3f4a38b-1605-470b-baed-5a22fdd4aaac -f /home/runner/work/azure-kubernetes-architect/azure-kubernetes-architect/_temp/tools/dockle
Scanning for CIS and best practice violations...
Error: FATAL	unable to initialize a image struct: failed to initialize source: reading manifest dev-7141d57 in aksarchitect.azurecr.io/frontend: manifest unknown: manifest tagged by "dev-7141d57" is not found
Error: An error occurred while scanning the container image for best practice violations

Screenshot from this run.
https://github.com/julie-ng/azure-kubernetes-architect/runs/7192699086?check_suite_focus=true

Cause

Based on aksarchitect.azurecr.io/frontend: manifest unknown: manifest tagged by "dev-7141d57" is not found I am guessing it is actually trying to pull from the registry 🤦‍♀️ and not trying to check an image I already built.

After pushing first in b04620c it now works…

Next Step

Because I want to scan before I push an image, I will just use Snyk instead.
https://github.com/snyk/actions