shirscher / aks-platform Goto Github PK
View Code? Open in Web Editor NEWLicense: The Unlicense
License: The Unlicense
# Overview # Getting Started - Initialize the environment ```bash > source ./platform/init.sh ``` - Deploy the platform ```bash > source ./platform/apply.sh ``` - Deploy the demo apps ```bash > source ./apps/deploy.sh ``` # Tearing down - Destroy all resources ```bash > source ./destroy.sh ``` - (Optional) Remove Terraform supporting resources ```bash > source ./platform/uninit.sh ``` # Features - Fully private VNet - All traffic stays in network using Private Endpoints - All ingress HTTP traffic must go through Azure App Gateway WAF (TODO) - No systems, even Azure SAAS services, have publicly addressable routes other than the public App Gateway - End to end encryption (TODO) - Predefined IAM configuration with groups and test users to support a compliant separation of concerns (TODO) - Azure Policies defined for all resources used in (In Progress) - Subscription budget with alerts (In Progress) - Azure Kubernetes Service for hosting all stateless apps - Nginx or Azure App Gateway (TODO) ingress options - ArgoCD - End-to-end transport encryption with cert-manager (TODO) - (Optional) Keycloak server for user and API authentication (TODO) - Angular API w/ NestJS + Azure SQL Server back end (In Progress) - AAD based OAuth for API integration, - Helm based manifest deploys - - Automated operation runbooks - Auto rotation of secrets - Auto refresh of TLS certs # TODOs X Add ingress X Add the demo node API X Add ArgoCD to startup - Add helm option for demo node api - Database migrations - Node app infrastructure - DB, MSI - Add Azure Policy for AKS - Resize AKS node subnet (max 1000 nodes per cluster) - Support multiple node pools (rename resource group to "*-nodepool-default") - Alerts for AKS cluster (see "Enable recommended alert rules" in portal) - Use spot instances for node pools - Add jump box - Update SQL Server to only allow AAD admins - Apply policy to AKS to address security issue when using kubenet w/ AAD Pod Identity: https://learn.microsoft.com/en-us/azure/app-service/tutorial-connect-msi-sql-database?tabs=windowsclient%2Cef%2Cdotnet -
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.