dct-pipeline.yml

#
# Microservice : Claims API Microservice
# Language : ASP.NET Core 2.2
# Date: 09-26-2019
# Author: Ganesh Radhakrishnan (ganrad01@gmail.com)
# 
# Description:
# Pipeline script (yaml) for building and deploying the 'claims-api' .NET Core microservice on AKS.
# The container image will be built and scanned for known OS vulnerabilities using Aqua Trivy container scanner.
# Next, the container image will be digitally signed using DCT and then pushed into an ACR. Note: ACR Premium
# SKU is required for pushing DCT enabled images!
# Finally, Helm will be used to deploy the Claims API microservice on AKS.  This application deployment will use
# the signed container image.
# 
# IMPORTANT:
# This pipeline requires a custom self-hosted pipeline agent for running all tasks.  Instructions for deploying
# a self-hosted Azure DevOps Services agent on AKS can be found here:
# https://github.com/ganrad/Az-DevOps-Agent-On-AKS
#
# This pipeline requires the following variables to be set.
#   - 'containerRegistryServiceConnection' :  Create a 'Service Connection' for ACR in Azure DevOps Services (Project settings) and then specify the service connection name.
#   - 'imageRepository' : Name of the image repository in ACR.  This repository should have been intialized (initiated) with a root key (docker trust signer add ...)
#   - 'DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE' : Passphrase used while generating delegation key pair (Should be a secret)
#   - 'privateKeyFilename' : Name of the secure file containing the delegation private key
#   - 'azureSubscriptionEndpoint' : Azure DevOps ARM Connection name
#   - 'azureContainerRegistry' : Azure Container Registry name
#   - 'azureResourceGroup' : Azure Resource Group name
#   - 'kubernetesCluster' : Azure Kubernetes Service cluster name
#     'sqlDbConnectionString' : Azure SQL DB Connection String value.  Refer to 'appsettings.json' file.
# 
# Add steps that run tests, create a NuGet package, deploy, and more:
# https://docs.microsoft.com/azure/devops/pipelines/languages/dotnet-core

# pool:
#  vmImage: 'Ubuntu 16.04'

pool:
  name: <Name of AKS Agent Pool in Azure DevOps Services eg., AKS-Agent-Pool>

variables:
  system.debug: false
  containerRegistryServiceConnection: <Specify ACR service connection>
  imageRepository: claims-api
  DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: <Passphrase for DCT delegation key pair> 
  privateKeyFilename: <Name of the secure file containing the private key>
  azureSubscriptionEndpoint: <Specify Azure RM connection>
  azureContainerRegistry: <Azure Container Registry name - name.azurecr.io>
  azureResourceGroup: <Azure Resource Group - name>
  kubernetesCluster: <Azure Kubernetes Service - name>
  sqlDbConnectionString: <Azure SQL DB Connection String>

steps:
- task: DownloadSecureFile@1
  displayName: Download secure file
  name: privateKey
  inputs:
    secureFile: $(privateKeyFilename)

- task: Docker@2
  displayName: Build container image
  inputs:
    command: build
    containerRegistry: $(containerRegistryServiceConnection)
    Dockerfile: '**/dockerfile'
    repository: $(imageRepository)
    tags: |
      $(Build.BuildId)

- task: Bash@3
  displayName: Scan container image with Aqua Trivy
  name: aqua_trivy
  inputs:
    targetType: inline
    script: |
      trivy --exit-code 0 --clear-cache --ignore-unfixed --vuln-type os --severity MEDIUM,HIGH,CRITICAL $(azureContainerRegistry)/$(imageRepository):$(Build.BuildId)
# trivy --exit-code 1 --ignore-unfixed --vuln-type os --severity CRITICAL $(imageRepository):$(Build.BuildId)

- task: Docker@2
  displayName: Docker login to ACR
  inputs:
    command: login
    containerRegistry: $(containerRegistryServiceConnection)

- script: |
    mkdir -p $(DOCKER_CONFIG)/trust/private
    cp $(privateKey.secureFilePath) $(DOCKER_CONFIG)/trust/private

- task: Docker@2
  displayName: Sign and push container image to ACR
  inputs: 
    command: push
    containerRegistry: $(containerRegistryServiceConnection)
    repository: $(imageRepository)
    tags: |
      $(Build.BuildId)
    arguments: '--disable-content-trust=false'
  env:
    DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: $(DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE)

- script: |
    docker trust inspect --pretty $(azureContainerRegistry)/$(imageRepository):$(Build.BuildId)

- task: HelmDeploy@0
  displayName: Helm init
  name: helm_init
  inputs:
    connectionType: Azure Resource Manager
    azureSubscriptionEndpoint: $(azureSubscriptionEndpoint)
    azureResourceGroup: $(azureResourceGroup)
    kubernetesCluster: $(kubernetesCluster)
    command: init
    upgradetiller: false
    waitForExecution: true
    arguments: --client-only

- task: HelmDeploy@0
  displayName: Helm upgrade on AKS - $(azureResourceGroup):$(kubernetesCluster)
  name: helm_deploy
  inputs:
    connectionType: Azure Resource Manager
    azureSubscriptionEndpoint: $(azureSubscriptionEndpoint)
    azureResourceGroup: $(azureResourceGroup)
    kubernetesCluster: $(kubernetesCluster)
    command: upgrade
    arguments: --namespace dev-dct --set image.repository=$(azureContainerRegistry)/claims-api --set image.tag=$(Build.BuildId) --set sqldb.connectionString="$(sqlDbConnectionString)" --set blue.enabled=true
    chartType: filepath
    chartPath: $(System.DefaultWorkingDirectory)/claims-api
    releaseName: aks-aspnetcore-lab-dct
    # overrideValues: image.repository=csulabtest.azurecr.io/claims-api,image.tag=$(Build.BuildId)
    install: true
    waitForExecution: true

- script: "echo 'Finished Helm Deploy...'"
  displayName: Helm deploy end
  name: echo_helm_end