Windows Containers and .NET Framework applications: DevOps with Kubernetes

# Only required if AKS creation fails due to
# Service Principal not existing or unable to be created automatically.
az ad sp create-for-rbac \
    --skip-assignment \
    --name myAksServicePrincipal

# Create new cluster with 2 system (Linux)
# nodes (you will be prompted for a password)
az aks create \
    --resource-group myResourceGroup \
    --name myAKSCluster \
    --node-count 2 \
    --enable-addons monitoring \
    --generate-ssh-keys \
    --location myAzureRegion \
    --windows-admin-username windowsAdminUser \
    --vm-set-type VirtualMachineScaleSets \
    --network-plugin azure \
    --service-principal myAppIdFromAdCreate \
    --client-secret myAppPasswordFromAdCreate

# Add Windows Node Pool with 2 nodes
az aks nodepool add \
    --resource-group myResourceGroup \
    --cluster-name myAKSCluster \
    --os-type Windows \
    --name winnp \
    --node-count 2

az aks get-credentials \
    --resource-group myResourceGroup \
    --name myAKSCluster \
    --admin \
    --file akscreds.txt

[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes("YOUR_CONNECTION_STRING"))

apiVersion: v1
kind: Secret
metadata:
  name: dbconnection
type: Opaque
data:
  connstring: U2Vy_NOT_A_VALID_BASE_64_sdoinsdcoin=

#Depending on the operating system of the host machines(s) that will build or run the containers, the image specified in the FROM statement may need to be changed.
#For more information, please see https://aka.ms/containercompat

FROM mcr.microsoft.com/dotnet/framework/aspnet:4.8-windowsservercore-ltsc2019
ARG source
WORKDIR /inetpub/wwwroot
COPY ${source:-obj/Docker/publish} .

FROM mcr.microsoft.com/dotnet/framework/sdk:4.8 AS build
WORKDIR /app

# copy csproj and restore as distinct layers
COPY MvcMusicStore-Completed/*.sln .
COPY MvcMusicStore-Completed/MvcMusicStore/*.csproj ./MvcMusicStore/
COPY MvcMusicStore-Completed/MvcMusicStore/*.config ./MvcMusicStore/
RUN nuget restore

# copy everything else and build app
COPY MvcMusicStore-Completed/MvcMusicStore/. ./MvcMusicStore/
WORKDIR /app/MvcMusicStore
RUN msbuild /p:Configuration=Release -r:False


FROM mcr.microsoft.com/dotnet/framework/aspnet:4.8 AS runtime
WORKDIR /inetpub/wwwroot
COPY --from=build /app/MvcMusicStore/. ./

az acr create --name myContainerRegistry \
              --resource-group myResourceGroup \
              --sku Basic \
              --admin-enabled true \
              --location myAzureRegion

az aks update \
   --resource-group myResourceGroup \
   --name myAKSCluster \
   --attach-acr $(az acr show --name myContainerRegistry --resource-group myResourceGroup --query "id" -o tsv)

name: Build Windows Container Image

on:
  push:
    branches: [ post-containerisation ]
  pull_request:
    branches: [ post-containerisation ]
  workflow_dispatch:

env:
  dockerfilePath: 'MvcMusicStore-Completed\CIDockerfile'
  USER: ${{ secrets.ACR_USER }}
  TOKEN: ${{ secrets.ACR_SECRET }}
  REPOSITORY: ${{ secrets.ACR_INSTANCE }}

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  # This workflow contains a single job called "build"
  build-and-deploy-to-azure:
    # The type of runner that the job will run on
    runs-on: windows-latest

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
      - uses: actions/checkout@v2

      - name: Build and push an image to container registry
        run: |
          docker login $env:REPOSITORY -u $env:USER -p $env:TOKEN
          docker build --file=$env:dockerfilePath -t ${{ secrets.ACR_INSTANCE }}/${{ secrets.IMAGE_NAME }}:${{ github.run_id }} .
          docker image push ${{ secrets.ACR_INSTANCE }}/${{ secrets.IMAGE_NAME }}:${{ github.run_id }}
          docker logout

helm create mvcmusicstoreweb

apiVersion: v2
name: mvcmusicstoreweb
description: MVC Music Store web application

# A chart can be either an 'application' or a 'library' chart.
#
# Application charts are a collection of templates that can be packaged into versioned archives
# to be deployed.
#
# Library charts provide useful utilities or functions for the chart developer. They're included as
# a dependency of application charts to inject those utilities and functions into the rendering
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
type: application

# This is the chart version. This version number should be incremented each time you make changes
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
version: 0.1.0

# This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application. Versions are not expected to
# follow Semantic Versioning. They should reflect the version the application is using.
# It is recommended to use it with quotes.
appVersion: "latest"

# Default values for mvcmusicstoreweb.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

replicaCount: 1

image:
  repository: your_repo.azurecr.io/mvcmusicstoreweb
  pullPolicy: Always
  # Overrides the image tag whose default is the chart appVersion.
  tag: ""

imagePullSecrets: []
nameOverride: "mvcmusicstore"
fullnameOverride: "mvcmusicstore"

serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # Annotations to add to the service account
  annotations: {}
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: ""

podAnnotations: {}

podSecurityContext: {}
  # fsGroup: 2000

securityContext: {}
  # capabilities:
  #   drop:
  #   - ALL
  # readOnlyRootFilesystem: true
  # runAsNonRoot: true
  # runAsUser: 1000

service:
  type: LoadBalancer
  port: 80

ingress:
  enabled: false
  annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
  hosts:
    - host: chart-example.local
      paths:
      - path: /
        backend:
          serviceName: chart-example.local
          servicePort: 80
  tls: []
  #  - secretName: chart-example-tls
  #    hosts:
  #      - chart-example.local

resources:
  requests:
    cpu: 512m
    memory: 256Mi

autoscaling:
  enabled: false
  minReplicas: 1
  maxReplicas: 10

nodeSelector:
  kubernetes.io/os: windows

tolerations: []

affinity: {}

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "mvcmusicstoreweb.fullname" . }}
  labels:
    {{- include "mvcmusicstoreweb.labels" . | nindent 4 }}
spec:
  {{- if not .Values.autoscaling.enabled }}
  replicas: {{ .Values.replicaCount }}
  {{- end }}
  selector:
    matchLabels:
      {{- include "mvcmusicstoreweb.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      {{- with .Values.podAnnotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      labels:
        {{- include "mvcmusicstoreweb.selectorLabels" . | nindent 8 }}
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "mvcmusicstoreweb.serviceAccountName" . }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      containers:
        - name: {{ .Chart.Name }}
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          env:
            - name: MusicStoreEntities
              valueFrom:
                secretKeyRef:
                  key: connstring
                  name: dbconnection
          ports:
            - name: http
              containerPort: 80
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /
              port: http
          readinessProbe:
            httpGet:
              path: /
              port: http
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}

name: Build Windows Container Image

on:
  push:
    branches: [ deploy-to-k8s ]
  pull_request:
    branches: [ deploy-to-k8s ]
  workflow_dispatch:

env:
  dockerfilePath: 'MvcMusicStore-Completed\CIDockerfile'
  USER: ${{ secrets.ACR_USER }}
  TOKEN: ${{ secrets.ACR_SECRET }}
  REPOSITORY: ${{ secrets.ACR_INSTANCE }}

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  # This workflow contains a single job called "build"
  build-and-publish-docker-image:
    name: Build and Publish Docker Image
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v2

      - name: Build and push an image to container registry
        run: |
          docker login $env:REPOSITORY -u $env:USER -p $env:TOKEN
          docker build --file=$env:dockerfilePath -t ${{ secrets.ACR_INSTANCE }}/${{ secrets.IMAGE_NAME }}:${{ github.run_id }} -t ${{ secrets.ACR_INSTANCE }}/${{ secrets.IMAGE_NAME }}:latest .
          docker image push --all-tags ${{ secrets.ACR_INSTANCE }}/${{ secrets.IMAGE_NAME }}
          docker logout
  build-and-push-helm-chart:
    name: Build and Push Helm Chart
    runs-on: windows-latest
    needs: [build-and-publish-docker-image]
    steps:
    - uses: actions/checkout@master

    - name: Helm Repo Add
      run: |
        helm repo add ${{ secrets.ACR_INSTANCE }} https://${{ secrets.ACR_INSTANCE }}/helm/v1/repo --username ${{ secrets.ACR_USER }} --password ${{ secrets.ACR_SECRET }}
      env:
        HELM_EXPERIMENTAL_OCI: 1

    - name: Helm Chart Save
      run: |
        cd .\charts\mvcmusicstoreweb
        helm chart save . ${{ secrets.IMAGE_NAME }}:v${{ github.run_id }}
        helm chart save . ${{ secrets.ACR_INSTANCE }}/helm/${{ secrets.IMAGE_NAME }}:v${{ github.run_id }}
        # list out saved charts
        helm chart list
      env:
        HELM_EXPERIMENTAL_OCI: 1

    - name: Helm Chart Push
      run: |
        helm registry login ${{ secrets.ACR_INSTANCE }} --username ${{ secrets.ACR_USER }} --password ${{ secrets.ACR_SECRET }}
        helm chart push ${{ secrets.ACR_INSTANCE }}/helm/${{ secrets.IMAGE_NAME }}:v${{ github.run_id }}
      env:
        HELM_EXPERIMENTAL_OCI: 1

  aks-deployment:
    name: AKS Deployment
    runs-on: windows-latest
    needs: [build-and-publish-docker-image,build-and-push-helm-chart]
    steps:
    - uses: actions/checkout@master

    - name: kubeconfig
      run: echo "${{ secrets.KUBECONFIG }}" >> kubeconfig

    - name: Helm Repo Add
      run: |
        helm repo add ${{ secrets.ACR_INSTANCE }} https://${{ secrets.ACR_INSTANCE }}/helm/v1/repo --username ${{ secrets.ACR_USER }} --password ${{ secrets.ACR_SECRET }}
        helm repo update
      env:
        HELM_EXPERIMENTAL_OCI: 1

    - name: Helm Upgrade
      run: |
        mkdir upgrade
        helm registry login ${{ secrets.ACR_INSTANCE }} --username ${{ secrets.ACR_USER }} --password ${{ secrets.ACR_SECRET }}
        helm chart pull ${{ secrets.ACR_INSTANCE }}/helm/${{ secrets.IMAGE_NAME }}:v${{ github.run_id }}
        helm chart export ${{ secrets.ACR_INSTANCE }}/helm/${{ secrets.IMAGE_NAME }}:v${{ github.run_id }} --destination .\upgrade
        helm upgrade ${{ secrets.IMAGE_NAME }} .\upgrade\${{ secrets.IMAGE_NAME }} -i
      env:
        KUBECONFIG: '.\kubeconfig'
        HELM_EXPERIMENTAL_OCI: 1