DEV Community: Lester Diaz Perez

[Boost]

Lester Diaz Perez — Sun, 22 Jun 2025 00:46:42 +0000

Lester Diaz Perez

Jun 21 '25

Azure DevOps: build & push docker micro-services to Azure Container Registry

#azure #devops #cicd #docker

Comments 1

5 min read

Deploying ArgoCD on an Azure Kubernetes Cluster for GitOps

Lester Diaz Perez — Sat, 21 Jun 2025 19:10:09 +0000

Azure Kubernetes Service (AKS) Cluster Setup ☸️

This document outlines the steps to create an Azure Kubernetes Service (AKS) cluster.

1. Prerequisites: Equipping Your Toolkit 🛠️

Before you begin, ensure you have:

An active Azure subscription 💳.
Azure CLI installed and configured. If not, follow the official Azure CLI installation guide 💻.
kubectl installed. If not, follow the official kubectl installation guide ## 2. Create AKS Cluster: Setting up Your Kubernetes Environment 🔥➡️☸️

Time to create your AKS cluster.

Sign in to Azure Portal: Navigate to portal.azure.com 🔑.
Search for AKS: In the search bar, type "Azure Kubernetes Service" and select it 🔍.

Initiate Cluster Creation: Click "Create" and then "Create Kubernetes cluster" ✨.
Configure Basic Settings ⚙️:
- Project details: Select your Azure subscription and resource group 📂.
- Cluster details:
  - Kubernetes cluster name: Enter a unique name for your cluster 🏷️.
  - Region: Choose the Azure region for your cluster 🌍.
  - Availability zones: Select zones for high availability if needed 🏞️.
  - AKS pricing tier: Standard is recommended for production 💰.
  - Kubernetes version: Choose a recent, stable version ✅.
- Primary node pool:
  - Node size: Select an appropriate VM size 🖥️. Standard_B2s is a good starting point for dev/test. For production, consider Standard_D2s_v3.
  - Scale method: Choose "Autoscale" for flexibility ⚖️.
  - Node count: Set the initial number of nodes #️⃣.

Review and Create: Carefully review all settings 👀. Once confirmed, click "Create". Cluster deployment may take several minutes ⏳. (Perfect time for a coffee! ☕)

3. Connect to Your AKS Cluster: Establishing Communication 🔮

After the cluster is deployed, connect to it.

Install Azure CLI (if not already done):
Ensure Azure CLI is installed 💻.
Verify installation:
```
az --version
```
Login to Azure 🔑:
```
az login
```
Follow the prompts to authenticate.

Get Cluster Credentials 📜:
This command configures kubectl.

az aks get-credentials --resource-group <your-resource-group> --name <your-cluster-name>

Verify Connection ✅:
Check if your nodes are ready.

kubectl get nodes

You should see your nodes listed with a Ready status.

NAME                                STATUS   ROLES   AGE     VERSION
aks-systempool-12345678-vmss000000   Ready    agent   5m16s   v1.28.5
aks-systempool-12345678-vmss000001   Ready    agent   5m17s   v1.28.5

4. Install ArgoCD using Helm: Your GitOps Companion 🧙‍♂️⛵📦

ArgoCD will manage your deployments based on your Git repository.

Add ArgoCD Helm Repository ➕:

helm repo add argo https://argoproj.github.io/argo-helm

Update Helm Repositories 🔄:
```
helm repo update
```

Install ArgoCD 🚀:
This installs ArgoCD into the argocd namespace.

helm install argocd argo/argo-cd --namespace argocd --create-namespace

Access ArgoCD UI (via Port Forwarding) 🖥️➡️🚪:
Access the ArgoCD dashboard.

kubectl get pods -n argocd
# Wait for argocd-server to be Running
kubectl port-forward svc/argocd-server -n argocd 8080:https

Open https://localhost:8080 in your browser.

Get Initial Admin Password 🤫🔑:
"Keep it secret, keep it safe!" (Okay, just one for the road! 😉)

kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d; echo

5. Next Steps: The Journey Continues... ➡️👣

Your AKS and ArgoCD setup is complete!

Connect Git repositories to ArgoCD 🔗.
Define applications for ArgoCD to manage 📝.

Azure DevOps: build & push docker micro-services to Azure Container Registry

Lester Diaz Perez — Sat, 21 Jun 2025 19:08:05 +0000

🦆 Prerequisites: Get Your Ducks in a Row

Before we dive in:

Requirement	Why You Need It
✅ Azure subscription	Need Credits
✅ Docker basics	Containerization knowledge
✅ Git workflows	Version control fundamentals
✅ GitHub repo	Fork this repo
☕ Coffee	Optional but highly recommended

Microservices Architecture:

🏗️ Step 1: Azure DevOps Foundation

Why Azure DevOps?

🔥 Industry standard for enterprise CI/CD
💎 Free private repos (up to 5 users)
🚀 Seamless Azure integration

Quick Setup:

🌐 Head to Azure DevOps
🆕 Create new project
🔗 Link your forked example-voting-app repo

🏪 Step 2: Container Registry - Your Image Vault

The Solution: Azure Container Registry (ACR)

🔒 Private & secure
⚡ Geo-replication
🔗 Native Azure integration

Think of ACR as: Your private, VIP parking garage for containers!

Quick Create:

Navigate to Container Registry → Create

Oops! 🤦‍♂️ Need a Resource Group first. Let's fix that...

📁 Step 3: Resource Group - Organization Master

What it is: Think digital folder that keeps all your Azure resources organized.

Why it matters:

💰 Cost tracking per project
🗂️ Easy cleanup (delete group = delete everything)
🎯 Access management in one place

Naming convention: rg-voting-app-prod (descriptive + environment)

🤖 Step 4: Self-Hosted Agent - Your Build Butler

Hosted vs Self-Hosted: The Truth

Hosted Agents	Self-Hosted Agents
💸 Pay per minute	💰 Free after VM cost
🐌 Queue times	⚡ Instant builds
🔒 Limited customization	🔧 Full control

Setup Process:

🖥️ Create Ubuntu VM in Azure
⚙️ Azure DevOps → Project Settings → Agent Pools → Add pool
📋 Follow installation steps

🔐 Security: Personal Access Token (PAT)

Why PAT? Secure communication between agent and Azure DevOps.

Steps:

Profile picture → Personal Access Tokens
Create token with required scopes

Security Note: Full access scope = demo only. Production = minimal required permissions! ⚠️

💍 Step 5: Crafting My Preciouuuuss Pipeline

"One pipeline to build them all, one pipeline to find them, one pipeline to bring them all, and in the registry bind them." – DevOps Gandalf

Pipeline Creation Magic ✨

Azure DevOps makes this stupid easy:

Pipelines → New Pipeline
Azure Repos Git
Select repository
Docker - build and push to ACR

Look at all the infinity of tasks available! Probably all frequently used tasks are already developed here. But you know, if something's missing, you can always create it yourself!

Dockerize and Push Our Vote Microservice

🐳 Creating the Vote Pipeline

Now let's create a dedicated pipeline for our vote microservice. This pipeline will:

✅ Trigger only on vote/ changes (efficient builds)
✅ Build the Python Flask app using Docker
✅ Push to Azure Container Registry securely
✅ Tag with build number for version tracking

Pipeline Configuration:

trigger:
  paths:
    include:
    - vote/*  # Only triggers when vote microservice changes

resources:
- repo: self

variables:
  dockerRegistryServiceConnection: '2833cab0-ae52-474d-97fd-43a2db870ebe'
  imageRepository: 'vote' # For each service one repository (worker, result)
  containerRegistry: 'sharker3312.azurecr.io'
  dockerfilePath: '$(Build.SourcesDirectory)/vote/Dockerfile' # Dockerfile PATH
  tag: '$(Build.BuildId)'

pool:
 name: 'self-host'  # Using our self-hosted agent

stages:
- stage: Build
  displayName: Build and push stage
  jobs:
  - job: Build
    displayName: Build
    steps:
    - task: Docker@2
      displayName: Build and push an image to container registry
      inputs:
        command: buildAndPush
        repository: $(imageRepository)
        dockerfile: $(dockerfilePath)
        containerRegistry: $(dockerRegistryServiceConnection)
        tags: |
          $(tag)
          latest

🚨 REALITY CHECK: When Things Go BOOM! 💥

Because let's be honest - your first pipeline run is going to fail spectacularly, and that's perfectly normal! 😅

🔥 THE MOMENT OF TRUTH 🔥

You hit that "Run Pipeline" button with all the confidence in the world, and then...

Problem Solved: Our agent needs Docker to build those containers! Let's fix that:

sudo apt-get update
sudo apt-get install -y apt-transport-https ca-certificates curl software-properties-common
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io

# Add agent user to docker group (no sudo needed for docker)
sudo usermod -aG docker $USER

Don't worry about errors - they're just DevOps giving you a chance to learn something new! 🧠

🏷️ Tagging Strategy Explained:

Tag	Example	Purpose
Build ID	`vote:12345`	Specific version tracking
Latest	`vote:latest`	Always points to newest build

🔄 Step 7: Worker & Result Microservices

👷‍♂️ The Worker Pipeline

  imageRepository: 'worker' # Changed from 'vote'
  dockerfilePath: '$(Build.SourcesDirectory)/worker/Dockerfile' # Changed path

Also update your trigger path:

trigger:
  paths:
    include:
    - worker/*  # Only triggers when worker microservice changes

📊 The Result Pipeline

Same story, different microservice! For the Result app, just modify:

  imageRepository: 'result' # Changed from 'vote'
  dockerfilePath: '$(Build.SourcesDirectory)/result/Dockerfile' # Changed path

And update your trigger:

trigger:
  paths:
    include:
    - result/*  # Only triggers when result microservice changes

Pro tip: 🧙‍♂️ With this approach, each microservice has its own dedicated pipeline that only triggers when that specific service changes! Talk about efficiency!

At this moment we've got all our pipelines functioning beautifully:

🔄 Step 8: Redis & PostgreSQL - The Missing Pieces

🤔 What about Redis and PostgreSQL?

No need to reinvent the wheel! For these components:

🐘 PostgreSQL - Using official public image from Docker Hub
🔄 Redis - Using official public image from Docker Hub

Why use public images?

🏆 Production-ready containers maintained by experts
🛡️ Security updates automatically rolled out
💰 Cost-efficient - no need to maintain our own images

🚢 What's Next?

But the real question is: What do we do with these container images once they're in our registry?

Well, this is just the beginning of our DevOps journey! Now we need a way to manage these containers through a single orchestration service.

Maybe Kubernetes - the container orchestration superhero! 🦸‍♂️

🏗️ Provision AWS EC2 Instances with Terraform and Set Up Docker via User Data

Lester Diaz Perez — Thu, 09 Jan 2025 15:34:14 +0000

📋Workflow

1️⃣ 📁 Structure
2️⃣ 🌱 Root module
3️⃣ 💻 EC2 module
4️⃣ 🛡️ Security Group module

🔗Link to project

1️⃣ 📁 Structure

├── dev.tfvars
├── main.tf
├── provider.tf
├── modules
│   ├── ec2
│   │   ├── install_docker.sh
│   │   ├── main.tf
│   │   ├── output.tf
│   │   └── variables.tf
│   └── security_group
│       ├── igw.tf
│       ├── output.tf
│       ├── rt.tf
│       ├── sg.tf
│       ├── subnet.tf
│       └── vpc.tf

Why it's important to split terraform into modules?

🔄 Code reuse
📈 Improved scalability
🧩 Modularity and abstraction
👥 Clear separation of responsibilities.
🛠️ Simplified maintenance
📖 Improved readability
🔄 Efficient version control

2️⃣ 🌱 Root module

# main.tf
variable "ami" {}
variable "instance_type" {}
variable "key_name" {}


#Replace the resource with a module
module "ec2_instance" {
  #References file location of new module
  source = "./modules/ec2"

  ami = var.ami
  instance_type = var.instance_type
  key_name = var.key_name

  subnet_id = module.security_group.subnet_id  # Call the name of variable output 

  sg_id = module.security_group.sg_id


}

# Specify the name for the security group
module "security_group" {
  source = "./modules/security_group"

}

#provider.tf
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.52.0"
    }
  }

}


provider "aws" {
  region  = "us-east-2"
}

# dev.tfvars
ami = "ami-0b4624933067d393a" # each ami is region specific 
instance_type = "t2.micro"
key_name = "ec2_key"

3️⃣ 💻 EC2 module

# modules/ec2/main.tf
variable "ami" {}
variable "instance_type" {}
variable "key_name" {}

resource "aws_instance" "ec2" {
  ami           = var.ami
  instance_type = var.instance_type
  key_name      = var.key_name

  vpc_security_group_ids = [var.sg_id]
  subnet_id = var.subnet_id
  user_data = "${file("./modules/ec2/install_docker.sh")}"

  tags = {
    Name = "traefik-demo"
  }
}

# modules/ec2/variables.tf
variable "sg_id" {
  description = "Security Group ID"
  type        = string
}
variable "subnet_id" {
  description = "Subnet ID"
  type        = string
}

🔑 Key points.
The EC2 module requires two essential fields:

🛡️ Security Group ID.
🌐 Subnet ID

# modules/ec2/output.tf
output "instance_id" {
  value = aws_instance.ec2.id
}

output "public_ip" {
  value = aws_instance.ec2.public_ip
}

#!/bin/bash
# Update and install Docker
sudo yum update -y
sudo yum install -y jq docker


# Enable Docker service
sudo service docker start
sudo usermod -a -G docker ec2-user

# Get the latest version of Docker Compose 
DOCKER_COMPOSE_VERSION=$(curl -s https://api.github.com/repos/docker/compose/releases/latest | jq -r .tag_name)

# Install Docker Compose
sudo curl -L "https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose

4️⃣ 🛡️ Security Group module

vpc.tf

#modules/security_group/vpc.tf
resource "aws_vpc" "traefik_vpc" {
  cidr_block = "10.0.0.0/16"

  tags = {
    Name = "main-vpc"
  }
}

#modules/security_group/subnet.tf
resource "aws_subnet" "traefik_subnet" {
    vpc_id                  = aws_vpc.traefik_vpc.id
    cidr_block              = "10.0.1.0/24"
    map_public_ip_on_launch = true

    tags = {
        Name = "example-subnet"
    }
}

#modules/security_group/sg.tf
resource "aws_security_group" "traefik_sg" {
  name        = "traefik-security-group"
  vpc_id = aws_vpc.traefik_vpc.id
  description = "Allow HTTP and HTTPS traffic"

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
   ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"] # Allow ssh from internet
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1" # Allow all traffic
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "traefik_sg"
  }
}

#modules/security_group/rt.tf
resource "aws_route_table" "traefik_route_table" {
  vpc_id = aws_vpc.traefik_vpc.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.traefik_igw.id
  }

  tags = {
    Name = "route_table"
  }
}
resource "aws_route_table_association" "a" {
  subnet_id      = aws_subnet.traefik_subnet.id
  route_table_id = aws_route_table.traefik_route_table.id
}

#modules/security_group/igw.tf
resource "aws_internet_gateway" "traefik_igw" {
  vpc_id = aws_vpc.traefik_vpc.id

  tags = {
    Name = "traefik_IGW"
  }
}

#modules/security_group/output.tf
output "subnet_id" {
  value = aws_subnet.traefik_subnet.id
}

output "sg_id" {
  value = aws_security_group.traefik_sg.id
}

🏗️ Terraform deploy

 terraform init
 terraform validate --var-file=dev.tfvars
 terraform plan --var-file=dev.tfvars
 terraform apply --var-file=dev.tfvars -auto-approve

☁️ AWS - Email notification system

Lester Diaz Perez — Mon, 17 Jun 2024 20:13:55 +0000

Technologies:

☁️ AWS: 🪣 S3 bucket, ⚡️ lambda function, 🔔 SNS, 📬 SQS
🤖 IaC: 🏗️ Terraform
🔄 CD: 🛠️ GitLab

Project resume: Email notification system developed in AWS. Once a file is uploaded to an s3 bucket it triggers an event which calls a lambda function and notifies service subscribers that a file has been uploaded.

📌Requirements

🎯Workflow

1️⃣ Source code 📄
2️⃣ Lambda function ⚡️
3️⃣ Deploy to AWS through GitLab 🚀

1️⃣ Source code 📄

Gitlab project

Structure

terraform
└── terraform
    ├── bucket
    │   ├── main.tf
    │   └── output.tf
    │   └── variables.tf
    ├── lambda
    │   ├── main.tf
    │   └── output.tf
    │   └── variables.tf
    │   └── lambda_assume_role_policy.json
    │   └── lambda_policy.json
    │   └── lambda_function.py
    │   └── lambda_function.zip
    ├── sns
    │   ├── main.tf
    │   └── output.tf
    │   └── variables.tf
    ├── sqs
    │   ├── main.tf
    │   └── output.tf
    │   └── variables.tf
    ├── main.tf
    └── providers.tf

It is organized into modules dedicated to different AWS services, each designed to serve a specific purpose and facilitate the management and scalability of the cloud environment.In addition, using Terraform to orchestrate these modules ensures a consistent and controlled deployment of the infrastructure, aligned with best practices for configuration management and agile development in the cloud.

2️⃣ Lambda function ⚡️

import json
import boto3

# Initialize AWS clients
s3_client = boto3.client('s3')
sns_client = boto3.client('sns')
sqs_client = boto3.client('sqs')

def lambda_handler(event, context):
    # Define SNS topic ARN and SQS queue URL
    sns_topic_arn = 'arn:aws:sns:us-east-2:087243254862:notifcationsystem-bucket'
    sqs_queue_url = 'https://sqs.us-east-2.amazonaws.com/087243254862/notification'

    # Process S3 event records
    for record in event['Records']:
        # Print the entire event for debugging purposes
        print(event)

        # Extract S3 bucket and object information from the event record
        s3_bucket = record['s3']['bucket']['name']
        s3_key = record['s3']['object']['key']

        # Example: Prepare metadata to send to SQS
        metadata = {
            'bucket': s3_bucket,
            'key': s3_key,
            'timestamp': record['eventTime']
        }

        # Send metadata to SQS queue
        sqs_response = sqs_client.send_message(
            QueueUrl=sqs_queue_url,
            MessageBody=json.dumps(metadata)
        )

        # Example: Prepare notification message to send to SNS
        notification_message = f"New file uploaded to S3 bucket '{s3_bucket}' with key '{s3_key}'"

        # Publish notification message to SNS topic
        sns_response = sns_client.publish(
            TopicArn=sns_topic_arn,
            Message=notification_message,
            Subject="File Upload Notification"
        )

    # Return a success response
    return {
        'statusCode': 200,
        'body': json.dumps('Processing complete')
    }

3️⃣ GitLab workflow 🚀

Add pipeline

🔑Add access key from AWS into secrets in GitLab(Create a User for this purpose)
▶️ Run

Ansible: The Swiss Army Knife of Automation

Lester Diaz Perez — Fri, 26 Apr 2024 02:11:12 +0000

📌Prerequisites:

Install Ansible
Install Vscode

🎯Workflow

1️⃣What we need to deploy the application❓
2️⃣Structure of the Project👷
3️⃣File Descriptions📂
4️⃣Playbook✏
5️⃣Check connectivity🌐 & Install Docker🐳
6️⃣Run docker app🚀

1️⃣What we need to deploy the application❓

Well, as the application is dockerized, the only thing we have to do is to install docker in the ec2 instance.

2️⃣Structure of the Project👷

ansible/
│
├── ansible.cfg
├── inventory.ini
│
├── key/
│   └── ec2_key.pem
│  
├── playbooks/
│   └── install_docker.yml
│   └── run_image.yml

ansible.cfg📋 : Defines the global configuration for running Ansible tasks in an environment.
inventary.ini📋: Define the list of hosts on which Ansible tasks will run. This file can contain groups of hosts and variables associated with those groups or individual hosts.
- /key/ec2_key.pem : This file will only be available on our localhost and contains the ssh key. Later I will add it as an environment variable.
- /playbooks/install_docker📋 : This file contain all the tasks to execute the docker installation

3️⃣File Descriptions📂

ansible.cfg

[defaults]
inventory = inventory.ini
host_key_checking = False  # optional: removes the SSH prompt 
deprecation_warnings=False  # optional: removes deprecation warning in playbooks
remote_user = ubuntu
#private_key_file = ./key/ec2_key.pem

inventory.ini

[all]
node ansible_host=x.x.x.x ansible_user=ubuntu ansible_ssh_private_key_file=./key/ec2_key.pem

key/ec2_key.pem
alerta bla blA

4️⃣Playbook✏

playbooks/install_docker.yml

---
- name: Install docker
  hosts: all
  become: true

  tasks:
    - name: Install docker dependencies
      ansible.builtin.apt:
        name:
          - apt-transport-https
          - ca-certificates
          - curl
          - gnupg-agent
          - software-properties-common
        update_cache: true

    - name: Add docker gpg key
      ansible.builtin.apt_key:
        url: https://download.docker.com/linux/ubuntu/gpg
        state: present
        keyring: /etc/apt/keyrings/docker.gpg

    - name: Add docker repository
      ansible.builtin.apt_repository:
        filename: docker
        repo: deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ansible_lsb.codename | lower }} stable
        state: present

    - name: Install docker engine
      ansible.builtin.apt:
        name:
          - docker-ce
          - docker-ce-cli
          - containerd.io
          - docker-buildx-plugin
          - docker-scan-plugin
          - docker-compose-plugin
        update_cache: true

    - name: Add user permissions
      shell: "usermod -aG docker ubuntu"

5️⃣Check connectivity🌐

ansible -i inventory.ini -m ping all

Then, install docker🐳 on the host
ansible-playbook -i inventory.ini playbooks/install_docker.yml

6️⃣Run docker app🚀

This is the playbook to pull and run the docker image

---
- name: Download and run sharker3312/nodeapp:latest
  hosts: all
  become: true

  tasks:
    - name: Download Docker image
      ansible.builtin.docker_image:
        name: sharker3312/nodeapp:latest
        source: pull

    - name: Run Docker container
      ansible.builtin.docker_container:
        name: nodeapp
        image: sharker3312/nodeapp:latest
        state: started
        detach: yes
        ports:
          - "8000:8000"

ansible-playbook -i inventory.ini playbooks/run_image.yml

The web site:

The purpose of using anisble software is to fully automate daily tasks. In this blog we observed how without having an interactive shell on the EC2 instance we were able to deploy a docker image.

Working Less, Automating More: Simplifying AWS Management with Terraform and GitHub Actions

Lester Diaz Perez — Sat, 13 Apr 2024 02:39:45 +0000

📌Prerequisites:

AWS account
VsCode

🎯Workflow

1️⃣Create IAM user👤
2️⃣Save🔒 Acces & Secret
3️⃣Key Pair for ssh🔑
4️⃣Terraform Pipeline📝
5️⃣Job from Github Actions📝

1️⃣Create IAM user👤

Login AWS
IAM -> Users -> Create user

Name of user whatever as you wish

Select Attach policies directly -> Select AmazonEC2FullAccess

It's not❌ the best practice, but it's simple for this purpose

User created successfully✅

Create Credentials

Create Access Key -> Third-party service

2️⃣Save🔒 Acces & Secret

Go to Github repository
Settings -> Secrets & Variables -> Actions
Save as a Secret

AWS_ACCESS_KEY_ID TF_USER_AWS_SECRET

3️⃣Create Key Pair for ssh

Just go here and name it.Is simple

The key will download⬇ automatically

4️⃣Terraform Pipeline📝

Create a new directory in the root project
🔰Name: terraform

This is a very simple pipeline. Remember this is a tutorial. I will soon make📍 a Terraform series.

provider "aws" {
  region = "us-east-2" #Region as you wish
}

resource "aws_instance" "nodeapp" {
  ami           = "ami-00cda30cf72311684" #Check the AMI list for free tier
  instance_type = "t2.micro" #Well... very intuitive -_-
  key_name = "ec2_key" #Name of key pair created in step 3
  vpc_security_group_ids = [aws_security_group.nodeapp.id] # ID security group


  tags = {
    Name = "Nodeapp"
  }
}

#Security Group
resource "aws_security_group" "nodeapp" {
  name        = "ec2_ecurity-group" #Whatever name
  description = "Allow inbound traffic on port 8080 and SSH" #The app expose port  8080




  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 8080
    to_port     = 8080
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

5️⃣Job from Github Actions📝

name: Deploy Node app 

on:
  push:
    branches:
      - master

jobs:
  tf-aws:
    name: Deploy Node app to AWS
    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: terraform #Path directory

    steps:

      - name: Checkout repository
        uses: actions/checkout@v2

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-2

      - name: Setup Terraform CLI
        uses: hashicorp/setup-terraform@v3

      - name: Terraform Init
        run: terraform init

      - name: Terraform Validate
        run: terraform validate

      - name: Terraform Plan
        run: terraform plan 

      - name: Terraform Apply
        run: terraform apply -auto-approve

🎬 Run the job

✅

Integrating a CodeQuality Scanner into Github Actions

Lester Diaz Perez — Tue, 02 Apr 2024 20:41:21 +0000

🎯Workflow

1️⃣Search🔍 the CodeQuality scanner tool
2️⃣Hands On✍

1️⃣Search🔍 the CodeQuality scanner tool

As always Let's go to the 🛒marketplace
Looking for a Codequality scanner🐞

Well, the SonarCloud is very used

2️⃣Hands On✍

Select SonarCloud and complete✅ the process
Just select the current repository in which you are working

You will be redirected to login📌 of the web SonarCloud(Just continue with your github account)

Create Organization👥

2️⃣Hands On✍

Inside the web ,get the SONAR_TOKEN

✏Save the SONAR_TOKEN as a secret in the repository
Create this file🗒 at the root directory >sonar-project.properties

sonar.projectKey=sharker_sharker
sonar.organization=sharker
sonar.host.url=https://sonarcloud.io

Add ➕ this job to the Workflow

 sonarcloud:
    name: SonarCloud
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
      - name: SonarCloud Scan
        uses: SonarSource/sonarcloud-github-action@master
        env:
          # This Token is automatically generated by Github
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

🎬Run The Action

Done 🚀

Add Slack notifications into Github Actions

Lester Diaz Perez — Tue, 02 Apr 2024 20:39:02 +0000

🎯Workflow

1️⃣Search🔍 the Slack-Notifications in the marketplace🛒
2️⃣Configure📋 the Webhook
3️⃣Configure📋 the Job

1️⃣Search🔍 the Slack-Notifications in the marketplace🛒

Go to github action marketplace

Select Slack-Notify🔔
Read📖 the doc

2️⃣ Configure 📋 the Webhook

For communication between Slack and Github we need a Slack webhook.

Login in Slack

Enter here to add the incoming webhook

You will be asked❓ to enter your team URL

Select the channel📱 to which you want to post

Save the URL generated as a Webhook

3️⃣Configure📋 the Job

Add ➕ a Slack Notification Job to the pipeline

 Slack-Notify:
    runs-on: ubuntu-latest
    #Wait for test job ending
    needs: test
    #If the test job is wrong, this job will still be executed 
    if:  always()
    steps:
    - uses: actions/checkout@v2
    - name: Slack Notification
      uses: rtCamp/action-slack-notify@v2
      env:
        #Settings->Secrets & Variables->Actions->New Secret
        #Paste here your secret webhook 
        SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
        # The variable needs.test.result print the result of the test job 
        SLACK_COLOR: ${{ needs.test.result }}
        SLACK_CHANNEL: general
        SLACK_USERNAME: 'Node-Bot'
        SLACK_TITLE: Workflow ${{ needs.test.result }}
        SLACK_MESSAGE_ON_SUCCESS: '✅'
        SLACK_MESSAGE_ON_FAILURE: '❌'
        SLACK_FOOTER: By Sharker3312

🚨🚨🚨:It is likely that you only want to send notifications when an error occurs, in this case just substitute this line
if: ${{ always() && (needs.failing-job.result == 'failure' || needs.failing-job.result == 'timed_out') }}

Done✅🚀

Leveraging GitHub Actions, Docker, Code Quality, and Slack Integration

Lester Diaz Perez — Mon, 01 Apr 2024 03:53:30 +0000

📌Prerequisites:

Github account
Dockerhub account
Web repository for dockerize

The web repository could be any of you wish

🎯Workflow

1️⃣Build🧱 & Test🧪
2️⃣Dockerize🐳 the web project
3️⃣Upload💹 image to your docker hub account

1️⃣Build🧱 & Test🧪

Why do what others have already done?

Github Actions has a marketplace where you can find🔎 any pipeline that any other developer has developed.

Writing✏ the pipeline

Inside repo -> Click in Actions

Create the workflow -> Enter New workflow
Search for a NodeJs pipeline

Adjust the pipeline to your needs An example of my pipeline stages

2️⃣Dockerize🐳 the web project

So, if you want to contain the application, you just have to write a dockerfile

🚨 Packing the NodeJs project

Create a dockerfile.ci at the root project directory

FROM node:18-alpine
WORKDIR /usr/src/app

COPY package.json package-lock.json ./
COPY app.js ./
COPY views ./views/

RUN npm install
#web port
EXPOSE 8000
CMD ["node", "app.js"]

3️⃣Upload💹 image to your docker hub account

Go to github marketplace🛒
Looking for build and push dockerhub

I like this pipeline

#Name of Job
 to_dockerhub:
    runs-on: ubuntu-latest
    #Wait for ending test process
    needs: test

    steps:

    - uses: actions/checkout@v3
      name: Check out code

    - uses: mr-smithers-excellent/docker-build-push@v6
      name: Build & push Docker image
      with:
        #Name's dockerhub / Name as you want
        image: sharker3312/nodeapp
        tags: v1, latest
        registry: docker.io
        dockerfile: Dockerfile
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKER_PASSWORD }}

Create the secret for login

Go to Settings

In left panel Click
Secrets and Variables -> Actions

Enter the secrets

🎬Run the workflow

🔦Check the dockerhub repository

Done✅🚀

Manual Approval and Telegram Notifications in Jenkins

Lester Diaz Perez — Mon, 11 Mar 2024 01:43:08 +0000

Why use a manual approval step in the deploy code?

Manual approval in Jenkins provides a mechanism to ensure quality, security and compliance in software development and deployment processes.

Manual approval

Add this stage to the pipeline

 stage('Approval') {
        steps {
            timeout(time: 15, unit: "MINUTES") {
                        input message: 'Do you want to approve the deployment?', ok: 'Yes'
                    }

                    echo "Initiating deployment"
        }
    }

Telegram Notifications

To send notifications we need two things
First: HTTP_API of bot
Second: CHAT_ID

HTTP_API of bot

Create telegram bot
1. BotFather in Telegram (@botfather)
2. Send /newbot command
3. Enter bot name and bot username
token-http-api

CHAT_ID
1. Go to @myidbot
2. Enter: /start -> /getid
3. Save your chat_ID

Creating Jenkins Global Credentials

Manage Jenkins -> Credentials -> System -> Global credentials (unrestricted)
Add Crediantials(CHAT_ID & TELEGRAM_API)

Configurig pipeline

_At the top of the pipeline

environment {
        // Telegram configuration
        TOKEN = credentials('telegram-api')
        CHAT_ID = credentials('telegram_chatid')
    }

Declare two variables which contain the tokens

 post {
        success {
            script {
                sh "curl -X POST -H 'Content-Type: application/json' -d '{\"chat_id\": \"${CHAT_ID}\", \"text\": \"${JOB_NAME}: #${BUILD_NUMBER}\n✅ Deploy succeeded! \", \"disable_notification\": false}' \"https://api.telegram.org/bot${TOKEN}/sendMessage\""
            }
        }
        failure {
            script {
                sh "curl -X POST -H 'Content-Type: application/json' -d '{\"chat_id\": \"${CHAT_ID}\", \"text\": \"${JOB_NAME}: #${BUILD_NUMBER}\n❌Deploy failure!\", \"disable_notification\": false}' \"https://api.telegram.org/bot${TOKEN}/sendMessage\""
            }
        }

       aborted {
            script {
                sh "curl -X POST -H 'Content-Type: application/json' -d '{\"chat_id\": \"${CHAT_ID}\", \"text\": \"${JOB_NAME}: #${BUILD_NUMBER}\n❌Deploy aborted!\", \"disable_notification\": false}' \"https://api.telegram.org/bot${TOKEN}/sendMessage\""
            }
        }    

    }

I hope helpful!!

Integrating SonarQube into Your CI/CD Pipeline: Elevating Code Quality and Security

Lester Diaz Perez — Mon, 26 Feb 2024 01:23:40 +0000

Adding Sonarqube into our workflow, code and security analysis.

Pre-requisites

Read the 1st part
Ngrok app

For clarification

I tried to install it on the t2.micro instance but Sonarqube requires 2 gb ram

We will install it on our local machine to do everything for free at least in this test environment, but in AWS a t2.medium is recommended (it is not free tier).

Deploy Sonarqube

Sonarqube compose file
cd /path(compose file)

docker-compose up -d

In sonarqube it is typical to find this error when deploying the container.

The solution is simple paste into the CLI the next code

sudo sysctl -w vm.max_map_count=262144

Opening Sonarqube Web -> http://localhost:9000

Well as sonarqube is in our localhost now we will expose it to the internet

Tunneling app to internet through Ngrok

Our Sonarqube is now exposed to the internet

Configure Jenkins to add Sonarqube

Go to Jenkins -> Manage Jenkins -> Plugins ->Available plugins
Install SonarQube Scanner

Now we configure the plugin

Manage Jenkins -> System

Search SonarQube servers -> Click Environment variables

Go to SonarQube Web
Click in Administration bar -> Security-> Users

Click Token and name it

Now copy the token into the jenkins configuration variable

Press Add

Kind= Secret text ID and description name them as you wish

Change Server authentication token

Save

CodeQuality Stage

Take a look to the pipeline project

tools: maven 3.9.6
Go to Manage Jenkins -> Tools -> Maven

Ready to run the job

Build the job

New Item -> Pipeline

Check the correct branch

run

Pulsa sobre el icono de sonarqube en la web, y haz click en el proyecto demo

Quality Gate

What is a quality gate for?
This function is used to wait for a certain time until the code analysis is completed
It's simple to use, just add the next code to the pipeline

stage("Quality Gate") {
      steps {
        timeout(time: 2, unit: 'MINUTES') {
          waitForQualityGate abortPipeline: true
        }
      }
    }