demo-pipeline.yaml

####
#
# Azure Pipeline for Todo API Server
#
# Displays usage of the Anchore integration with Azure DevOps
#
#####

trigger:
- master
- dev

resources:
- repo: self

variables:
  # Container registry service connection established during pipeline creation
  - name: acrDcarServiceConnection
    value: dcar

  - name: acrProdServiceConnection
    value: demoProduction
  - name: prodRegistry
    value: 'anchoredemo.azurecr.io'

  - name: acrStagingServiceConnection
    value: demoStaging
  - name: stagingRegistry
    value: 'demostaging.azurecr.io'

  - name: imageRepository
    value: 'todoapi'
  - name: dockerfilePath
    value: 'Dockerfile'
  - name: tag
    value: '$(Build.BuildId)'
  - name: prodImage
    value: '$(prodRegistry)/$(imageRepository)'

  # Agent VM image name
  - name: vmImageName
    value: 'ubuntu-latest'

  # Anchore stuff
  - name: anchoreUser
    value: 'admin'
  - name: anchoreUrl
    value: 'http://23.100.36.77/v1/'
  - group: AnchoreCreds
    # anchorepass ^

  - name: k8sImagePullSecret
    value: 'demo-pull-secret'
  - name: clusterName
    value: 'demo'
  - name: namespace
    value: 'todoapi'

stages:
- stage: Staging
  displayName: Build and push to staging registry
  jobs:
  - job: Staging
    displayName: Staging
    pool:
      name: 'Default'
      # vmImage: $(vmImageName)
    steps:
    - script: |
        cp /home/agent/golang/go1.14.3.linux-amd64.tar.gz $(Build.SourcesDirectory)
      displayName: Copy golang tarball

    - task: Docker@2
      displayName: Login to the \"DCAR\"
      inputs:
        command: login
        containerRegistry: $(acrDcarServiceConnection)

    - task: Docker@2
      displayName: Build and push an image to container registry
      inputs:
        command: buildAndPush
        repository: $(imageRepository)
        dockerfile: $(dockerfilePath)
        containerRegistry: $(acrStagingServiceConnection)
        tags: |
          $(tag)

- stage: Scan
  displayName: Scan the staged image
  dependsOn: Staging
  jobs:
  - job: Scan
    displayName: Scan
    pool:
      name: 'Default'
    steps:
    - task: AnchoreEnterprise@0
      inputs:
        image: '$(stagingRegistry)/$(imageRepository):$(tag)'
        url: $(anchoreUrl)
        username: $(anchoreUser)
        password: $(anchorepass)
        dockerfile: Dockerfile

- stage: Production
  displayName: Push to production registry
  dependsOn: Scan
  jobs:
  - job: Production
    displayName: Production
    pool:
      name: 'Default'
      # vmImage: $(vmImageName)
    steps:
    - script: |
        cp /home/agent/golang/go1.14.3.linux-amd64.tar.gz $(Build.SourcesDirectory)
      displayName: Copy golang tarball

    - task: Docker@2
      displayName: Login to the \"DCAR\"
      inputs:
        command: login
        containerRegistry: $(acrDcarServiceConnection)

    - task: Docker@2
      displayName: Build and push an image to container registry
      inputs:
        command: buildAndPush
        repository: $(imageRepository)
        dockerfile: $(dockerfilePath)
        containerRegistry: $(acrProdServiceConnection)
        tags: |
          $(tag)

    - task: PublishPipelineArtifact@1
      inputs:
        artifactName: 'manifests'
        path: 'manifests'

- stage: Deploy
  displayName: Deploy to AKS
  dependsOn: Production
  jobs:
  - deployment: Deploy
    displayName: Deploy to AKS
    environment: $(clusterName).todoapi
    strategy:
      runOnce:
        deploy:
          steps:
          - task: DownloadPipelineArtifact@2
            inputs:
              artifactName: 'manifests'
              downloadPath: '$(System.ArtifactsDirectory)/manifests'

          - task: KubernetesManifest@0
            displayName: Create secret to pull image
            inputs:
              action: createSecret
              secretName: $(k8sImagePullSecret)
              dockerRegistryEndpoint: $(acrProdServiceConnection)
              kubernetesServiceConnection: $(clusterName)

          - task: KubernetesManifest@0
            displayName: Deploy to AKS
            inputs:
              action: deploy
              namespace: $(namespace)
              manifests: |
                $(System.ArtifactsDirectory)/manifests/deploy.yaml
                $(System.ArtifactsDirectory)/manifests/svc.yaml
                $(System.ArtifactsDirectory)/manifests/pvc.yaml
              imagePullSecrets: |
                $(k8sImagePullSecret)
              containers: |
                $(prodImage):$(tag)
              kubernetesServiceConnection: $(clusterName)