Skip to content

Commit a69d33f

Browse files
george-ngugigeorge-ngugi
committed
Certificate update from github action
Add test files Enhanced certificate script Correct template to correctly name certificate; cleanup Finalize the github action Use named parameters Implement new cert logic that skips KV step Incorporate certificate changes in github action use named arguments for deploy-config script Validate JSON certificate details Test my action; Cleanup Correct per shell checks Correct per shell checks Manually run workflow Remove validate bits Run correct action Run correct action Run correct action Correct typo Trigger push Trigger push Update tag Update tag Use new tag Make cert script executable Make deploy-certificate.sh executable Enclose JSON array argument in quotes Remove buggy json check Download ARM template from public storage Echo json to view if valid Echo json to view if valid Echo json to view if valid JSON array through action to test View nginx-cert-details content View nginx-cert-details content revert script Parse certificate arg directly test toJSON test toJSON test toJSON test toJSON test toJSON in action Push certs A bug free run.. Remove jq parse bit Restore prev workflow Intro new entry script for smart deployment Shell check fixes Make deploy.sh executable add path for external scripts triggers for workflow correct call Add check confg and cert scripts since I can't run scripts inline Rename file Make scripts executable Rename files as per ops Correct conditions Do checks on action cleanup;pass correct arg change arm template URI correct URI clean workflow rename action name and other variables Add new lines as flagged on github Add new lines as flagged on github remove .gitignore Remove test workflow
1 parent d9347e2 commit a69d33f

File tree

5 files changed

+348
-10
lines changed

5 files changed

+348
-10
lines changed

‎action.yml

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
name: 'NGINX configuration sync'
2-
description: 'The action synchronizes NGINX configuration from a Git repository to an NGINX for Azure deployment.'
1+
name: 'NGINX For Azure Deployment Sync'
2+
description: 'The action synchronizes NGINX configuration from a Git repository and/or certificates already on Azure keyvault to an NGINX for Azure deployment'
33
inputs:
44
subscription-id:
55
description: 'The Azure subscription ID of the NGINX for Azure deployment.'
@@ -10,9 +10,12 @@ inputs:
1010
nginx-deployment-name:
1111
description: 'The name of the NGINX for Azure deployment.'
1212
required: true
13+
nginx-deployment-location:
14+
description: 'The location where the NGINX deployment is located. Example westcentralus'
15+
required: false
1316
nginx-config-directory-path:
1417
description: 'The NGINX configuration directory path relative to the root of the Git repository, example: "config/".'
15-
required: true
18+
required: false
1619
nginx-root-config-file:
1720
description: >
1821
'The root NGINX configuration file path relative to the NGINX configuration directory in the Git repository, example: "nginx.conf".'
@@ -25,9 +28,17 @@ inputs:
2528
can be used to overwrite the file paths when the action synchronizes the files to the NGINX for Azure deployment.'
2629
required: false
2730
default: ''
31+
nginx-certificate-details:
32+
description: 'An array of JSON objects each with keys nginx_cert_name, keyvault_secret, certificate_virtual_path and key_virtual_path. Example: [{"certificateName": "server1", "keyvaultSecret": "https://...", "certificateVirtualPath": "/etc/ssl/certs/server1.crt", "keyVirtualPath": "/etc/ssl/certs/server1.key" }, {"name": "server2", "keyvaultSecret": "https://...", "certificateVirtualPath": "/etc/ssl/certs/server2.crt", "keyVirtualPath": "/etc/ssl/certs/server2.key" }] '
33+
required: false
2834
runs:
2935
using: "composite"
3036
steps:
3137
- name: 'Synchronize NGINX configuration from the Git repository to an NGINX for Azure deployment'
32-
run: ${{github.action_path}}/src/deploy-config.sh ${{ inputs.subscription-id }} ${{ inputs.resource-group-name }} ${{ inputs.nginx-deployment-name }} ${{ inputs.nginx-config-directory-path }} ${{ inputs.nginx-root-config-file }} ${{ inputs.transformed-nginx-config-directory-path }}
38+
run: ${{github.action_path}}/src/deploy-config.sh --subscription_id=${{ inputs.subscription-id }} --resource_group_name=${{ inputs.resource-group-name }} --nginx_deployment_name=${{ inputs.nginx-deployment-name }} --config_dir_path=${{ inputs.nginx-config-directory-path }} --root_config_file=${{ inputs.nginx-root-config-file }} --transformed_config_dir_path=${{ inputs.transformed-nginx-config-directory-path }}
39+
if: ${{ inputs.nginx-config-directory-path != '' }}
40+
shell: bash
41+
- name: 'Synchronize NGINX certificate(s) from the Git repository to an NGINX for Azure deployment'
42+
run: ${{github.action_path}}/src/deploy-certificate.sh --subscription_id=${{ inputs.subscription-id }} --resource_group_name=${{ inputs.resource-group-name }} --nginx_deployment_name=${{ inputs.nginx-deployment-name }} --nginx_resource_location=${{ inputs.nginx-deployment-location }} --certificates=${{ toJSON(inputs.nginx-certificate-details) }}
43+
if: ${{ inputs.nginx-deployment-location != '' && inputs.nginx-certificate-details != '' }}
3344
shell: bash

‎src/deploy-certificate.sh

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
#!/bin/bash
2+
set -euo pipefail
3+
IFS=$'\n\t'
4+
5+
for i in "$@"
6+
do
7+
case $i in
8+
--subscription_id=*)
9+
subscription_id="${i#*=}"
10+
shift
11+
;;
12+
--resource_group_name=*)
13+
resource_group_name="${i#*=}"
14+
shift
15+
;;
16+
--nginx_deployment_name=*)
17+
nginx_deployment_name="${i#*=}"
18+
shift
19+
;;
20+
--nginx_resource_location=*)
21+
nginx_resource_location="${i#*=}"
22+
shift
23+
;;
24+
--certificates=*)
25+
certificates="${i#*=}"
26+
shift
27+
;;
28+
*)
29+
echo "Not matched option '${i#*=}' passed in."
30+
exit 1
31+
;;
32+
esac
33+
done
34+
35+
if [[ ! -v subscription_id ]];
36+
then
37+
echo "Please set 'subscription-id' ..."
38+
exit 1
39+
fi
40+
if [[ ! -v resource_group_name ]];
41+
then
42+
echo "Please set 'resource-group-name' ..."
43+
exit 1
44+
fi
45+
if [[ ! -v nginx_deployment_name ]];
46+
then
47+
echo "Please set 'nginx-deployment-name' ..."
48+
exit 1
49+
fi
50+
if [[ ! -v nginx_resource_location ]];
51+
then
52+
echo "Please set 'nginx-resource-location' ..."
53+
exit 1
54+
fi
55+
if [[ ! -v certificates ]];
56+
then
57+
echo "Please set 'nginx-certificate-details' ..."
58+
exit 1
59+
fi
60+
61+
arm_template_file="nginx-for-azure-certificate-template.json"
62+
63+
#get the ARM template file
64+
wget -O "$arm_template_file" https://nginxgithubactions.blob.core.windows.net/armtemplates/nginx-for-azure-certificate-template.json
65+
echo "Downloaded the ARM template for synchronizing NGINX certificate."
66+
67+
cat "$arm_template_file"
68+
echo ""
69+
70+
az account set -s "$subscription_id" --verbose
71+
72+
count=$(echo $certificates | jq '. | length')
73+
for (( i=0; i<count; i++ ));
74+
do
75+
nginx_cert_name=$(echo $certificates | jq -r '.['"$i"'].certificateName')
76+
nginx_cert_file=$(echo $certificates | jq -r '.['"$i"'].certificateVirtualPath')
77+
nginx_key_file=$(echo $certificates | jq -r '.['"$i"'].keyVirtualPath')
78+
keyvault_secret=$(echo $certificates | jq -r '.['"$i"'].keyvaultSecret')
79+
80+
do_nginx_arm_deployment=1
81+
err_msg=" "
82+
if [ -z "$nginx_cert_name" ] || [ "$nginx_cert_name" = "null" ]
83+
then
84+
err_msg+="nginx_cert_name is empty;"
85+
do_nginx_arm_deployment=0
86+
fi
87+
if [ -z "$nginx_cert_file" ] || [ "$nginx_cert_file" = "null" ]
88+
then
89+
err_msg+="nginx_cert_file is empty;"
90+
do_nginx_arm_deployment=0
91+
fi
92+
if [ -z "$nginx_key_file" ] || [ "$nginx_key_file" = "null" ]
93+
then
94+
err_msg+="nginx_key_file is empty;"
95+
do_nginx_arm_deployment=0
96+
fi
97+
if [ -z "$keyvault_secret" ] || [ "$keyvault_secret" = "null" ]
98+
then
99+
err_msg+="keyvault_secret is empty;"
100+
do_nginx_arm_deployment=0
101+
fi
102+
103+
uuid="$(cat /proc/sys/kernel/random/uuid)"
104+
template_file="template-$uuid.json"
105+
template_deployment_name="${nginx_deployment_name:0:20}-$uuid"
106+
107+
cp "$arm_template_file" "$template_file"
108+
109+
echo "Synchronizing NGINX certificate"
110+
echo "Subscription ID: $subscription_id"
111+
echo "Resource group name: $resource_group_name"
112+
echo "NGINX for Azure deployment name: $nginx_deployment_name"
113+
echo "NGINX for Azure Location: $nginx_resource_location"
114+
echo "ARM template deployment name: $template_deployment_name"
115+
echo ""
116+
echo "NGINX for Azure cert name: $nginx_cert_name"
117+
echo "NGINX for Azure cert file location: $nginx_cert_file"
118+
echo "NGINX for Azure key file location: $nginx_key_file"
119+
echo ""
120+
121+
if [ $do_nginx_arm_deployment -eq 1 ]
122+
then
123+
set +e
124+
az deployment group create --name "$template_deployment_name" --resource-group "$resource_group_name" --template-file "$template_file" --parameters name="$nginx_cert_name" location="$nginx_resource_location" nginxDeploymentName="$nginx_deployment_name" certificateVirtualPath="$nginx_cert_file" keyVirtualPath="$nginx_key_file" keyVaultSecretID="$keyvault_secret" --verbose
125+
set -e
126+
else
127+
echo "Skipping JSON object $i cert deployment with error:$err_msg"
128+
echo ""
129+
fi
130+
done

‎src/deploy-config.sh

Lines changed: 60 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,66 @@
22
set -euo pipefail
33
IFS=$'\n\t'
44

5-
subscription_id=$1
6-
resource_group_name=$2
7-
nginx_deployment_name=$3
8-
config_dir_path=$4
9-
root_config_file=$5
10-
transformed_config_dir_path=${6:-''}
5+
transformed_config_dir_path=''
6+
for i in "$@"
7+
do
8+
case $i in
9+
--subscription_id=*)
10+
subscription_id="${i#*=}"
11+
shift
12+
;;
13+
--resource_group_name=*)
14+
resource_group_name="${i#*=}"
15+
shift
16+
;;
17+
--nginx_deployment_name=*)
18+
nginx_deployment_name="${i#*=}"
19+
shift
20+
;;
21+
--config_dir_path=*)
22+
config_dir_path="${i#*=}"
23+
shift
24+
;;
25+
--root_config_file=*)
26+
root_config_file="${i#*=}"
27+
shift
28+
;;
29+
--transformed_config_dir_path=*)
30+
transformed_config_dir_path="${i#*=}"
31+
shift
32+
;;
33+
*)
34+
echo "Not matched option '${i#*=}' passed in."
35+
exit 1
36+
;;
37+
esac
38+
done
39+
40+
if [[ ! -v subscription_id ]];
41+
then
42+
echo "Please set 'subscription-id' ..."
43+
exit 1
44+
fi
45+
if [[ ! -v resource_group_name ]];
46+
then
47+
echo "Please set 'resource-group-name' ..."
48+
exit 1
49+
fi
50+
if [[ ! -v nginx_deployment_name ]];
51+
then
52+
echo "Please set 'nginx-deployment-name' ..."
53+
exit 1
54+
fi
55+
if [[ ! -v config_dir_path ]];
56+
then
57+
echo "Please set 'nginx-config-directory-path' ..."
58+
exit 1
59+
fi
60+
if [[ ! -v root_config_file ]];
61+
then
62+
echo "Please set 'nginx-root-config-file' ..."
63+
exit 1
64+
fi
1165

1266
# Validation and preprocessing
1367

‎src/deploy.sh

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
#!/bin/bash
2+
set -euo pipefail
3+
IFS=$'\n\t'
4+
5+
for i in "$@"
6+
do
7+
case $i in
8+
--subscription_id=*)
9+
subscription_id="${i#*=}"
10+
shift
11+
;;
12+
--resource_group_name=*)
13+
resource_group_name="${i#*=}"
14+
shift
15+
;;
16+
--nginx_deployment_name=*)
17+
nginx_deployment_name="${i#*=}"
18+
shift
19+
;;
20+
--nginx_resource_location=*)
21+
nginx_resource_location="${i#*=}"
22+
shift
23+
;;
24+
--config_dir_path=*)
25+
config_dir_path="${i#*=}"
26+
shift
27+
;;
28+
--root_config_file=*)
29+
root_config_file="${i#*=}"
30+
shift
31+
;;
32+
--transformed_config_dir_path=*)
33+
transformed_config_dir_path="${i#*=}"
34+
shift
35+
;;
36+
--certificates=*)
37+
certificates="${i#*=}"
38+
shift
39+
;;
40+
*)
41+
echo "Not matched option '${i#*=}' passed in."
42+
exit 1
43+
;;
44+
esac
45+
done
46+
47+
if [[ ! -v subscription_id ]];
48+
then
49+
echo "Please set 'subscription-id' ..."
50+
exit 1
51+
fi
52+
if [[ ! -v resource_group_name ]];
53+
then
54+
echo "Please set 'resource-group-name' ..."
55+
exit 1
56+
fi
57+
if [[ ! -v nginx_deployment_name ]];
58+
then
59+
echo "Please set 'nginx-deployment-name' ..."
60+
exit 1
61+
fi
62+
63+
if [[ -v nginx_resource_location ]] && [[ -v certificates ]];
64+
then
65+
./deploy-certificate.sh \
66+
--subscription_id="$subscription_id" \
67+
--resource_group_name="$resource_group_name" \
68+
--nginx_deployment_name="$nginx_deployment_name" \
69+
--nginx_resource_location="$nginx_resource_location" \
70+
--certificates="$certificates"
71+
fi
72+
73+
if [[ ! -v transformed_config_dir_path ]];
74+
then
75+
transformed_config_dir_path=''
76+
fi
77+
78+
if [[ -v config_dir_path ]] && [[ -v root_config_file ]];
79+
then
80+
./deploy-config.sh \
81+
--subscription_id="$subscription_id" \
82+
--resource_group_name="$resource_group_name" \
83+
--nginx_deployment_name="$nginx_deployment_name" \
84+
--config_dir_path="$config_dir_path" \
85+
--root_config_file="$root_config_file" \
86+
--transformed_config_dir_path="$transformed_config_dir_path"
87+
fi
88+

‎src/nginx-for-azure-certificate-template.json

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
{
2+
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
3+
"contentVersion": "1.0.0.0",
4+
"parameters": {
5+
"name": {
6+
"type": "string",
7+
"metadata": {
8+
"description": "The name of the cert resource"
9+
}
10+
},
11+
"location": {
12+
"type": "string",
13+
"metadata": {
14+
"description": "The location for all resources"
15+
}
16+
},
17+
"nginxDeploymentName": {
18+
"type": "string",
19+
"metadata": {
20+
"description": "The name of your NGINX deployment resource"
21+
}
22+
},
23+
"certificateVirtualPath": {
24+
"type": "string",
25+
"metadata": {
26+
"description": "The file path of the certificate file"
27+
}
28+
},
29+
"keyVirtualPath": {
30+
"type": "string",
31+
"metadata": {
32+
"description": "The file path of the certificate key file"
33+
}
34+
},
35+
"keyVaultSecretID": {
36+
"type": "string",
37+
"metadata": {
38+
"description": "The secret ID of the key vault holding the certificate"
39+
}
40+
}
41+
},
42+
"resources": [
43+
{
44+
"type": "NGINX.NGINXPLUS/nginxDeployments/certificates",
45+
"apiVersion": "2021-05-01-preview",
46+
"name": "[concat(parameters('nginxDeploymentName'), concat('/', parameters('name')))]",
47+
"location": "[parameters('location')]",
48+
"properties": {
49+
"certificateVirtualPath": "[parameters('certificateVirtualPath')]",
50+
"keyVirtualPath": "[parameters('keyVirtualPath')]",
51+
"keyVaultSecretId": "[parameters('keyVaultSecretID')]"
52+
}
53+
}
54+
]
55+
}

0 commit comments

Comments
 (0)