Skip to content

Commit 9313a85

Browse files
george-ngugigeorge-ngugi
authored
Merge pull request #19 from george-ngugi/george-ngugi/nginx-certs
Certificate deployment in github action
2 parents 45a4d04 + a69d33f commit 9313a85

File tree

5 files changed

+348
-10
lines changed

5 files changed

+348
-10
lines changed

‎action.yml

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
name: 'NGINX configuration sync'
2-
description: 'The action synchronizes NGINX configuration from a Git repository to an NGINX for Azure deployment.'
1+
name: 'NGINX For Azure Deployment Sync'
2+
description: 'The action synchronizes NGINX configuration from a Git repository and/or certificates already on Azure keyvault to an NGINX for Azure deployment'
33
inputs:
44
subscription-id:
55
description: 'The Azure subscription ID of the NGINX for Azure deployment.'
@@ -10,9 +10,12 @@ inputs:
1010
nginx-deployment-name:
1111
description: 'The name of the NGINX for Azure deployment.'
1212
required: true
13+
nginx-deployment-location:
14+
description: 'The location where the NGINX deployment is located. Example westcentralus'
15+
required: false
1316
nginx-config-directory-path:
1417
description: 'The NGINX configuration directory path relative to the root of the Git repository, example: "config/".'
15-
required: true
18+
required: false
1619
nginx-root-config-file:
1720
description: >
1821
'The root NGINX configuration file path relative to the NGINX configuration directory in the Git repository, example: "nginx.conf".'
@@ -25,9 +28,17 @@ inputs:
2528
can be used to overwrite the file paths when the action synchronizes the files to the NGINX for Azure deployment.'
2629
required: false
2730
default: ''
31+
nginx-certificate-details:
32+
description: 'An array of JSON objects each with keys nginx_cert_name, keyvault_secret, certificate_virtual_path and key_virtual_path. Example: [{"certificateName": "server1", "keyvaultSecret": "https://...", "certificateVirtualPath": "/etc/ssl/certs/server1.crt", "keyVirtualPath": "/etc/ssl/certs/server1.key" }, {"name": "server2", "keyvaultSecret": "https://...", "certificateVirtualPath": "/etc/ssl/certs/server2.crt", "keyVirtualPath": "/etc/ssl/certs/server2.key" }] '
33+
required: false
2834
runs:
2935
using: "composite"
3036
steps:
3137
- name: 'Synchronize NGINX configuration from the Git repository to an NGINX for Azure deployment'
32-
run: ${{github.action_path}}/src/deploy-config.sh ${{ inputs.subscription-id }} ${{ inputs.resource-group-name }} ${{ inputs.nginx-deployment-name }} ${{ inputs.nginx-config-directory-path }} ${{ inputs.nginx-root-config-file }} ${{ inputs.transformed-nginx-config-directory-path }}
38+
run: ${{github.action_path}}/src/deploy-config.sh --subscription_id=${{ inputs.subscription-id }} --resource_group_name=${{ inputs.resource-group-name }} --nginx_deployment_name=${{ inputs.nginx-deployment-name }} --config_dir_path=${{ inputs.nginx-config-directory-path }} --root_config_file=${{ inputs.nginx-root-config-file }} --transformed_config_dir_path=${{ inputs.transformed-nginx-config-directory-path }}
39+
if: ${{ inputs.nginx-config-directory-path != '' }}
40+
shell: bash
41+
- name: 'Synchronize NGINX certificate(s) from the Git repository to an NGINX for Azure deployment'
42+
run: ${{github.action_path}}/src/deploy-certificate.sh --subscription_id=${{ inputs.subscription-id }} --resource_group_name=${{ inputs.resource-group-name }} --nginx_deployment_name=${{ inputs.nginx-deployment-name }} --nginx_resource_location=${{ inputs.nginx-deployment-location }} --certificates=${{ toJSON(inputs.nginx-certificate-details) }}
43+
if: ${{ inputs.nginx-deployment-location != '' && inputs.nginx-certificate-details != '' }}
3344
shell: bash

‎src/deploy-certificate.sh

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
#!/bin/bash
2+
set -euo pipefail
3+
IFS=$'\n\t'
4+
5+
for i in "$@"
6+
do
7+
case $i in
8+
--subscription_id=*)
9+
subscription_id="${i#*=}"
10+
shift
11+
;;
12+
--resource_group_name=*)
13+
resource_group_name="${i#*=}"
14+
shift
15+
;;
16+
--nginx_deployment_name=*)
17+
nginx_deployment_name="${i#*=}"
18+
shift
19+
;;
20+
--nginx_resource_location=*)
21+
nginx_resource_location="${i#*=}"
22+
shift
23+
;;
24+
--certificates=*)
25+
certificates="${i#*=}"
26+
shift
27+
;;
28+
*)
29+
echo "Not matched option '${i#*=}' passed in."
30+
exit 1
31+
;;
32+
esac
33+
done
34+
35+
if [[ ! -v subscription_id ]];
36+
then
37+
echo "Please set 'subscription-id' ..."
38+
exit 1
39+
fi
40+
if [[ ! -v resource_group_name ]];
41+
then
42+
echo "Please set 'resource-group-name' ..."
43+
exit 1
44+
fi
45+
if [[ ! -v nginx_deployment_name ]];
46+
then
47+
echo "Please set 'nginx-deployment-name' ..."
48+
exit 1
49+
fi
50+
if [[ ! -v nginx_resource_location ]];
51+
then
52+
echo "Please set 'nginx-resource-location' ..."
53+
exit 1
54+
fi
55+
if [[ ! -v certificates ]];
56+
then
57+
echo "Please set 'nginx-certificate-details' ..."
58+
exit 1
59+
fi
60+
61+
arm_template_file="nginx-for-azure-certificate-template.json"
62+
63+
#get the ARM template file
64+
wget -O "$arm_template_file" https://nginxgithubactions.blob.core.windows.net/armtemplates/nginx-for-azure-certificate-template.json
65+
echo "Downloaded the ARM template for synchronizing NGINX certificate."
66+
67+
cat "$arm_template_file"
68+
echo ""
69+
70+
az account set -s "$subscription_id" --verbose
71+
72+
count=$(echo $certificates | jq '. | length')
73+
for (( i=0; i<count; i++ ));
74+
do
75+
nginx_cert_name=$(echo $certificates | jq -r '.['"$i"'].certificateName')
76+
nginx_cert_file=$(echo $certificates | jq -r '.['"$i"'].certificateVirtualPath')
77+
nginx_key_file=$(echo $certificates | jq -r '.['"$i"'].keyVirtualPath')
78+
keyvault_secret=$(echo $certificates | jq -r '.['"$i"'].keyvaultSecret')
79+
80+
do_nginx_arm_deployment=1
81+
err_msg=" "
82+
if [ -z "$nginx_cert_name" ] || [ "$nginx_cert_name" = "null" ]
83+
then
84+
err_msg+="nginx_cert_name is empty;"
85+
do_nginx_arm_deployment=0
86+
fi
87+
if [ -z "$nginx_cert_file" ] || [ "$nginx_cert_file" = "null" ]
88+
then
89+
err_msg+="nginx_cert_file is empty;"
90+
do_nginx_arm_deployment=0
91+
fi
92+
if [ -z "$nginx_key_file" ] || [ "$nginx_key_file" = "null" ]
93+
then
94+
err_msg+="nginx_key_file is empty;"
95+
do_nginx_arm_deployment=0
96+
fi
97+
if [ -z "$keyvault_secret" ] || [ "$keyvault_secret" = "null" ]
98+
then
99+
err_msg+="keyvault_secret is empty;"
100+
do_nginx_arm_deployment=0
101+
fi
102+
103+
uuid="$(cat /proc/sys/kernel/random/uuid)"
104+
template_file="template-$uuid.json"
105+
template_deployment_name="${nginx_deployment_name:0:20}-$uuid"
106+
107+
cp "$arm_template_file" "$template_file"
108+
109+
echo "Synchronizing NGINX certificate"
110+
echo "Subscription ID: $subscription_id"
111+
echo "Resource group name: $resource_group_name"
112+
echo "NGINX for Azure deployment name: $nginx_deployment_name"
113+
echo "NGINX for Azure Location: $nginx_resource_location"
114+
echo "ARM template deployment name: $template_deployment_name"
115+
echo ""
116+
echo "NGINX for Azure cert name: $nginx_cert_name"
117+
echo "NGINX for Azure cert file location: $nginx_cert_file"
118+
echo "NGINX for Azure key file location: $nginx_key_file"
119+
echo ""
120+
121+
if [ $do_nginx_arm_deployment -eq 1 ]
122+
then
123+
set +e
124+
az deployment group create --name "$template_deployment_name" --resource-group "$resource_group_name" --template-file "$template_file" --parameters name="$nginx_cert_name" location="$nginx_resource_location" nginxDeploymentName="$nginx_deployment_name" certificateVirtualPath="$nginx_cert_file" keyVirtualPath="$nginx_key_file" keyVaultSecretID="$keyvault_secret" --verbose
125+
set -e
126+
else
127+
echo "Skipping JSON object $i cert deployment with error:$err_msg"
128+
echo ""
129+
fi
130+
done

‎src/deploy-config.sh

Lines changed: 60 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,66 @@
22
set -euo pipefail
33
IFS=$'\n\t'
44

5-
subscription_id=$1
6-
resource_group_name=$2
7-
nginx_deployment_name=$3
8-
config_dir_path=$4
9-
root_config_file=$5
10-
transformed_config_dir_path=${6:-''}
5+
transformed_config_dir_path=''
6+
for i in "$@"
7+
do
8+
case $i in
9+
--subscription_id=*)
10+
subscription_id="${i#*=}"
11+
shift
12+
;;
13+
--resource_group_name=*)
14+
resource_group_name="${i#*=}"
15+
shift
16+
;;
17+
--nginx_deployment_name=*)
18+
nginx_deployment_name="${i#*=}"
19+
shift
20+
;;
21+
--config_dir_path=*)
22+
config_dir_path="${i#*=}"
23+
shift
24+
;;
25+
--root_config_file=*)
26+
root_config_file="${i#*=}"
27+
shift
28+
;;
29+
--transformed_config_dir_path=*)
30+
transformed_config_dir_path="${i#*=}"
31+
shift
32+
;;
33+
*)
34+
echo "Not matched option '${i#*=}' passed in."
35+
exit 1
36+
;;
37+
esac
38+
done
39+
40+
if [[ ! -v subscription_id ]];
41+
then
42+
echo "Please set 'subscription-id' ..."
43+
exit 1
44+
fi
45+
if [[ ! -v resource_group_name ]];
46+
then
47+
echo "Please set 'resource-group-name' ..."
48+
exit 1
49+
fi
50+
if [[ ! -v nginx_deployment_name ]];
51+
then
52+
echo "Please set 'nginx-deployment-name' ..."
53+
exit 1
54+
fi
55+
if [[ ! -v config_dir_path ]];
56+
then
57+
echo "Please set 'nginx-config-directory-path' ..."
58+
exit 1
59+
fi
60+
if [[ ! -v root_config_file ]];
61+
then
62+
echo "Please set 'nginx-root-config-file' ..."
63+
exit 1
64+
fi
1165

1266
# Validation and preprocessing
1367

‎src/deploy.sh

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
#!/bin/bash
2+
set -euo pipefail
3+
IFS=$'\n\t'
4+
5+
for i in "$@"
6+
do
7+
case $i in
8+
--subscription_id=*)
9+
subscription_id="${i#*=}"
10+
shift
11+
;;
12+
--resource_group_name=*)
13+
resource_group_name="${i#*=}"
14+
shift
15+
;;
16+
--nginx_deployment_name=*)
17+
nginx_deployment_name="${i#*=}"
18+
shift
19+
;;
20+
--nginx_resource_location=*)
21+
nginx_resource_location="${i#*=}"
22+
shift
23+
;;
24+
--config_dir_path=*)
25+
config_dir_path="${i#*=}"
26+
shift
27+
;;
28+
--root_config_file=*)
29+
root_config_file="${i#*=}"
30+
shift
31+
;;
32+
--transformed_config_dir_path=*)
33+
transformed_config_dir_path="${i#*=}"
34+
shift
35+
;;
36+
--certificates=*)
37+
certificates="${i#*=}"
38+
shift
39+
;;
40+
*)
41+
echo "Not matched option '${i#*=}' passed in."
42+
exit 1
43+
;;
44+
esac
45+
done
46+
47+
if [[ ! -v subscription_id ]];
48+
then
49+
echo "Please set 'subscription-id' ..."
50+
exit 1
51+
fi
52+
if [[ ! -v resource_group_name ]];
53+
then
54+
echo "Please set 'resource-group-name' ..."
55+
exit 1
56+
fi
57+
if [[ ! -v nginx_deployment_name ]];
58+
then
59+
echo "Please set 'nginx-deployment-name' ..."
60+
exit 1
61+
fi
62+
63+
if [[ -v nginx_resource_location ]] && [[ -v certificates ]];
64+
then
65+
./deploy-certificate.sh \
66+
--subscription_id="$subscription_id" \
67+
--resource_group_name="$resource_group_name" \
68+
--nginx_deployment_name="$nginx_deployment_name" \
69+
--nginx_resource_location="$nginx_resource_location" \
70+
--certificates="$certificates"
71+
fi
72+
73+
if [[ ! -v transformed_config_dir_path ]];
74+
then
75+
transformed_config_dir_path=''
76+
fi
77+
78+
if [[ -v config_dir_path ]] && [[ -v root_config_file ]];
79+
then
80+
./deploy-config.sh \
81+
--subscription_id="$subscription_id" \
82+
--resource_group_name="$resource_group_name" \
83+
--nginx_deployment_name="$nginx_deployment_name" \
84+
--config_dir_path="$config_dir_path" \
85+
--root_config_file="$root_config_file" \
86+
--transformed_config_dir_path="$transformed_config_dir_path"
87+
fi
88+

‎src/nginx-for-azure-certificate-template.json

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
{
2+
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
3+
"contentVersion": "1.0.0.0",
4+
"parameters": {
5+
"name": {
6+
"type": "string",
7+
"metadata": {
8+
"description": "The name of the cert resource"
9+
}
10+
},
11+
"location": {
12+
"type": "string",
13+
"metadata": {
14+
"description": "The location for all resources"
15+
}
16+
},
17+
"nginxDeploymentName": {
18+
"type": "string",
19+
"metadata": {
20+
"description": "The name of your NGINX deployment resource"
21+
}
22+
},
23+
"certificateVirtualPath": {
24+
"type": "string",
25+
"metadata": {
26+
"description": "The file path of the certificate file"
27+
}
28+
},
29+
"keyVirtualPath": {
30+
"type": "string",
31+
"metadata": {
32+
"description": "The file path of the certificate key file"
33+
}
34+
},
35+
"keyVaultSecretID": {
36+
"type": "string",
37+
"metadata": {
38+
"description": "The secret ID of the key vault holding the certificate"
39+
}
40+
}
41+
},
42+
"resources": [
43+
{
44+
"type": "NGINX.NGINXPLUS/nginxDeployments/certificates",
45+
"apiVersion": "2021-05-01-preview",
46+
"name": "[concat(parameters('nginxDeploymentName'), concat('/', parameters('name')))]",
47+
"location": "[parameters('location')]",
48+
"properties": {
49+
"certificateVirtualPath": "[parameters('certificateVirtualPath')]",
50+
"keyVirtualPath": "[parameters('keyVirtualPath')]",
51+
"keyVaultSecretId": "[parameters('keyVaultSecretID')]"
52+
}
53+
}
54+
]
55+
}

0 commit comments

Comments
 (0)