Design 47: DevSecOps (CI/CD)

Summary

This design implements DevSecOps using Azure DevOps/GitHub Actions.

Topology: Self-Hosted Agents run in a Spoke VNet. This allows the pipeline to deploy code to private resources (like Private AKS) via the Hub.

1. Key Design Decisions (ADR)

ADR-01: Agents

• Decision: Self-Hosted (VMSS).
• Rationale: Microsoft-hosted agents cannot reach your Private VNet. You need agents inside the network.

ADR-02: Identity

• Decision: Workload Identity Federation.
• Rationale: No secrets (Client Secrets) stored in GitHub. Azure trusts the GitHub OIDC token.

2. High-Level Design (HLD)

+--------------+           +--------------------------+           +--------------+
|  Developer   |           |        HUB VNet          |           |  SPOKE VNet  |
|  (Git Push)  |           |      (Firewall)          |           |  (Agents)    |
+------+-------+           +------------+-------------+           +------+-------+
       |                                |                                |
       v                                | (Peering)                      |
+------+-------+                        v                                v
|  GitHub      |           +------------+-------------+           +------+-------+
|  Actions     |---------->| Azure Firewall           |<--------->|  Agent Pool  |
|  (Orch)      |           | (Allow Package Dnld)     |           |  (VMSS)      |
+--------------+           +--------------------------+           +------+-------+
                                                                         |
                                                                         v
                                                                  +--------------+
                                                                  |  Target      |
                                                                  |  (AKS/SQL)   |
                                                                  +--------------+

3. Low-Level Design (LLD)

                               PRIMARY REGION (East US)
+-----------------------------------------------------------------------+
| HUB VNet: vnet-hub (10.0.0.0/16)                                      |
|   +-----------------------+                                           |
|   | Azure Firewall        |                                           |
|   +-----------|-----------+                                           |
|               |                                                       |
|               v (Peering)                                             |
+---------------|-------------------------------------------------------+
                |
+---------------|-------------------------------------------------------+
| SPOKE VNet: vnet-devops-spoke (10.1.0.0/16)                           |
|   +-----------------------+                                           |
|   | Subnet: Agents        |                                           |
|   | [VM Scale Set]        |                                           |
|   | (Docker Installed)    |                                           |
|   | -> Connects to GitHub |                                           |
|   +-----------------------+                                           |
+-----------------------------------------------------------------------+

                               SECONDARY REGION (West US)
+-----------------------------------------------------------------------+
| DR SPOKE VNet                                                         |
|   +-----------------------+                                           |
|   | Agent Pool (DR)       |                                           |
|   | (Standby)             |                                           |
|   +-----------------------+                                           |
+-----------------------------------------------------------------------+

4. Component Rationale

• VMSS Agents: Auto-scale based on queue length. If 10 jobs are waiting, spin up 10 VMs.

5. Strategy: High Availability (HA)

• Pool: Multiple agents in the pool.

6. Strategy: Disaster Recovery (DR)

• Implementation: Multi-Region Pools.
• Process:

* Create a pool East-Agents and West-Agents.

* In pipeline YAML: runs-on: [self-hosted, east].

* If East fails, update YAML to west.

7. Strategy: Backup

• Code: Git is the backup.

8. Strategy: Security

• Scan: Pipeline runs trivy (Container Scan) and sonar (Code Scan) before deploying.
• Network: Agents have NO Public IP. They talk to GitHub via NAT Gateway or Firewall.

9. Well-Architected Framework Analysis

• Reliability: High.
• Security: High.
• Cost Optimization: Medium. VM costs.
• Operational Excellence: Excellent. Everything as Code.
• Performance Efficiency: High.

10. Detailed Traffic Flow

1. Push: Dev pushes code.

2. Trigger: GitHub Action starts.

3. Queue: Job queued for "Self-Hosted".

4. Pickup: Agent in Spoke picks up job.

5. Build: Agent builds Docker image.

6. Deploy: Agent runs kubectl apply. Since Agent is in VNet, it can reach Private AKS.

11. Runbook: Deployment Guide (Azure Portal)

11. Runbook: Deployment Guide (Azure Portal)

Phase 1: Create Spoke VNet

1. Search: "Virtual networks" -> + Create.

2. Resource Group: rg-devops-spoke.

3. Name: vnet-devops-spoke.

4. Region: East US.

5. Create.

6. Peer to vnet-hub.

Phase 2: Create VM Scale Set (Agents)

1. Search: "Virtual machine scale sets" -> + Create.

2. Resource Group: rg-devops-spoke.

3. Name: vmss-agents.

4. Region: East US.

5. Orchestration mode: Uniform.

6. Image: Ubuntu 20.04 LTS.

7. Size: Standard_D2s_v3.

8. Networking:

* Virtual network: vnet-devops-spoke.

* Public IP address: None (Private Agents).

* *Note: Ensure you have a NAT Gateway or Firewall for outbound internet access to download packages.*

9. Create.

Phase 3: Configure Agent (Custom Data)

1. You need to install the GitHub Runner on boot.

2. Go to GitHub Repo -> Settings -> Actions -> Runners -> New self-hosted runner.

3. Copy the Download and Config commands.

4. Create a cloud-init.txt file:

```bash

#!/bin/bash

# Install Docker

apt-get update

apt-get install -y docker.io

# Install Runner

mkdir actions-runner && cd actions-runner

curl -o actions-runner-linux-x64-2.300.2.tar.gz -L https://github.com/actions/runner/releases/download/v2.300.2/actions-runner-linux-x64-2.300.2.tar.gz

tar xzf ./actions-runner-linux-x64-2.300.2.tar.gz

# Configure (Replace TOKEN)

./config.sh --url https://github.com/your-org/your-repo --token AABBCC... --unattended

# Install Service

./svc.sh install

./svc.sh start

```

5. In Azure Portal -> VMSS -> Settings -> Configuration -> Custom Data.

6. Paste the Base64 encoded content of cloud-init.txt.

7. Save and Update Instances.

Phase 4: Verify Runner

1. Go to GitHub Repo -> Settings -> Actions -> Runners.

2. You should see vmss-agents listed as Idle.

3. Test: Create a workflow .github/workflows/test.yml:

```yaml

runs-on: self-hosted

steps:

- run: echo "Hello from Azure VNet!"

```

4. Commit and watch it run.