aks-baseline-automation/.github/workflows/IaC-bicep-AKS.yml

name: 'Deploy CARML based AKS Cluster'

on:
  workflow_dispatch:
    inputs:
      ENVIRONMENT:
        description: 'A GitHub Environment to pull action secrets from'
        required: true
        type: environment
      REGION:
        description: 'The Azure region to deploy to'
        required: true
        default: eastus

env:
  event_sha: +refs/pull/${{ github.event.issue.number }}/merge

jobs:
  prereqs:
    runs-on: ubuntu-latest
    environment: ${{ inputs.ENVIRONMENT }}
    name: Prerequisite Checks
    steps:
      - name: "Checkout"
        uses: actions/checkout@v2
        with:
          fetch-depth: 0

      - name: "Azure Login"
        uses: azure/login@v1
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      #Helps with errors that can occur during deployment: OIDCIssuerFeatureFlagNotEnabled: Enabling OIDC issuer is not allowed since feature 'Microsoft.ContainerService/EnableOIDCIssuerPreview' is not enabled
      #                                                    AzureDefenderFeatureFlagNotEnabled: AzureDefender installation is not allowed since feature 'Microsoft.ContainerService/AKS-AzureDefender' is not enabled.
      - name: "Check Preview Features"
        shell: pwsh
        run: |
          write-output "Verifying required Resource Providers Features are registered"
          $aksfeatures = az feature list --query "[?contains(name, 'Microsoft.ContainerService')]" | ConvertFrom-Json

          $featureName='AKS-ExtensionManager'
          write-output "-- $featureName"
          $feature = $aksfeatures |  Where-Object {$_.name -like "*$featureName"}
          $feature.properties.state
          if ($feature.properties.state -ne 'Registered') {
            Write-Output $feature
            Write-Error "$featureName NOT registered"
          }

          $featureName='EnableOIDCIssuerPreview'
          write-output "-- $featureName"
          $feature = $aksfeatures |  Where-Object {$_.name -like "*$featureName"}
          $feature.properties.state
          if ($feature.properties.state -ne 'Registered') {
            Write-Output $feature
            Write-Error "$featureName NOT registered"
          }

          $featureName='AKS-AzureDefender'
          write-output "-- $featureName"
          $feature = $aksfeatures |  Where-Object {$_.name -like "*$featureName"}
          $feature.properties.state
          if ($feature.properties.state -ne 'Registered') {
            Write-Output $feature
            Write-Error "$featureName NOT registered"
          }

  deployment:
    runs-on: ubuntu-latest
    environment: ${{ inputs.ENVIRONMENT }}
    name: Deployment
    needs: [prereqs]
    steps:
      - name: "Checkout"
        uses: actions/checkout@v2
        with:
          fetch-depth: 0

      - name: "Azure Login"
        uses: azure/login@v1
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: "Deploy Hub"
        id: hub
        uses: azure/arm-deploy@v1
        with:
          subscriptionId: ${{ secrets.SUBSCRIPTION_ID }}
          region: ${{ inputs.REGION }}
          scope: subscription
          template: ./IaC/bicep/rg-hub/hub-default.bicep
          parameters: ./IaC/bicep/rg-hub/hub-default.parameters.json
          failOnStdErr: false

      - name: "Deploy Spoke"
        id: spoke
        uses: azure/arm-deploy@v1
        with:
          subscriptionId: ${{ secrets.SUBSCRIPTION_ID }}
          region: ${{ inputs.REGION }}
          scope: subscription
          template: ./IaC/bicep/rg-spoke/spoke.bicep
          parameters: ./IaC/bicep/rg-spoke/spoke.parameters.json hubVnetResourceId=${{ steps.hub.outputs.hubVnetId }} hubLaWorkspaceResourceId=${{ steps.hub.outputs.hubLaWorkspaceResourceId }} hubFwResourceId=${{ steps.hub.outputs.hubFwResourceId }}
          failOnStdErr: false

      - name: "Deploy Cluster"
        id: cluster
        uses: azure/arm-deploy@v1
        with:
          subscriptionId: ${{ secrets.SUBSCRIPTION_ID }}
          region: ${{ inputs.REGION }}
          scope: subscription
          template: ./IaC/bicep/rg-spoke/cluster.bicep
          parameters: ./IaC/bicep/rg-spoke/cluster.parameters.json targetVnetResourceId=${{ steps.spoke.outputs.clusterVnetResourceId }}
          #clusterAdminAadGroupObjectId=${{ github.event.inputs.clusterAdminAadGroupObjectId }} a0008NamespaceReaderAadGroupObjectId=${{ github.event.inputs.a0008NamespaceReaderAadGroupObjectId }}
          failOnStdErr: false

      - name: "Deploy Registry"
        id: registry
        uses: azure/arm-deploy@v1
        with:
          subscriptionId: ${{ secrets.SUBSCRIPTION_ID }}
          region: ${{ inputs.REGION }}
          scope: subscription
          template: ./IaC/bicep/rg-spoke/acr.bicep
          parameters: ./IaC/bicep/rg-spoke/acr.parameters.json targetVnetResourceId=${{ steps.spoke.outputs.clusterVnetResourceId }}
          failOnStdErr: false