Andrehe001

.github/workflows/msdevopssec.yml

@@ -0,0 +1,34 @@
+name: MSDO windows-latest
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  workflow_dispatch:
+
+jobs:
+  sample:
+
+    # MSDO runs on windows-latest and ubuntu-latest.
+    # macos-latest supporting coming soon
+    runs-on: windows-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - uses: actions/setup-dotnet@v1
+      with:
+        dotnet-version: |
+          5.0.x
+          6.0.x
+
+    # Run analyzers
+    - name: Run Microsoft Security DevOps Analysis
+      uses: microsoft/security-devops-action@preview
+      id: msdo
+
+    # Upload alerts to the Security tab
+    - name: Upload alerts to Security tab
+      uses: github/codeql-action/upload-sarif@v1
+      with:
+        sarif_file: ${{ steps.msdo.outputs.sarifFile }}

apps/dogs-cats/app.yaml

@@ -7,6 +7,7 @@ key2: Cats
 namespace: dogs-cats
 nodePort: 30080
 port: 8080
-targets: []
+targets:
+    - region:west
 template: vote-service
 title: Dogs Rule!

apps/imdb/app.yaml

@@ -5,5 +5,6 @@ image: ghcr.io/cse-labs/pib-imdb:latest
 namespace: imdb
 nodePort: 30080
 port: 8080
-targets: []
+targets:
+    - region:east
 template: pib-service

apps/myapp/.dockerignore

@@ -0,0 +1,72 @@
+dotfiles/placeholder
+
+*.suo
+*.user
+*.userosscache
+*.sln.docstates
+
+.vscode/
+
+# Build results
+[Dd]ebug/
+[Dd]ebugPublic/
+[Rr]elease/
+[Rr]eleases/
+x64/
+x86/
+bld/
+[Bb]in/
+[Oo]bj/
+[Ll]og/
+
+# Visual Studio cache/options directory
+.vs/
+
+# MSTest test Results
+[Tt]est[Rr]esult*/
+[Bb]uild[Ll]og.*
+
+# NUNIT
+*.VisualState.xml
+TestResult.xml
+
+# .NET Core
+project.lock.json
+project.fragment.lock.json
+artifacts/
+**/Properties/launchSettings.json
+
+*_i.c
+*_p.c
+*_i.h
+*.ilk
+*.meta
+*.obj
+*.pch
+*.pdb
+*.pgc
+*.pgd
+*.rsp
+*.sbr
+*.tlb
+*.tli
+*.tlh
+*.tmp
+*.tmp_proj
+*.log
+*.vspscc
+*.vssscc
+.builds
+*.pidb
+*.svclog
+*.scc
+
+# ReSharper is a .NET coding add-in
+_ReSharper*/
+*.[Rr]e[Ss]harper
+*.DotSettings.user
+
+# Visual Studio code coverage results
+*.coverage
+*.coveragexml
+

apps/myapp/.kic/check.yaml

@@ -0,0 +1,19 @@
+###
+# check commands
+###
+
+commands:
+- name: check
+  short: Check local apps
+  scriptCommands:
+    - name: myapp
+      short: Check MyApp
+      path: check/app
+
+    - name: webv
+      short: Check WebValidate
+      path: check/webv
+
+    - name: flux
+      short: Check Flux service
+      path: check/flux

apps/myapp/.kic/commands/check/app

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+http localhost:30080/version

apps/myapp/.kic/commands/check/flux

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+flux get kustomizations

apps/myapp/.kic/commands/check/webv

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+kubectl exec -it jumpbox -- http webv.myapp.svc.cluster.local:8080/version

apps/myapp/.kic/webv-config.yaml

@@ -0,0 +1,27 @@
+###
+# webv config
+###
+
+image: k3d-registry.localhost:5500/webv-myapp:local
+server:  http://localhost:30080
+logformat: TsvMin
+verbose: false
+verboseerrors: false
+timeout: 30
+region: ""
+zone: ""
+tag: ""
+urlprefix: ""
+
+integration:
+  files: integration.json
+  sleep: 0
+  maxerrors: 10
+  summary: Tsv
+
+load:
+  files: load.json
+  sleep: 10
+  duration: 30
+  random: false
+  port: 8080

apps/myapp/Dockerfile

@@ -0,0 +1,34 @@
+### Build and Test the App
+FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build
+
+### copy the source and tests
+COPY src /src
+
+WORKDIR /src
+
+# build the app
+RUN dotnet publish -c Release -o /app
+
+###########################################################
+
+
+### Build the runtime container
+FROM mcr.microsoft.com/dotnet/aspnet:6.0-alpine AS release
+
+### if port is changed, also update value in Config
+EXPOSE 8080
+WORKDIR /app
+
+### create a user
+RUN addgroup -S app && \
+    adduser -S app -G app && \
+    mkdir -p /home/app && \
+    chown -R app:app /home/app
+
+### run as app user
+USER app
+
+### copy the app
+COPY --from=build /app .
+
+ENTRYPOINT [ "dotnet",  "myapp.dll" ]

apps/myapp/README.md

@@ -0,0 +1,22 @@
+# Dotnet WebAPI Template
+
+![License](https://img.shields.io/badge/license-MIT-green.svg)
+[![Contributor Covenant](https://img.shields.io/badge/Contributor%20Covenant-2.1-4baaaa.svg)](code_of_conduct.md)
+
+## Introduction
+
+- todo - add application info here
+
+## Support
+
+This project uses GitHub Issues to track bugs and feature requests. Please search the existing issues before filing new issues to avoid duplicates.  For new issues, file your bug or feature request as a new issue.
+
+## Contributing
+
+This project welcomes contributions and suggestions and has adopted the [Contributor Covenant Code of Conduct](https://www.contributor-covenant.org/version/2/1/code_of_conduct.html).
+
+For more information see [Contributing.md](./.github/CONTRIBUTING.md)
+
+## Trademarks
+
+This project may contain trademarks or logos for projects, products, or services. Any use of third-party trademarks or logos are subject to those third-party's policies.

apps/myapp/app.yaml

@@ -0,0 +1,16 @@
+app: myapp
+containerArgs: []
+cpuLimit: 500m
+cpuRequest: 300m
+environment: dev
+image: ghcr.io/cse-labs/myapp:latest
+ingressPrefix: /
+livenessProbe: /healthz
+memoryLimit: 128Mi
+memoryRequest: 64Mi
+namespace: myapp
+nodePort: 30080
+port: 8080
+readinessProbe: /readyz
+targets: []
+template: pib-service

apps/myapp/ci-cd/codeQL.yaml

@@ -0,0 +1,72 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ "main" ]
+  schedule:
+    - cron: '18 16 * * 6'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'csharp' ]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v2
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+    #   If the Autobuild fails above, remove it and uncomment the following three lines.
+    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+    # - run: |
+    #   echo "Run, Build Application using script"
+    #   ./location_of_script_within_repo/buildscript.sh
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2

apps/myapp/ci-cd/docker-build.yaml

@@ -0,0 +1,48 @@
+name: Docker-Build
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+    - 'myapp/Dockerfile'
+    - 'myapp/**.csproj'
+    - 'myapp/**.cs'
+    - '.github/workflows/docker-build.yaml'
+
+jobs:
+
+  build:
+
+    env:
+      DOCKER_REPO: ghcr.io/yourOrg/myapp
+
+    runs-on: ubuntu-20.04
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Login to Container Registry
+      uses: docker/login-action@v1
+      with:
+        registry: ghcr.io
+        username: "$GITHUB_ACTOR"
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Docker pull
+      run: |
+        docker pull mcr.microsoft.com/dotnet/sdk:6.0
+        docker pull mcr.microsoft.com/dotnet/aspnet:6.0-alpine
+
+    - name: Docker Build
+      run: |
+        docker build myapp -t image
+
+    - name: Docker Tag and Push
+      run: |
+        # VERSION=$(docker run --rm image --version)
+
+        # tag the repo with :latest
+        docker tag image $DOCKER_REPO:latest
+
+        # Push to the repo
+        docker push -a $DOCKER_REPO