Deploying to Azure

This guide will describe the process of deploying the application to Azure using github actions. We have chosen to deploy the application to Azure, however a Docker container is portable and may be run at any endpoint! So feel free to deploy anywhere you see fit!

Likewise keep in mind that we have already looked at how to run the project as a container locally, so there is nothing to stop you form running it on premises!

Notice

Keep in mind
You will have to adjust the endpoint permissions for the application...

This involves adjusting the allowed hosts in myvenv/mysite/settings.py and also changing the final directive in the Dockerfile

settings.py
ALLOWED_HOSTS = ['127.0.0.1', 'localhost']

Would become
ALLOWED_HOSTS = ['127.0.0.1', 'localhost', 'your-endpoint-ip']

Dockerfile
...
CMD ["python", "myvenv/manage.py", "runserver", "0.0.0.0:8000"]

Would change to
...
CMD ["python", "myvenv/manage.py", "runserver", "your-endpoint-ip:port"]

With this, you now have the potential to deploy your application anywhere!

Likewise, if you choose to deploy the project to Azure, you will need to add the public IP address of the container instance to the allowed hosts

Automating the deployment

Updating Dockerfile
We need to make a small change to our Dockerfile

Dockerfile
...
CMD ["python", "myvenv/manage.py", "runserver", "0.0.0.0:8000"]

Would change to
...
CMD ["python", "myvenv/manage.py", "runserver", "0.0.0.0:80"]

I.e our final Dockerfile is:
FROM python:3.8.3-alpine

# set work directory
WORKDIR /usr/src/app

# set environment variables
ENV PYTHONDONTWRITEBYTECODE 1
ENV PYTHONUNBUFFERED 1

# copy project
COPY . /usr/src/app

# install dependencies
RUN python -m pip install -r requirements.txt
EXPOSE 8000

# commands issued to container
RUN python myvenv/manage.py clearsessions
RUN python myvenv/manage.py makemigrations
RUN python myvenv/manage.py migrate
CMD ["python", "myvenv/manage.py", "runserver", "0.0.0.0:80"]

Credentials for the GitHub repo
We need the following credentials noted down somewhere in order for our deployment to work:

1. AZURE_CREDENTIALS
2. REGISTRY_LOGIN_SERVER
3. REGISTRY_USERNAME
4. REGISTRY_PASSWORD
5. RESOURCE_GROUP

We will add them to our repository secrets.

Keep in mind that our method of authenticating access to our Azure resources is through a service principal which is stored as a secret in our GitHub repository. It is documented here.

Collecting credentials
Using the Azure CLI, we will create a service principal to authenticate Azure actions

1. Get the GROUP_ID of the resource group using the name of the group
az group show --name <resource-group-name> --query id --output tsv
We do not need to save the output of this in github actions, however it is needed for the following steps so it is wise to keep it safe.

2. Create the service principal using the GROUP_ID from the previous step
az ad sp create-for-rbac --scope <GROUP_ID> --role Contributor --sdk-auth
Which will result in a JSON output similiar to:

{
"clientId": "xxxx6ddc-xxxx-xxxx-xxx-ef78a99dxxxx",
"clientSecret": "xxxx79dc-xxxx-xxxx-xxxx-aaaaaec5xxxx",
"subscriptionId": "xxxx251c-xxxx-xxxx-xxxx-bf99a306xxxx",
"tenantId": "xxxx88bf-xxxx-xxxx-xxxx-2d7cd011xxxx",
"activeDirectoryEndpointUrl": "https://login.microsoftonline.com",
"resourceManagerEndpointUrl": "https://management.azure.com/",
"activeDirectoryGraphResourceId": "https://graph.windows.net/",
"sqlManagementEndpointUrl": "https://management.core.windows.net:8443/",
"galleryEndpointUrl": "https://gallery.azure.com/",
"managementEndpointUrl": "https://management.core.windows.net/"
}

We need to save all of this JSON output for the later steps.
We also need to note down the clientId which we need in the upcoming steps

3. Get the REGISTRY_ID for the container registry by querying the registry name
az acr show --name <registry-name> --query id --output tsv
We do not need to save the output of this in github actions, however it is needed for the following steps so it is wise to keep it safe. Keep in mind this step assumes you already set up a container registry as per the pre requisites.

4. Assign the AcrPush role for the container registry using REGISTRY_ID and clientId from the JSON output
az role assignment create --assignee <ClientId> --scope <registryId> --role AcrPush

Storing credentials
Using the Azure CLI, we have collected all the information needed for the automation to work!

We can save these credentials in GitHub secrets by selecting Settings > Secrets > Actions, and choosing 'New Repository Secret'

We can now populate our GitHub repository secrets as such:

Secret	Value
AZURE_CREDENTIALS	The entire JSON output from when we create service principal
REGISTRY_LOGIN_SERVER	The name of the login server for the registry, in lowercase Such as: moorfieldsapp.azurecr.io
REGISTRY_USERNAME	The clientId from the JSON output
REGISTRY_PASSWORD	The clientSecret from the JSON output
RESOURCE_GROUP	The name of the resource group that we used to create the service principal

And with this, our preparations are done! We've managed to do the tricky bit!

Creating the workflow
Now that our secrets are in place, we just need to automate the building and deploying of our project to our container registry using a GitHub action.

1. Select Actions from the UI in your GitHub repository
2. Select set up a workflow yourself from the menu
3. Select a name for your workflow, or leave it as the default main.yml
4. Paste the following YAML contents over the sample code
5. Select Start commit to push your workflow to the repository

Here is the YAML file to paste in, remember that you need to replace <image-name> with the name for your image

                                name: Automatic_Deployment
                                on:
                                  push:
                                    branches:
                                    - main
                                jobs:
                                    build-and-deploy:
                                        runs-on: ubuntu-latest
                                        steps:
                                        # checkout the repo
                                        - name: 'Checkout GitHub Action'
                                          uses: actions/checkout@main
                                          
                                        - name: 'Login via Azure CLI'
                                          uses: azure/login@v1
                                          with:
                                            creds: ${{ secrets.AZURE_CREDENTIALS }}
                                        
                                        - name: 'Build and push image'
                                          uses: azure/docker-login@v1
                                          with:
                                            login-server: ${{ secrets.REGISTRY_LOGIN_SERVER }}
                                            username: ${{ secrets.REGISTRY_USERNAME }}
                                            password: ${{ secrets.REGISTRY_PASSWORD }}
                                        - run: |
                                            docker build . -t ${{ secrets.REGISTRY_LOGIN_SERVER }}/<image-name>:latest
                                            docker push ${{ secrets.REGISTRY_LOGIN_SERVER }}/<image-name>:latest
                                
                                        - name: 'Deploy to Azure Container Instances'
                                          uses: 'azure/aci-deploy@v1'
                                          with:
                                            resource-group: ${{ secrets.RESOURCE_GROUP }}
                                            dns-name-label: ${{ secrets.RESOURCE_GROUP }}${{ github.run_number }}
                                            image: ${{ secrets.REGISTRY_LOGIN_SERVER }}/<image-name>:latest
                                            registry-login-server: ${{ secrets.REGISTRY_LOGIN_SERVER }}
                                            registry-username: ${{ secrets.REGISTRY_USERNAME }}
                                            registry-password: ${{ secrets.REGISTRY_PASSWORD }}
                                            name: <image-name>
                                            location: 'uksouth'
                            
                            

Keep in mind that this automation is triggered when pushing to main, feel free to change this to something else, such as production if needed!

Finishing up

With this, our automatic deployment is set up!

1. Navigate to your Azure portal over here.
2. Click on your container instance, recall that you changed <image-name>, so that is what your container instance will be called!
3. This will open up the dashboard for your container instance! Here you can see its public IP adresss, this is where the project is deployed to!

And thats it! You've gone ahead and automated the project to be built using Docker and uploaded to the Azure cloud automatically!

Some notes

docker push ${{ secrets.REGISTRY_LOGIN_SERVER }}/<image-name>:latest
Pushes the freshly built Docker image to container registry from where the latest image replaces the running container instance!

This is how it keeps the application at the endpoint, namely the public IP address of the container instance, up to date with the latest changes! Here is our deployment endpoint: 20.108.118.162 though this assumes we still have Azure credits in our student accounts

Further, this is how we chose to deploy our project... You can deploy this project anywhere since it is wrapped up as Docker container that can be run anywhere! The possibilities are endless.