{"id":16782136,"url":"https://github.com/arup-g/cicd-pipeline-using-github-actions","last_synced_at":"2026-04-08T22:31:33.729Z","repository":{"id":237955094,"uuid":"795568942","full_name":"ARUP-G/CICD-Pipeline-Using-GitHub-Actions","owner":"ARUP-G","description":"This project deploys a SpringBoot application for a boardgame on an AWS Kubernetes cluster with monitoring using Prometheus and Grafana. The deployment is automated using a GitHub Actions CICD pipeline.","archived":false,"fork":false,"pushed_at":"2024-05-08T04:44:05.000Z","size":2445,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-03-16T21:21:46.803Z","etag":null,"topics":["aws","blackbox","docker","github-actions","graphana","java","kubeadm","kubernetes","nodeexporter","prometheus","springboot"],"latest_commit_sha":null,"homepage":"","language":"HTML","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ARUP-G.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-05-03T15:04:07.000Z","updated_at":"2024-06-26T14:45:37.000Z","dependencies_parsed_at":"2024-05-08T05:39:29.067Z","dependency_job_id":null,"html_url":"https://github.com/ARUP-G/CICD-Pipeline-Using-GitHub-Actions","commit_stats":null,"previous_names":["arup-g/cicd-pipeline-using-github-actions"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/ARUP-G/CICD-Pipeline-Using-GitHub-Actions","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ARUP-G%2FCICD-Pipeline-Using-GitHub-Actions","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ARUP-G%2FCICD-Pipeline-Using-GitHub-Actions/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ARUP-G%2FCICD-Pipeline-Using-GitHub-Actions/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ARUP-G%2FCICD-Pipeline-Using-GitHub-Actions/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ARUP-G","download_url":"https://codeload.github.com/ARUP-G/CICD-Pipeline-Using-GitHub-Actions/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ARUP-G%2FCICD-Pipeline-Using-GitHub-Actions/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31577444,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-08T14:31:17.711Z","status":"ssl_error","status_checked_at":"2026-04-08T14:31:17.202Z","response_time":54,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","blackbox","docker","github-actions","graphana","java","kubeadm","kubernetes","nodeexporter","prometheus","springboot"],"created_at":"2024-10-13T07:44:31.688Z","updated_at":"2026-04-08T22:31:33.710Z","avatar_url":"https://github.com/ARUP-G.png","language":"HTML","funding_links":[],"categories":[],"sub_categories":[],"readme":"## Boardgame SpringBoot Application on Kubernetes with Monitoring and Security\n\nThis project provides a streamlined approach to deploy your SpringBoot boardgame application on a Kubernetes cluster hosted on AWS while ensuring comprehensive monitoring and security. The deployment process is automated using a GitHub Actions CICD pipeline.\n\n## Overview\n\n![Steps](images/Github%20actions.png)\n\n- **Backend**: SpringBoot application for your boardgame.\n- **Cloud Provider**: Amazon Web Services.\n- **Containerization**: Docker for building container images.\n- **Code Quality Check**: SonarQube for code quality check.\n- **Orchestration**: Kubernetes for managing container deployments and scaling.\n- **Self-Hosted Runner**: Dedicated EC2 instance for running GitHub Actions workflows\n#### Monitoring\n- **Prometheus**: Collects and stores application and system metrics.\n- **Grafana**: Visualizes collected metrics for insights.\n- **Node Exporter**: Exposes system stats as Prometheus metrics.\n- **Blackbox Exporter**: Monitors external services.\n#### **Security**\n- **Trivy**: Scans container images for vulnerabilities.\n- **CI/CD**: GitHub Actions workflow automates build, image push, and deployment.\n\n## Features\n\n- Automated build and deployment process through GitHub Actions\n- Containerized application for portability and scalability\n- Real-time monitoring of application and system health\n- Customizable dashboards for visualizing key metrics\n- vulnerability scanning of container images with Trivy\n## Prerequisites\n\n- Java 11+\n- AWS Account with IAM user access\n- kubectl configured to interact with your Kubernetes cluster\n- Git installed\n- Docker installed \n\n## Setting Up the Project\n\n### Clone the Repository:\n\n```Bash\ngit clone https://github.com/ARUP-G/CICD-Pipeline-Using-GitHub-Actions.git\n```\n\n### Configure AWS :\nWe are creating 2 Ec2 instances for kubernetes Master and Kubernetes Worker and another Ec2 instance for Github Actions Self-Hosted Runner.\nTo create an Ubuntu EC2 instance in AWS, follow these steps:\n\n1. **Sign in to the AWS Management Console**:\n   - Go to the AWS Management Console at https://aws.amazon.com/console/.\n   - Sign in with your AWS account credentials.\n\n2. **Navigate to EC2**:\n   - Once logged in, navigate to the EC2 dashboard by typing \"EC2\" in the search bar at the top or by selecting \"Services\" and then \"EC2\" under the \"Compute\" section.\n\n3. **Launch Instance**:\n   - Click on the \"Instances\" link in the EC2 dashboard sidebar.\n   - Click the \"Launch Instance\" button.\n\n4. **Choose an Amazon Machine Image (AMI)**:\n   - In the \"Step 1: Choose an Amazon Machine Image (AMI)\" section, select \"Ubuntu\" from the list of available AMIs.\n   - Choose the Ubuntu version you want to use. For example, \"Ubuntu Server 20.04 LTS\".\n   - Click \"Select\".\n\n5. **Choose an Instance Type**:\n   - In the \"Step 2: Choose an Instance Type\" section, select the instance type that fits your requirements. The default option (usually a t2.micro instance) is suitable for testing and small workloads.\n   - Click \"Next: Configure Instance Details\".\n   ```\n   Note: Try to select instance type which has 2 or more Cpu to omit any error on K8s side.\n   ```\n\n6. **Configure Instance Details**:\n   - Optionally, configure instance details such as network settings, subnets, IAM role, etc. You can leave these settings as default for now.\n   - Click \"Next: Add Storage\".\n\n7. **Add Storage**:\n   - Specify the size of the root volume (default is usually fine for testing purposes).\n   - Click \"Next: Add Tags\".\n\n8. **Add Tags**:\n   - Optionally, add tags to your instance for better organization and management.\n   - Click \"Next: Configure Security Group\".\n\n9. **Configure Security Group**:\n   - In the \"Step 6: Configure Security Group\" section, configure the security group to allow SSH access (port 22) from your IP address.\n   - You may also want to allow other ports based on your requirements (e.g., HTTP, HTTPS) as in this pic ![Alt text](images/inbound-rules.png)\n   - Click \"Review and Launch\".\n\n10. **Review and Launch**:\n    - Review the configuration of your instance.\n    - Click \"Launch\".\n\n11. **Select Key Pair**:\n    - In the pop-up window, select an existing key pair or create a new one.\n    - Check the acknowledgment box.\n    - Click \"Launch Instances\".\n\n12. **Access Your Instance**:\n    - Use Mobaxterm \n\n\n### Configure Kubernetes Cluster:\n1. Update System Packages [On Master \u0026 Worker Node]\n\n    ```bash\n    sudo apt-get update\n    ```\n\n2. **Install Docker [On Master \u0026 Worker Node]**\n\n    ```bash\n    sudo apt install docker.io -y\n    sudo chmod 666 /var/run/docker.sock\n    ```\n\n3. **Install Required Dependencies for Kubernetes [On Master \u0026 Worker Node]**\n\n    ```bash\n    sudo apt-get install -y apt-transport-https ca-certificates curl gnupg\n    sudo mkdir -p -m 755 /etc/apt/keyrings\n    ```\n\n4. **Add Kubernetes Repository and GPG Key [On Master \u0026 Worker Node]**\n\n    ```bash\n    curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.28/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg\n    echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.28/deb/ /' | sudo tee /etc/apt/sources.list.d/kubernetes.list\n    ```\n\n5. **Update Package List [On Master \u0026 Worker Node]**\n\n    ```bash\n    sudo apt update\n    ```\n\n6. **Install Kubernetes Components [On Master \u0026 Worker Node]**\n\n    ```bash\n    sudo apt install -y kubeadm=1.28.1-1.1 kubelet=1.28.1-1.1 kubectl=1.28.1-1.1\n    ```\n\n7. **Initialize Kubernetes Master Node [On MasterNode]**\n\n    ```bash\n    sudo kubeadm init --pod-network-cidr=10.244.0.0/16\n    ```\n\n8. **Configure Kubernetes Cluster [On MasterNode]**\n\n    ```bash\n    mkdir -p $HOME/.kube\n    sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config\n    sudo chown $(id -u):$(id -g) $HOME/.kube/config\n    ```\n\n9. **Deploy Networking Solution (Calico) [On MasterNode]**\n    ```bash\n    kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml\n    ```\n\n10. **Deploy Ingress Controller (NGINX) [On MasterNode]**\n\n    ```bash\n    kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v0.49.0/deploy/static/provider/baremetal/deploy.yaml\n    ```\n11. **Connect Master Node with Worker Node [On Worker]** \n\n    Run Join Command on Worker Node:\n    \n    ```bash\n    sudo kubeadm join \u003cmaster-node-ip\u003e:\u003cmaster-node-port\u003e --token \u003ctoken\u003e --discovery-token-ca-cert-hash \u003chash\u003e\n    ```\n12. **Ckeck Kubernetes nodes [On Master]**\n    ```bash\n    kubectl get nodes\n    ```\n    ![K8-nodes](images/k8-nodes.png)\n\n13. **Create a namespace on Kubernetes**\n    ```bash\n    kubectl create namespace production\n    ```\n14. **Create Role Based Service Account**\n\n    Create a `svc.yml` file in ec2, copy the file content from K8s-setup directory from the repository and execute\n    ```bash\n    kubectl apply -f scv.yml\n    ```\n15. **Create Role for Service Account**\n\n    Create a `role.yml` file in ec2, copy the file content from K8s-setup directory from the repository and execute\n    ```bash\n    kubectl apply -f role.yml\n    ```\n16. **Create Role Bind for Service Account**\n\n    Create a `bind.yml` file in ec2, copy the file content from K8s-setup directory from the repository and execute\n    ```bash\n    kubectl apply -f bind.yml\n    ```\n14. **Create Secret for authentication of K8s Cluster**\n\n    Create a `secret.yml` file in ec2, copy the file content from K8s-setup directory from the repository and execute\n    ```bash\n    kubectl apply -f secret.yml -n production\n    ```\n15. **Add Secret to access K8s Cluster**\n    Go to `./kube` directory and convert `config` file to base64 format\n    ```bash\n    cd ./kube\n    base64 ./kube/config\n    ```\n    copy the output and set it in Step-6 of `Repository Secrets` and save as `Kube_config`\n### Configure Runner server:\n\n1. **Update System Packages** \n\n    ```bash\n    sudo apt-get update\n    ```\n\n2. **Install Docker**\n\n    ```bash\n    sudo apt install docker.io -y\n    sudo chmod 666 /var/run/docker.sock\n    ``` \n3.  **Run the following command [SonarQube]**:\n\n    ```bash\n    docker run -d --name sonar -p 9000:9000 sonarqube:lts-community\n    ```\n\n    This command will download the `sonarqube:lts-community` Docker image from Docker Hub if it's not already available locally. Then, it will create a container named \"sonar\" from this image, running it in detached mode (`-d` flag) and mapping port 9000 on the host machine to port 9000 in the container (`-p 9000:9000` flag).\n\n4. **Access SonarQube by opening a web browser**.\n\n    Navigating to `http://runner-ec2-public-ip:9000`\n    This will start the SonarQube server, and you should be able to access it using the provided URL.\n    ![Sonarqube](images/sonarqube.png)\n\n5. **Setup Trivy for vulnerablity scan**\n    ```bash\n    sudo apt-get install wget apt-transport-https gnupg lsb-release\n    wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -\n    echo deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main | sudo tee -a /etc/apt/sources.list.d/trivy.list\n    sudo apt-get update\n    sudo apt-get install trivy\n    ```\n\n### Configure GitHub Actions:\n\n1. **Go to setting page of the repo**\n\n2. **Click action -\u003e Runners -\u003e Create New-Self-Hosted-Runner**\n\n3. **Follow the configaration steps**\n    ![Github-Actions Configaration](images/runner%20setup.png)\n\n4. **Execute `run.sh` file in `actions-runner` directory**\n\n5. **Check Runners page on GitHub to ckeck the Runner status**\n    ![runner](images/git-runner.png)\n\n6. **Create Repository Secrets for CI/CD Pipeline**.\n\n    Go to repo settings -\u003e Secrets and Variables -\u003e Actions -\u003e New Repository Secret \n    make sure to keep the same secret names as below\n    ![Repo-secret](images/github_secret.png)\n\n7. **Run the CICD-Pipeline on GitHUb actions**\n    ![CodeBuild](images/actions.png)\n\n8. **Port on which application is deployed**\n\n    Go to Build summary and find the Kubernetes stage and find the svc port.\n    ![k8-ingress](images/k8-ingress.png)\n\n9. **Access the application**\n\n    access the application on ``http://runner-ec2-public-ip:k8ssvc-portnumber``\n    ![app](images/app.png)\n\n## Setup Monitoring\n### Configure Prometheus:\n\n1. **Download Prometheus**\n\n    Go to `https://prometheus.io/download/` and get prometheus linux version.\n    ```bash\n    wget https://github.com/prometheus/prometheus/releases/download/v2.45.5/prometheus-2.45.5.linux-amd64.tar.gz\n    ```\n2. **Unzip Prometheus**\n\n    ```bash\n    tar -xvf prometheus-2.45.5.linux-amd64.tar.gz\n    ```\n3. **Run Prometheus**\n\n    ```bash\n    cd prometheus-2.45.5.linux-amd64\n    # Run on background\n    ./prometheus \u0026\n    ```\n4. **Access prometheus**\n\n    Visit `http://runner-ec2-public-ip:9090` and go to `Status` then `Targets`\n    ![promethesu-1](images/promethus2.png)\n\n5. **Add BlackBox For External Service monitoting**\n\n    Go to `https://prometheus.io/download/` and get Blackbox_exporter linux version.\n    ```bash\n    wget https://github.com/prometheus/blackbox_exporter/releases/download/v0.25.0/blackbox_exporter-0.25.0.linux-amd64.tar.gz\n    ```\n6. **Unzip BalckBox**\n    ```bash\n    tar -xvf blackbox_exporter-0.25.0.linux-amd64.tar.gz\n    ```\n\n7. **Add Node-Exporter For system stats monitoting**\n\n    Go to `https://prometheus.io/download/` and get node_exporter linux version.\n    ```bash\n    wget https://github.com/prometheus/node_exporter/releases/download/v1.8.0/node_exporter-1.8.0.linux-amd64.tar.gz\n    ```\n8. **Unzip Node-exporter**\n\n    ```bash\n    tar -xvf node_exporter-1.8.0.linux-amd64.tar.gz\n    ``` \n9. **Confirure Bloackbox and Node_Exporter to work with prometheus**\n    \n    ```bash\n    cd prometheus-2.45.5.linux-amd64\n    # edit the prometheus.yml file\n    # Copy the contents from file in k8s-setup under same name\n    vi prometheus.yml\n    ``` \n10. **Run BlackBOx Exporter**\n\n    ```bash\n    cd blackbox_exporter-0.25.0.linux-amd64\n    ./blackbox\n    ```\n\n11. **Access BlackBox**\n\n    Visit `http://runner-ec2-public-ip:9115`\n    ![BlackBox](images/bbox.png)\n\n12. **Run Node Exporter**\n\n    ```bash\n    cd node_exporter-1.8.0.linux-amd64\n    # Run in background\n    ./node_exporter \u0026\n    ```\n13. **Access Node_Exporter**\n\n    Visit `http://runner-ec2-public-ip:9100`\n    ![node-exporter](images/node%20exporter.png)\n\n14. **Access prometheus**\n\n    Re-run Prometheus\n\n    Visit `http://runner-ec2-public-ip:9090`\n\n    ![](images/node%20exp%2011.png) \n\n### Configure Graphana:\n\n1. **Download Graphana**\n\n    Go to `https://grafana.com/grafana/download` and get Graphana linux version.\n    \n    ```bash\n    # Run commands one by one\n    sudo apt-get install -y adduser libfontconfig1 musl\n    wget https://dl.grafana.com/enterprise/release/grafana-enterprise_10.4.2_amd64.deb\n    sudo dpkg -i grafana-enterprise_10.4.2_amd64.deb\n    ```\n2. **Run Graphana**\n\n    ```bash\n    sudo /bin/systemctl/ start graphana-server\n    ```\n3. **Access Graphana**\n\n    Visit `http://runner-ec2-public-ip:3000`\n\n    ![Graphana](images/graphana1.png) \n\n4. **Add Connection to Prometheus**\n\n    Home -\u003e Connections -\u003e Add new connnection -\u003e Search Prometheus -\u003e Add -\u003e Prometheua Serever URL -\u003e `http://runner-ec2-public-ip:9090` -\u003e Save and Test\n    \n    ![Connection](images/graphana2.png)\n\n5. **Create Dashboard**\n    \n    - visit https://grafana.com/grafana/dashboards/7587-prometheus-blackbox-exporter/ and import the dashboard by copying dashboard ID.\n\n    - visit https://grafana.com/grafana/dashboards/1860-node-exporter-full/ and import the dashboard by copying dashboard ID.\n    - Refresh dashboard.\n\n    ![graphana-bb-dashboard](images/graphana%204.png)\n\n    ![graphana-ne-dashboard](images/gara.png)\n\n\n\n## License\n\nThis project is licensed under the MIT License. \n\n## Contributing\n\nContributions to the Spring Boot BoardGame application and deployment guide are welcome! If you have any suggestions, bug fixes, or improvements, feel free to open an issue or submit a pull request.\n\n## Acknowledgements\n\nSpecial thanks to the Spring Boot community, Kubernetes community, GitHub Actions, Prometheus, Grafana, Blackbox, Node Exporter, and Trivy and Aditya Jaisawal for their contributions to the ecosystem.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farup-g%2Fcicd-pipeline-using-github-actions","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Farup-g%2Fcicd-pipeline-using-github-actions","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farup-g%2Fcicd-pipeline-using-github-actions/lists"}