{"id":50666315,"url":"https://github.com/silasfrancis/azure-private-aks-platform","last_synced_at":"2026-06-08T06:36:24.828Z","repository":{"id":352444944,"uuid":"1158316804","full_name":"silasfrancis/azure-private-aks-platform","owner":"silasfrancis","description":"A fully private CI/CD platform built on Microsoft Azure, leveraging a private Kubernetes cluster, Azure Application Gateway for Containers, Infrastructure as Code, and automated deployment pipelines.","archived":false,"fork":false,"pushed_at":"2026-04-19T15:28:58.000Z","size":792,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"dev","last_synced_at":"2026-04-19T17:30:20.219Z","etag":null,"topics":["aks","ansible","azure","azure-devops","cicd","devops","external-secrets","gateway-api","helm","infrastructure-as-code","key-vault","kubernetes","managed-identity","oidc","platform-engineering","private-cluster","terraform","zero-trust"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/silasfrancis.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"docs/security.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-02-15T06:34:03.000Z","updated_at":"2026-04-19T15:05:38.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/silasfrancis/azure-private-aks-platform","commit_stats":null,"previous_names":["silasfrancis/azure-private-aks-platform"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/silasfrancis/azure-private-aks-platform","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/silasfrancis%2Fazure-private-aks-platform","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/silasfrancis%2Fazure-private-aks-platform/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/silasfrancis%2Fazure-private-aks-platform/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/silasfrancis%2Fazure-private-aks-platform/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/silasfrancis","download_url":"https://codeload.github.com/silasfrancis/azure-private-aks-platform/tar.gz/refs/heads/dev","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/silasfrancis%2Fazure-private-aks-platform/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34051771,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-08T02:00:07.615Z","response_time":111,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aks","ansible","azure","azure-devops","cicd","devops","external-secrets","gateway-api","helm","infrastructure-as-code","key-vault","kubernetes","managed-identity","oidc","platform-engineering","private-cluster","terraform","zero-trust"],"created_at":"2026-06-08T06:34:43.319Z","updated_at":"2026-06-08T06:36:24.823Z","avatar_url":"https://github.com/silasfrancis.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Private Azure Kubernetes CI/CD Platform\n\nA fully private CI/CD platform built on Microsoft Azure, leveraging a private Kubernetes cluster, Azure Application Gateway for Containers, Infrastructure as Code, and automated deployment pipelines.\n\nThis project demonstrates how to design, provision, secure, and operate a production-style private Kubernetes environment on Azure with no public control plane exposure and a private CI/CD runner inside the virtual network.\n\n---\n\n## Overview\n\nMost production Kubernetes environments operate as private clusters, where the Kubernetes API server is not publicly accessible and can only be reached from within a secure Virtual Network (VNet).\n\nThis project demonstrates how to:\n\n- Provision a private AKS cluster  \n- Route external traffic securely using Azure Application Gateway for Containers  \n- Deploy workloads using a private Azure DevOps self-hosted runner  \n- Configure infrastructure using Terraform  \n- Manage automation and configuration with Ansible  \n- Secure secrets and TLS within the cluster  \n\nThe system is designed around network isolation, identity-based access control, and controlled ingress.\n\n---\n\n## Key Features\n\n- Private AKS cluster (accessible only within the VNet)  \n- Azure Application Gateway for Containers as a Gateway API ingress controller  \n- Self-hosted Azure DevOps runner inside the VNet  \n- Ansible-based configuration management  \n- Terraform-based infrastructure provisioning  \n- External Secrets Operator for Kubernetes secret management  \n- cert-manager for automated TLS certificate management  \n- OIDC and Azure Service Connections for secure pipeline authentication  \n- Jumphost VM for private cluster administration  \n\n---\n\n## Architecture Overview\n\n### High-Level Flow\n\n```text\nDeveloper\n↓\nAzure DevOps (OIDC / Service Connection)\n↓\nTerraform (Infrastructure Provisioning)\n↓\nAzure Infrastructure\n  - Virtual Network\n  - Subnets (VM, AKS, Application Gateway, PostgreSQL)\n  - Private AKS Cluster\n  - Azure Application Gateway for Containers\n  - Azure PostgreSQL Flexible Server (Private)\n  - Azure Key Vault\n  - Private VM (Self-Hosted Runner)\n↓\nAnsible Configuration\n  - Configure Jumphost\n  - Install and register Azure DevOps private runner\n  - Kubernetes administrative configuration\n↓\nHelm Deployments to Private AKS\n↓\nApplication Workloads (FastAPI + React)\n```\n\n---\n\n## Runtime Traffic Flow\n\n```\nClient\n↓\nPublic Endpoint (Application Gateway)\n↓\nAzure Application Gateway for Containers\n↓\nKubernetes Gateway API\n↓\nKubernetes Service\n↓\nApplication Pods (FastAPI / React)\n↓\nAzure PostgreSQL Flexible Server\n```\n\n---\n\n## CI/CD Execution Flow (Private Deployment Path)\n\n```\nDeveloper Commit\n↓\nAzure DevOps Pipeline Trigger\n↓\nPipeline runs on Self-Hosted Private Runner (inside VNet)\n↓\nDocker Build \u0026 Push\n↓\nHelm Upgrade / Deploy to Private AKS\n↓\nAKS pulls secrets from Azure Key Vault (via External Secrets Operator)\n↓\nApplication Updated in Cluster\n```\n\n---\n\n## Security Model\n\n### Network Isolation\n\n- Private AKS cluster (no public API endpoint)  \n- Subnet segmentation  \n- Controlled ingress via Azure Application Gateway for Containers  \n\n### Identity \u0026 Access\n\n- Managed Identities  \n- OIDC federation for Azure DevOps pipelines  \n- Azure Service Connections for scoped resource access  \n- Kubernetes RBAC enforcement  \n\n### Secret Management\n\n- Azure Key Vault integration  \n- External Secrets Operator  \n- No hardcoded secrets in repositories or pipelines  \n\n### CI/CD Security\n\n- Self-hosted runner inside the VNet  \n- No public build agents  \n- Infrastructure access controlled via scoped service connections  \n\nDetailed security documentation is available in [`docs/security.md`](docs/security.md).\n\n---\n\n## CI/CD Pipeline\n\nThe CI/CD pipeline is implemented using Azure DevOps and includes:\n\n- Infrastructure provisioning via Terraform  \n- Application build and container image push  \n- Helm-based Kubernetes deployment  \n- Secure authentication using OIDC and Service Connections  \n- Execution on a private self-hosted runner inside the VNet  \n\nThe runner VM is provisioned with Terraform and configured using Ansible.\n\n---\n\n## Repository Structure\n\n```\n.\n├── ansible\n├── azure_pipelines\n│   ├── env\n│   ├── templated-steps\n│   └── templates\n├── backend\n│   └── fastapi\n├── docs\n├── frontend\n│   └── react-recoil\n├── helm\n│   ├── app\n│   └── azure-application-gateway-for-containers\n├── terraform\n│   ├── azure_modules\n│   └── env\n└── utils\n```\n\n---\n\n## Directory Overview\n\n- `ansible/` – Configuration management and private runner setup  \n- `azure_pipelines/` – CI/CD definitions and reusable Azure DevOps templates  \n- `helm/` – Kubernetes application deployments  \n- `terraform/` – Infrastructure as Code for Azure resources  \n- `backend/` – FastAPI backend  \n- `frontend/` – React frontend  \n- `docs/` – Architectural, security, and system documentation  \n\n---\n\n## Getting Started (High-Level)\n\n1. Provision infrastructure using the Terraform configurations in `/terraform`.  \n2. Configure the private VM and Azure DevOps runner using Ansible in `/ansible`.  \n3. Set up Azure DevOps service connections.  \n4. Execute the pipeline to build and deploy workloads.  \n5. Access the application through the Application Gateway endpoint.  \n\n---\n\n## Limitations \u0026 Future Work\n\n- Add monitoring stack (Prometheus / Grafana)  \n- Implement Horizontal Pod Autoscaler and Cluster Autoscaler  \n- Add policy enforcement (OPA)  \n\n---\n\n## Additional Documentation\n\nDetailed documentation is available in the `docs/` directory:\n\n- [`docs/architecture.md`](docs/architecture.md) – Infrastructure and component breakdown  \n- [`docs/security.md`](docs/security.md) – Security model and threat considerations  ","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsilasfrancis%2Fazure-private-aks-platform","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsilasfrancis%2Fazure-private-aks-platform","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsilasfrancis%2Fazure-private-aks-platform/lists"}