Azure Kubernetes Skill Security Audit

123      # -----------------------------------------------------------124      - name: Azure Login (OIDC)125        uses: azure/login@v2126        with:127          client-id: ${{ secrets.AZURE_CLIENT_ID }}128          tenant-id: ${{ secrets.AZURE_TENANT_ID }}129          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}130

144145      - name: Set AKS context146        uses: azure/aks-set-context@v4147        with:148          resource-group: ${{ env.RESOURCE_GROUP }}149          cluster-name: ${{ env.AKS_CLUSTER }}150

170171      - name: Deploy to AKS172        id: deploy173        run: |174          # Ensure the namespace exists before applying manifests175          kubectl create namespace ${{ env.NAMESPACE }} --dry-run=client -o yaml \176            | kubectl apply -f -177          kubectl apply -f k8s/ --namespace ${{ env.NAMESPACE }}178179          kubectl rollout status deployment/${{ env.APP_NAME }} \180            --namespace ${{ env.NAMESPACE }} \181            --timeout=300s182

137      # -----------------------------------------------------------138      - name: Build and push image to ACR139        run: |140          az acr build \141            --registry ${{ env.ACR_NAME }} \142            --image ${{ env.APP_NAME }}:${{ github.sha }} \143            .144

20# ---------------------------------------------------------------------------21# Base: current Node LTS, Alpine variant. See references/base-images.md.22FROM node:<LATEST_STABLE_NODE>-alpine AS build23

45# ---------------------------------------------------------------------------46FROM node:<LATEST_STABLE_NODE>-alpine4748# Security: install dumb-init so Node runs as PID > 1 and signals propagate49# correctly — avoids zombie processes inside the container.50RUN apk add --no-cache dumb-init51

891. **Never pin minor/patch.** Use a floating **major** (or major.minor) tag.10   Floating tags receive security patches automatically — a frozen patch tag11   does not.122. **Resolve `<LATEST_STABLE_*>` at generation time.** When generating a13   Dockerfile, replace each placeholder with the current stable major the14   project targets (see "Resolution" below), then keep that major tag in the15   output. A major tag is concrete, so it satisfies Deployment Safeguard DS00916   (no `:latest`).173. **Prefer the Microsoft/Azure Linux image when one exists and the project

6364          # DS002: Liveness probe65          livenessProbe:66            httpGet:67              path: <health-path>68              port: <port>69            initialDelaySeconds: 1070            periodSeconds: 1571            timeoutSeconds: 372            failureThreshold: 37374          # DS003: Readiness probe75          readinessProbe:76            httpGet:77              path: <ready-path>78              port: <port>79            initialDelaySeconds: 580            periodSeconds: 1081            timeoutSeconds: 382            failureThreshold: 383

182183# 2. Apply remaining manifests184kubectl apply -f k8s/ --recursive185186# 3. Wait for rollout187kubectl rollout status deployment/<app-name> -n <namespace> --timeout=300s188```

175176### Deploy to cluster177178```bash179# 1. Create namespace (must succeed before proceeding)180kubectl apply -f k8s/namespace.yaml181kubectl get namespace <namespace> -o name   # verify182183# 2. Apply remaining manifests184kubectl apply -f k8s/ --recursive185186# 3. Wait for rollout187kubectl rollout status deployment/<app-name> -n <namespace> --timeout=300s188```

185186      - name: Rollback on failure187        if: failure() && steps.deploy.outputs.deployed == 'true'188        run: |189          kubectl rollout undo deployment/${{ env.APP_NAME }} \190            --namespace ${{ env.NAMESPACE }}191          kubectl rollout status deployment/${{ env.APP_NAME }} \192            --namespace ${{ env.NAMESPACE }} \193            --timeout=120s194          echo "⚠️ Rolled back to previous revision"195

2122## kubectl apply Failed (Section 4 — Deploy to Cluster)2324```bash25# Remove the partially applied resources:26kubectl delete -f k8s/27

99100**If existing manifests found** (in `k8s/`, `manifests/`, or `deploy/`): Validate against AKS Deployment Safeguards (Section 3) and apply targeted fixes. Do not regenerate — improve in place.101102**If no manifests found:** Generate from `templates/k8s/` templates. Replace `<angle-bracket>` placeholders with detected values.103

5455# Minimum permissions required:56# - Microsoft.ContainerService/managedClusters/read57# - Microsoft.ContainerService/managedClusters/listClusterUserCredential/action5859# Assign if missing (requires Owner or User Access Administrator)60az role assignment create \61  --assignee <principal-id> \62  --role "Azure Kubernetes Service Cluster User Role" \63  --scope /subscriptions/<subscription-id>/resourceGroups/<rg>/providers/Microsoft.ContainerService/managedClusters/<cluster>64```

48491. **Read-only**: NEVER modify cluster state. Assessment is read-only. Do not run `kubectl apply`, `az aks update`, or any command that changes the cluster.502. **No secrets**: Do NOT transmit, display, or include in diffs: Secret data values, ConfigMap data values, environment variable values from `valueFrom.secretKeyRef`, service account tokens, or connection strings.

5859# Assign if missing (requires Owner or User Access Administrator)60az role assignment create \61  --assignee <principal-id> \62  --role "Azure Kubernetes Service Cluster User Role" \63  --scope /subscriptions/<subscription-id>/resourceGroups/<rg>/providers/Microsoft.ContainerService/managedClusters/<cluster>64```