<blockquote>
  <p>Our previous GitLab based CI/CD utilized an Authenticated curl request to a specific REST API endpoint to trigger the redeployment of an updated container to our service, if you use something similar for your Kubernetes based deployment this Question is for you.</p>
</blockquote>

<h2>More Background</h2>

<p>We run a production site / app (Ghost blog based) on an Azure AKS Cluster.  Right now we manually push our updated containers to a private ACR (Azure Container Registry) and then update from the command line with Kubectl.</p>

<p>That being said we previously used Docker Cloud for our orchestration and fully integrated re-deploying our production / staging services using GitLab-Ci.</p>

<p>That GitLab-Ci integration is the goal, and the 'Why' behind this question.</p>

<h1>My Question</h1>

<p>Since we previously used Docker Cloud (doh, should have gone K8s from the start) how should we handle the fact that GitLab-Ci was able to make use of Secrets created the Docker Cloud CLI and then authenticate with the Docker Cloud API to trigger actions on our Nodes (ie. re-deploy with new containers etc).</p>

<p>While I believe we can build a container (to be used by our GitLab-Ci runner) that contains Kubectl, and the Azure CLI, I know that Kubernetes also has a similar (to docker cloud) Rest API that can be found here (<a href="https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster" rel="noreferrer">https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster</a>) — specifically the section that talks about connecting WITHOUT Kubectl appears to be relevant (as does the piece about the HTTP REST API).</p>

<p>My Question to anyone who is connecting to an Azure (or potentially other managed Kubernetes service):</p>

<blockquote>
  <p>How does your Ci/CD server authenticate with your Kubernetes service provider's Management Server, and then how do you currently trigger an update / redeployment of an updated container / service?</p>
</blockquote>

<p>If you have used the Kubernetes HTTP Rest API to re-deploy a service your thoughts are particularly value-able!</p>

<h1>Kubernetes Resources I am Reviewing</h1>

<ol>
<li><a href="https://stackoverflow.com/questions/37426096/how-should-i-manage-deployments-with-kubernetes?rq=1">How should I manage deployments with kubernetes</a></li>
<li><a href="https://stackoverflow.com/questions/34773609/kubernetes-deployments">Kubernetes Deployments</a></li>
</ol>

<p>Will update as I work through the process.</p>

Necevil
<h2>Creating the integration</h2>

<p>I had the same problem of how to integrate the GitLab CI/CD with my Azure AKS Kubernetes cluster. I created this <a href="https://stackoverflow.com/questions/50775758/how-to-add-an-azure-aks-kubernetes-cluster-self-signed-ca-to-gitlab-ci-cd-kubern/50778120">question</a> because I was having some error when I tried to add my Kubernetes cluester info into GitLab.</p>

<p>How to integrate them:</p>

<ol>
<li>Inside GitLab, go to "Operations" > "Kubernetes" menu.</li>
<li>Click on the "Add Kubernetes cluster" button on the top of the page</li>
<li>You will have to fill some form fields, to get the content that you have to put into these fields, connect to your Azure account from the CLI (you need Azure CLI installed on your PC) using <code>az login</code> command, and then execute this other command to get the Kubernetes cluster credentials: <code>az aks get-credentials --resource-group &lt;resource-group-name&gt; --name &lt;kubernetes-cluster-name&gt;</code></li>
<li>The previous command will create a <code>~/.kube/config</code> file, open this file, the content of the fields that you have to fill in the GitLab "Add Kubernetes cluster" form are all inside this <code>.kube/config</code> file</li>
</ol>

<p>These are the fields:</p>

<ol>
<li><strong>Kubernetes cluster name:</strong> It's the name of your cluster on Azure, it's in the <code>.kube/config</code> file too. </li>
<li><strong>API URL:</strong> It's the URL in the field <code>server</code> of the <code>.kube/config</code> file.</li>
<li><strong>CA Certificate:</strong> It's the field <code>certificate-authority-data</code> of the <code>.kube/config</code> file, but you will have to base64 decode it.</li>
</ol>

<p>After you decode it, it must be something like this:</p>

<pre><code>-----BEGIN CERTIFICATE-----
...
some base64 strings here
...
-----END CERTIFICATE-----
</code></pre>

<ol start="4">
<li><strong>Token:</strong> It's the string of hexadecimal chars in the field <code>token</code> of the <code>.kube/config</code> file (it might also need to be base 64 decoded?). You need to use a token belonging to an account with <strong>cluster-admin</strong> privileges, so GitLab can use it for authenticating and installing stuff on the cluster. The easiest way to achieve this is by creating a new account for GitLab: create a YAML file with the service account definition (an example can be seen <a href="https://docs.gitlab.com/ee/user/project/clusters/#adding-an-existing-kubernetes-cluster" rel="noreferrer">here</a> under <em>Create a gitlab service account in the default namespace</em>) and apply it to your cluster by means of <code>kubectl apply -f serviceaccount.yml</code>.</li>
<li><strong>Project namespace (optional, unique):</strong> I leave it empty, don't know yet for what or where this namespace can be used.</li>
</ol>

<p>Click in "Save" and it's done. Your GitLab project must be connected to your Kubernetes cluster now.</p>

<h2>Deploy</h2>

<p>In your deploy job (in the pipeline), you'll need some environment variables to access your cluster using the <code>kubectl</code> command, here is a list of all the variables available:</p>

<p><a href="https://docs.gitlab.com/ee/user/project/clusters/index.html#deployment-variables" rel="noreferrer">https://docs.gitlab.com/ee/user/project/clusters/index.html#deployment-variables</a></p>

<p>To have these variables injected in your deploy job, there are some conditions:</p>

<ul>
<li>You must have added correctly the Kubernetes cluster into your GitLab project, menu "Operations" > "Kubernetes" and these steps that I described above</li>
<li>Your job must be a "deployment job", in GitLab CI, to be considered a deployment job, your job definition (in your <code>.gitlab-ci.yml</code>) must have an <code>environment</code> key (take a look at the line 31 in this <a href="https://gist.github.com/lmcarreiro/75186bd1d4e387c13c63d0a7087e9999#file-gitlab-ci-yml-L31" rel="noreferrer">example</a>), and the environment name must match the name you used in menu "Operations" > "Environments".</li>
</ul>

<p>Here are an example of a <a href="https://gist.github.com/lmcarreiro/75186bd1d4e387c13c63d0a7087e9999" rel="noreferrer">.gitlab-ci.yml</a> with three stages:</p>

<ul>
<li><strong>Build:</strong> it builds a docker image and push it to gitlab private registry</li>
<li><strong>Test:</strong> it doesn't do anything yet, just put an <code>exit 0</code> to change it later</li>
<li><strong>Deploy:</strong> download a stable version of <code>kubectl</code>, copy the <code>.kube/config</code> file to be able to run <code>kubectl</code> commands in the cluster and executes a <code>kubectl cluster-info</code> to make sure it is working. In my project I didn't finish to write my deploy script to really execute a deploy. But this <code>kubectl cluster-info</code> command is executing fine.</li>
</ul>

<p><strong>Tip:</strong> to take a look at all the environment variables and their values (Jenkins has a page with this view, GitLab CI doesn't) you can execute the command <code>env</code> in the script of your deploy stage. It helps a lot to debug a job.</p>
