Netflix Clone Deployment on Azure - DevSecOps Project

This repository contains a complete DevSecOps pipeline for deploying a Netflix clone application on Azure, implementing security scanning, monitoring, and Kubernetes deployment.

Project Overview

This project demonstrates a complete CI/CD pipeline with integrated security (DevSecOps) for a Netflix clone application, deployed on Azure infrastructure. The pipeline includes:

Code Build & Test: Jenkins pipeline for building and testing the application
Security Scanning: SonarQube, OWASP Dependency Check, and Trivy for vulnerability scanning
Containerization: Docker for containerizing the application
Orchestration: Azure Kubernetes Service (AKS) for container orchestration
GitOps: ArgoCD for declarative deployments
Monitoring: Prometheus and Grafana for monitoring

Prerequisites

Azure account with active subscription
Azure B-series VM (equivalent to AWS t2.medium)
Basic knowledge of Jenkins, Docker, and Kubernetes

Infrastructure Setup

1. Create Azure VM

Instead of AWS EC2, this project uses Azure B-series VM (equivalent to t2.medium). Azure VMs automatically create public IPs, simplifying access to the services.

# Create resource group
az group create --name netflix-devsecops --location eastus

# Create VM
az vm create \
  --resource-group netflix-devsecops \
  --name jenkins-vm \
  --image Ubuntu2204 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --size Standard_B2s

2. Configure Network Security Group

Ensure the following ports are open in your Azure Network Security Group:

8080: Jenkins
8081: Netflix application
9000: SonarQube
9090: Prometheus
3000: Grafana
9100: Node Exporter

# Open required ports
az vm open-port --resource-group netflix-devsecops --name jenkins-vm --port 8080,8081,9000,9090,3000,9100 --priority 1001

Application Deployment Steps

Phase 1: Initial Setup and Deployment

Step 1: Connect to Azure VM

ssh azureuser@<your-azure-vm-ip>

Step 2: Clone the Repository

git clone https://github.com/Harivelu0/Netflix.git
cd Netflix

Step 3: Install Docker

sudo apt-get update
sudo apt-get install docker.io -y
sudo usermod -aG docker $USER
newgrp docker
sudo chmod 777 /var/run/docker.sock

Step 4: Build and Run with Docker

Get an API key from TMDB by creating an account and generating an API key in the settings.

# Build with your API key
docker build --build-arg TMDB_V3_API_KEY=<your-api-key> -t netflix .

# Run the container
docker run -d --name netflix -p 8081:80 netflix:latest

Access the application at: http://your-azure-vm-ip:8081

Phase 2: Security Setup

Step 1: Install SonarQube

docker run -d --name sonar -p 9000:9000 sonarqube:lts-community

Access SonarQube at: http://your-azure-vm-ip:9000 (default credentials: admin/admin)

Step 2: Install Trivy

sudo apt-get install wget apt-transport-https gnupg lsb-release -y
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
echo deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main | sudo tee -a /etc/apt/sources.list.d/trivy.list
sudo apt-get update
sudo apt-get install trivy -y

Phase 3: CI/CD Setup with Jenkins

Step 1: Install Java

sudo apt update
sudo apt install fontconfig openjdk-17-jre -y

Step 2: Install Jenkins

sudo wget -O /usr/share/keyrings/jenkins-keyring.asc \
  https://pkg.jenkins.io/debian-stable/jenkins.io-2023.key
echo deb [signed-by=/usr/share/keyrings/jenkins-keyring.asc] \
  https://pkg.jenkins.io/debian-stable binary/ | sudo tee \
  /etc/apt/sources.list.d/jenkins.list > /dev/null
sudo apt-get update
sudo apt-get install jenkins -y
sudo systemctl start jenkins
sudo systemctl enable jenkins

Access Jenkins at: http://your-azure-vm-ip:8080

Step 3: Install Required Jenkins Plugins

Install the following plugins:

Eclipse Temurin Installer
SonarQube Scanner
NodeJs Plugin
Email Extension Plugin
OWASP Dependency-Check
Docker plugins (Docker, Docker Commons, Docker Pipeline, Docker API, docker-build-step)

Step 4: Configure Jenkins Tools

Go to Manage Jenkins → Tools
Configure JDK 17 and NodeJS 16
Configure SonarQube Scanner
Configure Dependency-Check (name: "DP-Check")

Step 5: Add Docker Hub Credentials

Go to Manage Jenkins → Credentials → System → Global credentials
Add credentials:
- For Docker Hub: Use Personal Access Token (PAT) with read/write access instead of password
- For SonarQube: Create token from SonarQube admin panel

Step 6: Create Jenkins Pipeline

Create a Jenkins pipeline with the following configuration:

pipeline{
    agent any
    tools{
        jdk 'jdk17'
        nodejs 'node16'
    }
    environment {
        SCANNER_HOME=tool 'sonar-scanner'
    }
    stages {
        stage('clean workspace'){
            steps{
                cleanWs()
            }
        }
        stage('Checkout from Git'){
            steps{
                git branch: 'main', url: 'https://github.com/Harivelu0/Netflix.git'
            }
        }
        stage("Sonarqube Analysis"){
            steps{
                withSonarQubeEnv('sonar-server') {
                    sh ''' $SCANNER_HOME/bin/sonar-scanner -Dsonar.projectName=Netflix \
                    -Dsonar.projectKey=netflix '''
                }
            }
        }
        stage("quality gate"){
           steps {
                script {
                    // Added timeout to prevent getting stuck
                    timeout(time: 1, unit: 'MINUTES') {
                        // Added sleep to give SonarQube time to process
                        sleep(10)
                        waitForQualityGate abortPipeline: false, credentialsId: 'Sonar-token' 
                    }
                }
            } 
        }
        stage('Install Dependencies') {
            steps {
                sh "npm install"
            }
        }
        stage('OWASP FS SCAN') {
            steps {
                dependencyCheck additionalArguments: '--scan ./ --disableYarnAudit --disableNodeAudit', odcInstallation: 'DP-Check'
                dependencyCheckPublisher pattern: '**/dependency-check-report.xml'
            }
        }
        stage('TRIVY FS SCAN') {
            steps {
                sh "trivy fs . > trivyfs.txt"
            }
        }
        stage("Docker Build & Push"){
            steps{
                script{
                   withDockerRegistry(credentialsId: 'docker', toolName: 'docker'){   
                       sh "docker build --build-arg TMDB_V3_API_KEY=YOUR_TMDB_API_KEY -t netflix ."
                       sh "docker tag netflix harivp1234/netflix:latest"
                       sh "docker push harivp1234/netflix:latest"
                    }
                }
            }
        }
        stage("TRIVY"){
            steps{
                sh "trivy image harivp1234/netflix:latest > trivyimage.txt" 
            }
        }
        stage('Deploy to container'){
            steps{
                sh 'docker run -d --name netflix -p 8081:80 harivp1234/netflix:latest'
            }
        }
    }
    post {
        always {
            // Clean up to avoid container name conflicts on next run
            sh 'docker rm -f netflix || true'
        }
    }
}

Note: If you encounter a "docker login failed" error:

sudo su
sudo usermod -aG docker jenkins
sudo systemctl restart jenkins

Phase 4: Monitoring Setup

For monitoring, a separate Azure VM was created to host Prometheus and Grafana.

Step 1: Create Monitoring VM

az vm create \
  --resource-group netflix-devsecops \
  --name monitoring-vm \
  --image Ubuntu2204 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --size Standard_B1s

# Open ports
az vm open-port --resource-group netflix-devsecops --name monitoring-vm --port 9090,3000,9100 --priority 1001

Step 2: Install Prometheus

# Create user
sudo useradd --system --no-create-home --shell /bin/false prometheus

# Download and install Prometheus
wget https://github.com/prometheus/prometheus/releases/download/v2.47.1/prometheus-2.47.1.linux-amd64.tar.gz
tar -xvf prometheus-2.47.1.linux-amd64.tar.gz
cd prometheus-2.47.1.linux-amd64/

sudo mkdir -p /data /etc/prometheus
sudo mv prometheus promtool /usr/local/bin/
sudo mv consoles/ console_libraries/ /etc/prometheus/
sudo mv prometheus.yml /etc/prometheus/prometheus.yml
sudo chown -R prometheus:prometheus /etc/prometheus/ /data/

Configure Prometheus service:

sudo nano /etc/systemd/system/prometheus.service

Add the following content:

[Unit]
Description=Prometheus
Wants=network-online.target
After=network-online.target

StartLimitIntervalSec=500
StartLimitBurst=5

[Service]
User=prometheus
Group=prometheus
Type=simple
Restart=on-failure
RestartSec=5s
ExecStart=/usr/local/bin/prometheus \
  --config.file=/etc/prometheus/prometheus.yml \
  --storage.tsdb.path=/data \
  --web.console.templates=/etc/prometheus/consoles \
  --web.console.libraries=/etc/prometheus/console_libraries \
  --web.listen-address=0.0.0.0:9090 \
  --web.enable-lifecycle

[Install]
WantedBy=multi-user.target

Start Prometheus:

sudo systemctl enable prometheus
sudo systemctl start prometheus

Step 3: Install Node Exporter

sudo useradd --system --no-create-home --shell /bin/false node_exporter
wget https://github.com/prometheus/node_exporter/releases/download/v1.6.1/node_exporter-1.6.1.linux-amd64.tar.gz
tar -xvf node_exporter-1.6.1.linux-amd64.tar.gz
sudo mv node_exporter-1.6.1.linux-amd64/node_exporter /usr/local/bin/
rm -rf node_exporter*

Configure Node Exporter service:

sudo nano /etc/systemd/system/node_exporter.service

Add the following content:

[Unit]
Description=Node Exporter
Wants=network-online.target
After=network-online.target

StartLimitIntervalSec=500
StartLimitBurst=5

[Service]
User=node_exporter
Group=node_exporter
Type=simple
Restart=on-failure
RestartSec=5s
ExecStart=/usr/local/bin/node_exporter --collector.logind

[Install]
WantedBy=multi-user.target

Start Node Exporter:

sudo systemctl enable node_exporter
sudo systemctl start node_exporter

Step 4: Configure Prometheus to Monitor Jenkins

Update Prometheus configuration:

sudo nano /etc/prometheus/prometheus.yml

Add the following configuration:

global:
  scrape_interval: 15s

scrape_configs:
  - job_name: 'node_exporter'
    static_configs:
      - targets: ['localhost:9100']

  - job_name: 'jenkins'
    metrics_path: '/prometheus'
    static_configs:
      - targets: ['jenkins-vm-ip:8080']
      
  - job_name: 'Netflix'
    metrics_path: '/metrics'
    static_configs:
      - targets: ['jenkins-vm-ip:9100']

Reload Prometheus configuration:

curl -X POST http://localhost:9090/-/reload

Step 5: Install Grafana

sudo apt-get update
sudo apt-get install -y apt-transport-https software-properties-common
wget -q -O - https://packages.grafana.com/gpg.key | sudo apt-key add -
echo "deb https://packages.grafana.com/oss/deb stable main" | sudo tee -a /etc/apt/sources.list.d/grafana.list
sudo apt-get update
sudo apt-get -y install grafana
sudo systemctl enable grafana-server
sudo systemctl start grafana-server

Access Grafana at http://monitoring-vm-ip:3000 (default credentials: admin/admin)

Configure Grafana:

Add Prometheus as a data source (URL: http://localhost:9090)
Import dashboard templates (e.g., Node Exporter dashboard #1860)

Phase 5: Kubernetes Deployment with AKS

Step 1: Create AKS Cluster

# Install Azure CLI
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

# Login to Azure
az login

# Create AKS cluster
az aks create \
  --resource-group netflix-devsecops \
  --name netflix-cluster \
  --node-count 2 \
  --node-vm-size Standard_B2s \
  --generate-ssh-keys

# Get credentials
az aks get-credentials --resource-group netflix-devsecops --name netflix-cluster

Step 2: Install ArgoCD

Install ArgoCD on the Kubernetes cluster:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# Expose ArgoCD UI
kubectl patch svc argocd-server -n argocd -p '{"spec": {"type": "LoadBalancer"}}'

# Get ArgoCD password
kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d

Access ArgoCD UI at the LoadBalancer IP (use kubectl get svc -n argocd to find it)

Step 3: Deploy Application with ArgoCD

Create an application in ArgoCD using the UI or CLI:

kubectl apply -f - <<EOF
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: netflix-app
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/Harivelu0/Netflix.git
    targetRevision: HEAD
    path: kubernetes
  destination:
    server: https://kubernetes.default.svc
    namespace: default
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
EOF

The Kubernetes directory in the repository contains:

deployment.yaml
node-service.yaml
service.yaml

Step 4: Access the Application

To access your application running in Kubernetes, you have two options:

Using NodePort Service:

Verify the service is created with NodePort type:

kubectl get svc

If your service is exposed on port 30007 as specified in the service.yaml:

# Make sure port 30007 is open in your Azure Network Security Group
az vm open-port --resource-group netflix-devsecops --name jenkins-vm --port 30007 --priority 1002

# Get the external IP of any node in your cluster
kubectl get nodes -o wide

Access the application at: http://node-external-ip:30007

Using kubectl port-forward:

# Forward the service port to your local machine
kubectl port-forward svc/netflix-service 8081:80

Access the application at: http://localhost:8081

Verify deployment status:

# Check if pods are running
kubectl get pods

# Check logs if needed
kubectl logs <pod-name>

# Describe the service
kubectl describe svc netflix-service

You can also see the deployment status in the ArgoCD UI, which will show you the sync status and health of your application components.

Repository Structure

├── Dockerfile
├── README.md
├── Jenkinsfile
├── package.json
├── kubernetes/
│   ├── deployment.yaml
│   ├── node-service.yaml
│   └── service.yaml
└── src/
    └── [Application Source Files]

Conclusion

This project demonstrates a complete DevSecOps pipeline for deploying a Netflix clone application on Azure infrastructure. The implementation includes:

CI/CD with Jenkins
Security scanning with SonarQube, OWASP Dependency Check, and Trivy
Containerization with Docker
Orchestration with Azure Kubernetes Service
GitOps with ArgoCD
Monitoring with Prometheus and Grafana

Name		Name	Last commit message	Last commit date
Latest commit History 3 Commits
Kubernetes		Kubernetes
public		public
src		src
.dockerignore		.dockerignore
.env.example		.env.example
.gitignore		.gitignore
Dockerfile		Dockerfile
README.md		README.md
index.html		index.html
package.json		package.json
pipeline.txt		pipeline.txt
tsconfig.json		tsconfig.json
tsconfig.node.json		tsconfig.node.json
vercel.json		vercel.json
vite.config.ts		vite.config.ts

Folders and files

Latest commit

History

Repository files navigation

Netflix Clone Deployment on Azure - DevSecOps Project

Project Overview

Prerequisites

Infrastructure Setup

1. Create Azure VM

2. Configure Network Security Group

Application Deployment Steps

Phase 1: Initial Setup and Deployment

Step 1: Connect to Azure VM

Step 2: Clone the Repository

Step 3: Install Docker

Step 4: Build and Run with Docker

Phase 2: Security Setup

Step 1: Install SonarQube

Step 2: Install Trivy

Phase 3: CI/CD Setup with Jenkins

Step 1: Install Java

Step 2: Install Jenkins

Step 3: Install Required Jenkins Plugins

Step 4: Configure Jenkins Tools

Step 5: Add Docker Hub Credentials

Step 6: Create Jenkins Pipeline

Phase 4: Monitoring Setup

Step 1: Create Monitoring VM

Step 2: Install Prometheus

Step 3: Install Node Exporter

Step 4: Configure Prometheus to Monitor Jenkins

Step 5: Install Grafana

Phase 5: Kubernetes Deployment with AKS

Step 1: Create AKS Cluster

Step 2: Install ArgoCD

Step 3: Deploy Application with ArgoCD

Step 4: Access the Application

Repository Structure

Conclusion

About

Resources

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Uh oh!

Uh oh!

Contributors

Uh oh!

Languages

Packages