Exploit for hays-london-azure-platform-2-poc

## https://sploitus.com/exploit?id=C1954BF6-339D-53A6-8F5A-4D5505BDA55B
# Hays London Azure Platform Engineer POC — AKS Operations & Platform Engineering

[![CI/CD Pipeline](https://github.com/saikirangvariganti/hays-london-azure-platform-2-poc/actions/workflows/aks_deploy.yml/badge.svg)](https://github.com/saikirangvariganti/hays-london-azure-platform-2-poc/actions/workflows/aks_deploy.yml)

## Overview

This proof-of-concept demonstrates end-to-end Azure Platform Engineering capabilities aligned with the Hays Specialist Recruitment Azure Platform Engineer role. It covers AKS cluster operations, GitOps with ArgoCD, Terraform IaC, Azure security (Key Vault CMK, Defender for Cloud, RBAC), and full observability with Azure Monitor, Log Analytics, and Grafana.

**Author:** Sai Kiran Goud Variganti
**GitHub:** [saikirangvariganti](https://github.com/saikirangvariganti)
**Role Target:** Azure Platform Engineer — Hays Specialist Recruitment (London)

---

## Architecture

```
┌──────────────────────────────────────────────────────────────────┐
│                        Azure Subscription                        │
│                                                                  │
│  ┌─────────────────────────────────────────────────────────────┐ │
│  │                    Resource Group: rg-platform              │ │
│  │                                                             │ │
│  │  ┌──────────────┐   ┌──────────────┐   ┌────────────────┐  │ │
│  │  │  AKS Cluster │   │    ACR       │   │   Key Vault    │  │ │
│  │  │  (prod-aks)  │◄──│  (prodacr)  │   │  (CMK + RBAC)  │  │ │
│  │  └──────┬───────┘   └──────────────┘   └────────────────┘  │ │
│  │         │                                                   │ │
│  │  ┌──────▼───────┐   ┌──────────────┐   ┌────────────────┐  │ │
│  │  │  ArgoCD      │   │ App Gateway  │   │ Azure Monitor  │  │ │
│  │  │  (GitOps)    │   │  (Ingress)   │   │  + Log Anal.   │  │ │
│  │  └──────────────┘   └──────────────┘   └────────────────┘  │ │
│  │                                                             │ │
│  │  ┌──────────────┐   ┌──────────────┐   ┌────────────────┐  │ │
│  │  │   VNet       │   │  Defender    │   │    Grafana     │  │ │
│  │  │  (10.0.0.0)  │   │  for Cloud   │   │  Dashboards    │  │ │
│  │  └──────────────┘   └──────────────┘   └────────────────┘  │ │
│  └─────────────────────────────────────────────────────────────┘ │
└──────────────────────────────────────────────────────────────────┘
```

---

## Key Capabilities Demonstrated

### 1. AKS Operations
- **Cluster management** with system and user node pools
- **Horizontal Pod Autoscaler (HPA)** configured for CPU/memory thresholds
- **Network Policies** enforcing pod-to-pod communication rules
- **ArgoCD GitOps** — declarative continuous delivery
- **Helm charts** for application packaging and versioning

### 2. Terraform IaC
- Modular Terraform: `aks`, `acr`, `networking`, `security` modules
- Azure Provider v3.x with remote state in Azure Storage
- Variables and outputs for reusable, environment-agnostic deployments

### 3. Azure Security
- **Key Vault CMK** — Customer-Managed Keys for AKS disk encryption
- **Azure Policy** — enforce tagging, restrict SKUs, require HTTPS
- **Defender for Cloud** — threat detection on AKS and ACR
- **RBAC** — least-privilege role assignments

### 4. CI/CD Pipelines
- **GitHub Actions** — build, scan, push to ACR, deploy via ArgoCD
- Multi-stage pipeline: lint → security scan → build → push → deploy → verify

### 5. Observability
- **Azure Monitor** + **Log Analytics** workspace
- **Prometheus** alert rules for pod failures, node pressure, HPA saturation
- **Grafana** dashboard — cluster health, request rate, error budget
- **KQL queries** — pod restart analysis, node memory pressure, slow queries

### 6. Incident Response
- `incident_response.py` — automated triage, escalation, evidence collection
- `cluster_health_check.py` — pre-on-call health sweep
- **AKS Incident Runbook** — step-by-step SRE playbook

---

## Project Structure

```
hays-london-azure-platform-2-poc/
├── README.md                        # This file
├── requirements.txt                 # Python dependencies
├── terraform/                       # Terraform IaC
│   ├── main.tf                      # Root module — providers, backend, calls
│   ├── variables.tf                 # Input variables
│   ├── outputs.tf                   # Output values
│   └── modules/
│       ├── aks/main.tf              # AKS cluster module
│       ├── aks/variables.tf         # AKS module variables
│       ├── acr/main.tf              # Azure Container Registry module
│       ├── networking/main.tf       # VNet, subnets, NSG
│       └── security/main.tf         # Key Vault, RBAC, Defender
├── k8s/                             # Kubernetes manifests
│   ├── namespace.yaml               # platform-apps namespace
│   ├── deployment.yaml              # App deployment with resource limits
│   ├── service.yaml                 # ClusterIP + LoadBalancer service
│   ├── hpa.yaml                     # Horizontal Pod Autoscaler
│   └── network_policy.yaml          # Network isolation policies
├── helm/app-chart/                  # Helm chart
│   ├── Chart.yaml                   # Chart metadata
│   └── values.yaml                  # Default values
├── argocd/
│   └── application.yaml             # ArgoCD Application manifest
├── scripts/
│   ├── incident_response.py         # Incident triage automation
│   └── cluster_health_check.py      # Cluster health sweep
├── monitoring/
│   ├── prometheus_rules.yaml        # Alert rules
│   ├── grafana_dashboard.json       # Grafana dashboard definition
│   └── log_analytics_queries.kql   # KQL queries for Log Analytics
├── runbooks/
│   └── aks_incident_runbook.md     # SRE incident playbook
├── .github/workflows/
│   └── aks_deploy.yml               # GitHub Actions CI/CD pipeline
└── tests/
    └── test_poc.py                  # 90+ validation tests
```

---

## Quick Start

### Prerequisites
- Terraform >= 1.5
- Azure CLI >= 2.50
- kubectl >= 1.28
- Helm >= 3.12
- ArgoCD CLI >= 2.8
- Python 3.11+

### Deploy Infrastructure
```bash
cd terraform
terraform init
terraform plan -var-file=environments/prod.tfvars
terraform apply -auto-approve
```

### Deploy Application via ArgoCD
```bash
# Install ArgoCD
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# Apply application manifest
kubectl apply -f argocd/application.yaml
```

### Run Tests
```bash
pip install -r requirements.txt
python -m pytest tests/test_poc.py -v
```

---

## Certifications & Alignment

| Certification | Relevance to This POC |
|---|---|
| AZ-104 (Azure Administrator) | AKS, VNet, Key Vault, RBAC configuration |
| AZ-305 (Azure Solutions Architect) | Modular Terraform, multi-layer security |
| AZ-400 (Azure DevOps Expert) | GitHub Actions pipeline, ArgoCD GitOps |

---

## Security Posture

- All container images scanned with Trivy before push
- AKS uses managed identity (no service principal credentials)
- Key Vault CMK for disk encryption at rest
- Network policies enforce namespace isolation
- Defender for Cloud plan enabled on AKS and ACR
- RBAC — no cluster-admin bindings in application namespaces