Skip to content

Commit 7e9e828

Browse files
author
Sheyla Trudo
committed
fixup! Move to Resource Module
1 parent 83aa798 commit 7e9e828

File tree

3 files changed

+100
-75
lines changed

3 files changed

+100
-75
lines changed

‎.pipelines/templates/artifact-storage.steps.yaml‎

Lines changed: 63 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -84,68 +84,6 @@ steps:
8484
INFRA_RG_LENGTH: $(OUT_RESULT_LENGTH)
8585

8686

87-
## Managed Identity ##
88-
89-
- template: get-resources.steps.yaml
90-
parameters:
91-
resourceType: managedidentity
92-
serviceConnection: $(ACN_TEST_SERVICE_CONNECTION)
93-
inputs:
94-
resourceGroupName: $(resourcegroups.ACNCI_BUILD_RESOURCEGROUP)
95-
buildTagDefinitionIdKey: $(ACNCI_BUILDTAG_DEFINITIONID)
96-
buildTagCreatedByAppIdKey: $(ACNCI_BUILDTAG_CREATEDBYAPPID)
97-
98-
- template: create-or-update-resource.steps.yaml
99-
parameters:
100-
serviceConnection: $(ACN_TEST_SERVICE_CONNECTION)
101-
resourceType: managedidentity
102-
refreshAfterCreation: True
103-
createCondition: |
104-
and(succeeded(),
105-
or(not(variables.OUT_RESULT_LENGTH),
106-
eq(variables.OUT_RESULT_LENGTH, 'null'),
107-
lt(variables.OUT_RESULT_LENGTH, 1)))
108-
updateCondition: False
109-
inputs:
110-
managedIdentityList: $(OUT_RESULT)
111-
managedIdentityCount: $(OUT_RESULT_LENGTH)
112-
managedIdentityName: '$(ACNCI_MANAGEDIDENTITY_PREFIX)$(LOCAL_ACNCI_UNIQUE_ID)-$(resourcegroups.ACNCI_BUILD_RESOURCEGROUP_LOCATION)'
113-
managedIdentityLocation: $(resourcegroups.ACNCI_BUILD_RESOURCEGROUP_LOCATION)
114-
resourceGroupName: $(resourcegroups.ACNCI_BUILD_RESOURCEGROUP)
115-
buildTagDefinitionIdKey: $(ACNCI_BUILDTAG_DEFINITIONID)
116-
buildTagCreatedByAppIdKey: $(ACNCI_BUILDTAG_CREATEDBYAPPID)
117-
buildTagCreatedByBuildIdKey: $(ACNCI_BUILDTAG_CREATEDBYBUILDID)
118-
119-
- task: AzureCLI@2
120-
name: managedidentity
121-
displayName: "[Output] Build User ManagedIdentity Details"
122-
inputs:
123-
azureSubscription: $(ACN_TEST_SERVICE_CONNECTION)
124-
scriptType: bash
125-
scriptLocation: inlineScript
126-
addSpnToEnvironment: true
127-
inlineScript: |
128-
set -e
129-
[[ -n $SYSTEM_DEBUG ]] && [[ $SYSTEM_DEBUG =~ $IS_TRUE ]] && set -x || set +x
130-
131-
# Select MI to use
132-
RANDOM_SELECT=`tr -dc '1-9' < /dev/urandom | head -c${1:-7}`
133-
IDX=$(( "$RANDOM_SELECT" % "$MI_LIST_LENGTH" ))
134-
MI_DATA=$(echo "$MI_LIST" | jq --argjson IDX "$IDX" -rc '.[$IDX]')
135-
136-
MI_ID=$(echo "$MI_DATA" | jq -r '.id')
137-
echo >&2 "##vso[task.setvariable variable=ACNCI_MANAGEDIDENTITY_ID;isoutput=true]$MI_ID"
138-
MI_PRINCIPALID=$(echo "$MI_DATA" | jq -r '.principalId')
139-
echo >&2 "##vso[task.setvariable variable=ACNCI_MANAGEDIDENTITY_OBJECTID;isoutput=true]$MI_PRINCIPALID"
140-
MI_APPID=$(echo "$MI_DATA" | jq -r '.clientId')
141-
echo >&2 "##vso[task.setvariable variable=ACNCI_MANAGEDIDENTITY_APPID;isoutput=true]$MI_APPID"
142-
MI_NAME=$(echo "$MI_DATA" | jq -r '.name')
143-
echo >&2 "##vso[task.setvariable variable=ACNCI_MANAGEDIDENTITY_NAME;isoutput=true]$MI_NAME"
144-
env:
145-
ACNCI_BUILD_RESOURCEGROUP: $(resourcegroups.ACNCI_BUILD_RESOURCEGROUP)
146-
MI_LIST: $(OUT_RESULT)
147-
MI_LIST_LENGTH: $(OUT_RESULT_LENGTH)
148-
14987
## MI Service Connection
15088

15189
#- template: get-resources.steps.yaml
@@ -358,6 +296,7 @@ steps:
358296
# - Local Use Only -
359297
# SA Object
360298
echo >&2 "##vso[task.setvariable variable=ACNCI_STORAGEACCOUNT]$SA_DATA"
299+
echo $SA_DATA
361300
else
362301
echo >&2 "##[error]No storage accounts available for use."
363302
exit 1
@@ -398,6 +337,68 @@ steps:
398337
STORAGEACCOUNT_NAME: $(artifact_storage.ACNCI_STORAGEACCOUNT_NAME)
399338
STORAGECONTAINER_NAME: $(artifact_storage.ACNCI_STORAGEACCOUNT_CONTAINER_NAME)
400339

340+
## Managed Identity ##
341+
342+
- template: get-resources.steps.yaml
343+
parameters:
344+
resourceType: managedidentity
345+
serviceConnection: $(ACN_TEST_SERVICE_CONNECTION)
346+
inputs:
347+
resourceGroupName: $(resourcegroups.ACNCI_BUILD_RESOURCEGROUP)
348+
buildTagDefinitionIdKey: $(ACNCI_BUILDTAG_DEFINITIONID)
349+
buildTagCreatedByAppIdKey: $(ACNCI_BUILDTAG_CREATEDBYAPPID)
350+
351+
- template: create-or-update-resource.steps.yaml
352+
parameters:
353+
serviceConnection: $(ACN_TEST_SERVICE_CONNECTION)
354+
resourceType: managedidentity
355+
refreshAfterCreation: True
356+
createCondition: |
357+
and(succeeded(),
358+
or(not(variables.OUT_RESULT_LENGTH),
359+
eq(variables.OUT_RESULT_LENGTH, 'null'),
360+
lt(variables.OUT_RESULT_LENGTH, 1)))
361+
updateCondition: False
362+
inputs:
363+
managedIdentityList: $(OUT_RESULT)
364+
managedIdentityCount: $(OUT_RESULT_LENGTH)
365+
managedIdentityName: '$(ACNCI_MANAGEDIDENTITY_PREFIX)$(LOCAL_ACNCI_UNIQUE_ID)-$(resourcegroups.ACNCI_BUILD_RESOURCEGROUP_LOCATION)'
366+
managedIdentityLocation: $(resourcegroups.ACNCI_BUILD_RESOURCEGROUP_LOCATION)
367+
resourceGroupName: $(resourcegroups.ACNCI_BUILD_RESOURCEGROUP)
368+
buildTagDefinitionIdKey: $(ACNCI_BUILDTAG_DEFINITIONID)
369+
buildTagCreatedByAppIdKey: $(ACNCI_BUILDTAG_CREATEDBYAPPID)
370+
buildTagCreatedByBuildIdKey: $(ACNCI_BUILDTAG_CREATEDBYBUILDID)
371+
372+
- task: AzureCLI@2
373+
name: managedidentity
374+
displayName: "[Output] Build User ManagedIdentity Details"
375+
inputs:
376+
azureSubscription: $(ACN_TEST_SERVICE_CONNECTION)
377+
scriptType: bash
378+
scriptLocation: inlineScript
379+
addSpnToEnvironment: true
380+
inlineScript: |
381+
set -e
382+
[[ -n $SYSTEM_DEBUG ]] && [[ $SYSTEM_DEBUG =~ $IS_TRUE ]] && set -x || set +x
383+
384+
# Select MI to use
385+
RANDOM_SELECT=`tr -dc '1-9' < /dev/urandom | head -c${1:-7}`
386+
IDX=$(( "$RANDOM_SELECT" % "$MI_LIST_LENGTH" ))
387+
MI_DATA=$(echo "$MI_LIST" | jq --argjson IDX "$IDX" -rc '.[$IDX]')
388+
389+
MI_ID=$(echo "$MI_DATA" | jq -r '.id')
390+
echo >&2 "##vso[task.setvariable variable=ACNCI_MANAGEDIDENTITY_ID;isoutput=true]$MI_ID"
391+
MI_PRINCIPALID=$(echo "$MI_DATA" | jq -r '.principalId')
392+
echo >&2 "##vso[task.setvariable variable=ACNCI_MANAGEDIDENTITY_OBJECTID;isoutput=true]$MI_PRINCIPALID"
393+
MI_APPID=$(echo "$MI_DATA" | jq -r '.clientId')
394+
echo >&2 "##vso[task.setvariable variable=ACNCI_MANAGEDIDENTITY_APPID;isoutput=true]$MI_APPID"
395+
MI_NAME=$(echo "$MI_DATA" | jq -r '.name')
396+
echo >&2 "##vso[task.setvariable variable=ACNCI_MANAGEDIDENTITY_NAME;isoutput=true]$MI_NAME"
397+
env:
398+
ACNCI_BUILD_RESOURCEGROUP: $(resourcegroups.ACNCI_BUILD_RESOURCEGROUP)
399+
MI_LIST: $(OUT_RESULT)
400+
MI_LIST_LENGTH: $(OUT_RESULT_LENGTH)
401+
401402
- task: AzureCLI@2
402403
displayName: "[Provision] Build User Access Permissions"
403404
continueOnError: true

‎.pipelines/templates/create-or-update-resource.steps.yaml‎

Lines changed: 23 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -90,9 +90,9 @@ steps:
9090
9191
az role assignment create \
9292
--role "$ROLE_NAME" \
93-
--assignee-object-id "$MANAGEDIDENTITY_OBJECTID" \
94-
--assignee-principal-type ServicePrincipal \
95-
--scope "$RESOURCEGROUP_ID"
93+
--assignee "$MANAGEDIDENTITY_NAME" \
94+
--resource-group "$RESOURCEGROUP_NAME" \
95+
--scope "$MI_SCOPE"
9696

9797
${{ elseif eq(parameters.resourceType, 'resourcegroups') }}:
9898
inlineScript: |
@@ -200,6 +200,8 @@ steps:
200200
MANAGEDIDENTITY_NAME: ${{ parameters.inputs.managedIdentityName }}
201201
MANAGEDIDENTITY_FEDCRED_NAME: ${{ parameters.inputs.managedIdentityName }}-cred
202202

203+
204+
203205
inputs:
204206
azureSubscription: ${{ parameters.serviceConnection }}
205207
scriptType: bash
@@ -213,6 +215,11 @@ steps:
213215
214216
az role definition update --role-definition "$ROLEDEFINITION_JSON"
215217
218+
${{ elseif eq(parameters.resourceType, 'roleassignments') }}:
219+
inlineScript: |
220+
set -e
221+
[[ -n $SYSTEM_DEBUG ]] && [[ $SYSTEM_DEBUG =~ $IS_TRUE ]] && set -x || set +x
222+
216223
${{ elseif eq(parameters.resourceType, 'storageaccounts') }}:
217224
inlineScript: |
218225
set -e
@@ -228,11 +235,17 @@ steps:
228235
set -e
229236
[[ -n $SYSTEM_DEBUG ]] && [[ $SYSTEM_DEBUG =~ $IS_TRUE ]] && set -x || set +x
230237
231-
FEDCRED_DETAILS=$(az identity federated-credential create \
232-
--name "$MANAGEDIDENTITY_FEDCRED_NAME" \
233-
--identity-name "$MANAGEDIDENTITY_NAME" \
238+
az role assignment update \
239+
--role "$ROLE_NAME" \
240+
--assignee "$MANAGEDIDENTITY_NAME" \
234241
--resource-group "$RESOURCEGROUP_NAME" \
235-
--issuer "https://VisualStudio/SPN" \
236-
--subject "user_impersonation" \
237-
--audience "api://AzureADMyOrg")
238-
echo $FEDCRED_DETAILS
242+
--scope "$MI_SCOPE"
243+
244+
#FEDCRED_DETAILS=$(az identity federated-credential create \
245+
#--name "$MANAGEDIDENTITY_FEDCRED_NAME" \
246+
#--identity-name "$MANAGEDIDENTITY_NAME" \
247+
#--resource-group "$RESOURCEGROUP_NAME" \
248+
#--issuer "https://VisualStudio/SPN" \
249+
#--subject "user_impersonation" \
250+
#--audience "api://AzureADMyOrg")
251+
#echo $FEDCRED_DETAILS

‎.pipelines/templates/get-resources.steps.yaml‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,11 @@ steps:
3535
ROLEDEFINITION_FILEPATH: ${{ parameters.inputs.roleDefinitionFileLocation }}
3636

3737
${{ elseif eq(parameters.resourceType, 'roleassignments') }}:
38-
MANAGEDIDENTITY_OBJECTID: ${{ parameters.inputs.managedIdentityObjectId }}
38+
#MANAGEDIDENTITY_OBJECTID: ${{ parameters.inputs.managedIdentityObjectId }}
39+
#RESOURCEGROUP_NAME: ${{ parameters.inputs.resourceGroupName }}
40+
#ROLE_NAME: ${{ parameters.inputs.roleName }}
41+
MANAGEDIDENTITY_NAME: ${{ parameters.inputs.managedIdentityObjectId }}
42+
MANAGEDIDENTITY_SCOPE: ${{ parameters.inputs.scope }}
3943
RESOURCEGROUP_NAME: ${{ parameters.inputs.resourceGroupName }}
4044
ROLE_NAME: ${{ parameters.inputs.roleName }}
4145

@@ -94,12 +98,19 @@ steps:
9498
set -e
9599
[[ -n $SYSTEM_DEBUG ]] && [[ $SYSTEM_DEBUG =~ $IS_TRUE ]] && set -x || set +x
96100
97-
R_QUERY="[? principalId == '$MANAGEDIDENTITY_OBJECTID' ]"
98101
MI_ROLE_DATA=$(az role assignment list \
99102
--role "$ROLE_NAME" \
103+
--assignee "$MANAGEDIDENTITY_NAME" \
100104
--resource-group "$RESOURCEGROUP_NAME" \
101-
--query "$R_QUERY" \
105+
--scope "$MI_SCOPE" \
102106
--output json | jq -rc '.')
107+
echo $MI_ROLE_DATA
108+
#R_QUERY="[? name == '$MANAGEDIDENTITY_OBJECTID' ]"
109+
#MI_ROLE_DATA=$(az role assignment list \
110+
# --role "$ROLE_NAME" \
111+
# --resource-group "$RESOURCEGROUP_NAME" \
112+
# --query "$R_QUERY" \
113+
# --output json | jq -rc '.')
103114
MI_ROLE_DATA_LENGTH=$(echo "$MI_ROLE_DATA" | jq length)
104115

105116
echo >&2 "##vso[task.setvariable variable=${VAR_NAME};]$MI_ROLE_DATA"

0 commit comments

Comments
 (0)