Skip to content

Commit 2883294

Browse files
vidai-msftvidai-msft
authored
Migrate secrets from CI variables to KeyVault (#23451)
* Update test coverage CI with secrets retrieved from KeyVault * Update live test CI to retrieve secrets from KeyVault * Update smoke test CI to retrieve secrets from Key Vault * Add condition for keyvault template
1 parent b004bae commit 2883294

File tree

4 files changed

+79
-26
lines changed

4 files changed

+79
-26
lines changed

‎.azure-pipelines/test-coverage.yml

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,6 @@ jobs:
6060
vmImage: ${{ parameters.testPoolVMImage }}
6161

6262
steps:
63-
- template: util/get-github-pat-steps.yml
6463
- task: UseDotNet@2
6564
displayName: 'Install .NET 6.0 SDK'
6665
inputs:
@@ -115,6 +114,13 @@ jobs:
115114
filePath: ./tools/TestFx/Coverage/AnalyzeTestCoverage.ps1
116115
arguments: -CalcBaseline
117116

117+
- template: util/get-keyvault-secret-steps.yml
118+
parameters:
119+
serviceConnectionName: $(AzureSubscription)
120+
keyVaultName: $(KustoServicePrincipalKeyVaultName)
121+
secretName: $(KustoServicePrincipalSecretName)
122+
outVar: 'KustoServicePrincipalSecret'
123+
118124
- task: PowerShell@2
119125
displayName: Save Test Coverage Results
120126
condition: succeeded()
@@ -124,6 +130,8 @@ jobs:
124130
filePath: ./tools/TestFx/Coverage/SaveTestCoverageResult.ps1
125131
arguments: CITest $(KustoTenantId) $(KustoServicePrincipalId) $(KustoServicePrincipalSecret) $(KustoClusterName) $(KustoClusterRegion)
126132

133+
- template: util/get-github-pat-steps.yml
134+
127135
- task: PowerShell@2
128136
displayName: Update Test Coverage Baseline
129137
condition: succeeded()

‎.azure-pipelines/util/get-keyvault-secret-steps.yml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
parameters:
2+
- name: serviceConnectionName
3+
type: string
4+
- name: keyVaultName
5+
type: string
6+
- name: secretName
7+
type: string
8+
- name: outVar
9+
type: string
10+
default: 'KVSecret'
11+
- name: execCondition
12+
type: string
13+
default: succeeded()
14+
15+
steps:
16+
- task: AzurePowerShell@5
17+
displayName: Get Secret from Azure KeyVault
18+
condition: ${{ parameters.execCondition }}
19+
inputs:
20+
azurePowerShellVersion: LatestVersion
21+
azureSubscription: ${{ parameters.serviceConnectionName }}
22+
pwsh: true
23+
scriptType: InlineScript
24+
inline: |
25+
$secretValue = Get-AzKeyVaultSecret -VaultName ${{ parameters.keyVaultName }} -Name ${{ parameters.secretName }} -AsPlainText
26+
Write-Host "##vso[task.setvariable variable=${{ parameters.outVar }};issecret=true;isreadonly=true]$secretValue"

‎.azure-pipelines/util/live-test-steps.yml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,14 @@ jobs:
106106
filePath: ./tools/TestFx/Live/InvokeLiveTestCITask.ps1
107107
arguments: -UseWindowsPowerShell ('${{ parameters.psVersion }}' -eq '5.1') -ScriptFile './tools/TestFx/Live/InstallLiveTestAzModules.ps1 -Source $(GalleryName) -AzPackagesLocation (Join-Path -Path $(DataLocation) -ChildPath AzPreviewPackages)'
108108

109+
- template: get-keyvault-secret-steps.yml
110+
parameters:
111+
serviceConnectionName: $(LiveTestServiceConnectionName)
112+
keyVaultName: $(LiveTestServicePrincipalKeyVaultName)
113+
secretName: $(LiveTestServicePrincipalSecretName)
114+
outVar: 'LiveTestServicePrincipalSecret'
115+
execCondition: and(succeeded(), ne(variables['skipLatest'], 'true'))
116+
109117
- task: PowerShell@2
110118
displayName: Connect Azure with live test service principal
111119
condition: and(succeeded(), ne(variables['skipLatest'], 'true'))
@@ -126,6 +134,14 @@ jobs:
126134
filePath: ./tools/TestFx/Live/InvokeLiveTestCITask.ps1
127135
arguments: -UseWindowsPowerShell ('${{ parameters.psVersion }}' -eq '5.1') -ScriptFile './tools/TestFx/Live/InvokeLiveTestScenarios.ps1 -OSVersion ${{ parameters.vmImage }} -RunPlatform ${{ parameters.osType }} -RunPowerShell ${{ parameters.psVersion }}'
128136

137+
- template: get-keyvault-secret-steps.yml
138+
parameters:
139+
serviceConnectionName: $(KustoServiceConnectionName)
140+
keyVaultName: $(KustoServicePrincipalKeyVaultName)
141+
secretName: $(KustoServicePrincipalSecretName)
142+
outVar: 'KustoServicePrincipalSecret'
143+
execCondition: and(succeeded(), ne(variables['skipLatest'], 'true'))
144+
129145
- task: PowerShell@2
130146
displayName: Save live test results to Kusto
131147
condition: and(succeeded(), ne(variables['skipLatest'], 'true'), or(eq(variables['Build.Reason'], 'Schedule'), eq(variables['Build.SourceBranch'], 'refs/heads/internal/release')))

‎.azure-pipelines/util/smoke-test-steps.yml

Lines changed: 28 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
inputs:
2121
packageType: sdk
2222
version: ${{ parameters.netCoreVersion }}
23-
23+
2424
- task: PowerShell@2
2525
condition: and(succeeded(), eq('${{ parameters.psVersion }}', 'preview'))
2626
displayName: DownLoad Package for ${{ parameters.psVersion }}
@@ -37,13 +37,13 @@ jobs:
3737
*.tar.gz
3838
destinationFolder: ${{ parameters.PowerShellPath }}
3939
overwriteExistingFiles: true
40-
40+
4141
- task: PowerShell@2
4242
displayName: Prepare Powershell ${{ parameters.psVersion }}
4343
inputs:
4444
filePath: 'tools/Test/SmokeTest/PrepareRequiredPowershell.ps1'
4545
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
46-
46+
4747
- task: DownloadPipelineArtifact@2
4848
condition: and(succeeded(), eq(variables['GalleryName'], 'LocalRepo'), eq(variables['PipelineId'], ''))
4949
displayName: Download Latest Artifacts from Build Pipeline
@@ -91,7 +91,7 @@ jobs:
9191
inputs:
9292
command: custom
9393
arguments: 'install Az.Compute -directdownload -packagesavemode nupkg -source https://www.powershellgallery.com/api/v2 -OutputDirectory packages'
94-
94+
9595
- task: PowerShell@2
9696
condition: and(succeeded(), eq(variables['GalleryName'], 'LocalRepo'))
9797
displayName: 'Copy Previous Release .nupkg files to LocalRepo'
@@ -106,49 +106,53 @@ jobs:
106106
displayName: Install Az Modules from $(GalleryName)
107107
inputs:
108108
filePath: 'tools/Test/SmokeTest/ScriptsCaller.ps1'
109-
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/InstallAzModules.ps1 -Gallery $(GalleryName) -LocalRepoLocation $(LocalRepoLocation)" -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
110-
109+
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/InstallAzModules.ps1 -Gallery $(GalleryName) -LocalRepoLocation $(LocalRepoLocation)" -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
110+
111+
- template: get-keyvault-secret-steps.yml
112+
parameters:
113+
serviceConnectionName: $(ServiceConnectionName)
114+
keyVaultName: $(ServicePrincipalKeyVaultName)
115+
secretName: $(ServicePrincipalSecretName)
116+
outVar: 'ServicePrincipalSecret'
117+
111118
- task: PowerShell@2
112-
displayName: Connect AzAccount
119+
displayName: Connect AzAccount
113120
inputs:
114121
filePath: 'tools/Test/SmokeTest/ScriptsCaller.ps1'
115-
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/ConnectAzAccount.ps1 $(Password) $(ServicePrincipal) $(TenantId) $(SubscriptionId) " -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
122+
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/ConnectAzAccount.ps1 $(ServicePrincipalSecret) $(ServicePrincipal) $(TenantId) $(SubscriptionId) " -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
116123

117124
- task: PowerShell@2
118-
displayName: Run Smoke Test
125+
displayName: Run Smoke Test
119126
inputs:
120127
filePath: 'tools/Test/SmokeTest/ScriptsCaller.ps1'
121128
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/RmCoreSmokeTests.ps1 " -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
122129
failOnStderr: true
123130

124-
125131
- task: PowerShell@2
126132
displayName: 'Run Smoke Test Reversely'
127133
inputs:
128134
filePath: 'tools/Test/SmokeTest/ScriptsCaller.ps1'
129135
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/RmCoreSmokeTests.ps1 -Reverse" -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
130136
failOnStderr: true
131137

132-
133138
- task: PowerShell@2
134139
displayName: Clean Az Modules
135140
inputs:
136141
filePath: 'tools/Test/SmokeTest/ScriptsCaller.ps1'
137-
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/CleanAzModules.ps1" -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
142+
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/CleanAzModules.ps1" -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
138143

139144
- task: PowerShell@2
140145
displayName: Update Az Modules
141146
inputs:
142147
filePath: 'tools/Test/SmokeTest/ScriptsCaller.ps1'
143-
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/UpdateAzModules.ps1 -Gallery $(GalleryName) -AllowEquality $(AllowEquality) " -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
148+
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/UpdateAzModules.ps1 -Gallery $(GalleryName) -AllowEquality $(AllowEquality) " -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
144149

145150
- task: PowerShell@2
146-
displayName: Run Smoke Test
151+
displayName: Run Smoke Test
147152
inputs:
148153
filePath: 'tools/Test/SmokeTest/ScriptsCaller.ps1'
149154
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/RmCoreSmokeTests.ps1 " -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
150155
failOnStderr: true
151-
152156

153157
- task: PowerShell@2
154158
displayName: 'Run Smoke Test Reversely'
@@ -157,48 +161,47 @@ jobs:
157161
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/RmCoreSmokeTests.ps1 -Reverse " -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
158162
failOnStderr: true
159163

160-
161164
- task: PowerShell@2
162165
displayName: Clean Az Modules
163166
inputs:
164167
filePath: 'tools/Test/SmokeTest/ScriptsCaller.ps1'
165-
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/CleanAzModules.ps1" -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
166-
168+
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/CleanAzModules.ps1" -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
169+
167170
- task: PowerShell@2
168171
displayName: Install an individual module
169172
inputs:
170173
filePath: 'tools/Test/SmokeTest/ScriptsCaller.ps1'
171-
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/InstallAnIndividualModule.ps1 -Gallery $(GalleryName) " -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
174+
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/InstallAnIndividualModule.ps1 -Gallery $(GalleryName) " -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
172175

173176
- task: PowerShell@2
174177
displayName: Clean Az Modules
175178
inputs:
176179
filePath: 'tools/Test/SmokeTest/ScriptsCaller.ps1'
177-
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/CleanAzModules.ps1" -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
180+
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/CleanAzModules.ps1" -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
178181

179182
- task: PowerShell@2
180183
displayName: Update an individual module
181184
inputs:
182185
filePath: 'tools/Test/SmokeTest/ScriptsCaller.ps1'
183-
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/UpdateAnIndividualModule.ps1 -Gallery $(GalleryName) -AllowEquality $(AllowEquality) " -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
186+
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/UpdateAnIndividualModule.ps1 -Gallery $(GalleryName) -AllowEquality $(AllowEquality) " -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
184187

185188
- task: PowerShell@2
186189
displayName: Clean Az Modules
187190
inputs:
188191
filePath: 'tools/Test/SmokeTest/ScriptsCaller.ps1'
189-
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/CleanAzModules.ps1" -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
192+
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/CleanAzModules.ps1" -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
190193

191194
- task: PowerShell@2
192195
displayName: Install Az on top of an individual module
193196
inputs:
194197
filePath: 'tools/Test/SmokeTest/ScriptsCaller.ps1'
195-
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/InstallAzOnTopOfAnIndividualModule.ps1 -Gallery $(GalleryName) -AllowEquality $(AllowEquality) " -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
196-
198+
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/InstallAzOnTopOfAnIndividualModule.ps1 -Gallery $(GalleryName) -AllowEquality $(AllowEquality) " -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
199+
197200
- task: PowerShell@2
198201
displayName: Clean Az Modules
199202
inputs:
200203
filePath: 'tools/Test/SmokeTest/ScriptsCaller.ps1'
201-
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/CleanAzModules.ps1" -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
204+
arguments: '-RequiredPsVersion ${{ parameters.psVersion }} -Script "./tools/Test/SmokeTest/CleanAzModules.ps1" -PowerShellPath "${{ parameters.PowerShellPath }}" -AgentOS "$(Agent.OS)"'
202205

203206
- task: PowerShell@2
204207
displayName: Install an individual module on top of Az

0 commit comments

Comments
 (0)