Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Migrate Identity Live tests deployment to Fed Auth. #42635

Draft
wants to merge 11 commits into
base: main
Choose a base branch
from
+30 −10
Draft

Migrate Identity Live tests deployment to Fed Auth. #42635

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
d4356d4
update federated auth config
g2vinay Oct 28, 2024
402c03c
update ci
g2vinay Oct 28, 2024
fc40de3
update AKS tests
g2vinay Oct 28, 2024
da2f6ee
update CI yml
g2vinay Oct 28, 2024
3cd1232
Merge branch 'main' of https://github.com/Azure/azure-sdk-for-java in…
g2vinay Oct 28, 2024
e28ac1e
update ci
g2vinay Oct 28, 2024
bd810b3
update pre ps1 to use ARM user
g2vinay Oct 28, 2024
9672d4b
update test resources ps1
g2vinay Oct 28, 2024
24df15f
add persist oidc token flow
g2vinay Oct 29, 2024
0853563
update pre ps1
g2vinay Oct 29, 2024
ff9d5e1
Merge remote-tracking branch 'upstream/main' into update-identity-liv…
g2vinay Nov 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions sdk/identity/azure-identity/src/test/java/LiveManagedIdentityTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,9 +69,9 @@ public void testManagedIdentityAksDeployment() {
//Setup Env
Configuration configuration = Configuration.getGlobalConfiguration().clone();

String spClientId = configuration.get("IDENTITY_CLIENT_ID");
String secret = configuration.get("IDENTITY_CLIENT_SECRET");
String tenantId = configuration.get("IDENTITY_TENANT_ID");
String spClientId = configuration.get("ARM_CLIENT_ID");
String oidc = configuration.get("ARM_OIDC_TOKEN");
String tenantId = configuration.get("ARM_TENANT_ID");
String resourceGroup = configuration.get("IDENTITY_RESOURCE_GROUP");
String aksCluster = configuration.get("IDENTITY_AKS_CLUSTER_NAME");
String subscriptionId = configuration.get("IDENTITY_SUBSCRIPTION_ID");
Expand All @@ -81,7 +81,7 @@ public void testManagedIdentityAksDeployment() {
String azPath = runCommand(pathCommand, "az").trim();
String kubectlPath = runCommand(pathCommand, "kubectl").trim();

runCommand(azPath, "login", "--service-principal", "-u", spClientId, "-p", secret, "--tenant", tenantId);
runCommand(azPath, "login", "--federated-token",oidc, "--service-principal", "-u", spClientId, "--tenant", tenantId);
runCommand(azPath, "account", "set", "--subscription", subscriptionId);
runCommand(azPath, "aks", "get-credentials", "--resource-group", resourceGroup, "--name", aksCluster,
"--overwrite-existing");
Expand Down
21 changes: 19 additions & 2 deletions sdk/identity/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,12 +71,29 @@ extends:
LiveTestStages:
- template: /eng/pipelines/templates/stages/archetype-sdk-tests-isolated.yml
parameters:
PreSteps:
- task: AzureCLI@2
displayName: Set OIDC variables
env:
ARM_OIDC_TOKEN: $(ARM_OIDC_TOKEN)
ARM_CLIENT_ID: $(ARM_CLIENT_ID)
ARM_TENANT_ID: $(ARM_TENANT_ID)
inputs:
azureSubscription: azure-sdk-tests
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See my other comment https://github.com/Azure/azure-sdk-for-java/pull/42635/files#r1819384979 but you should not need this PreStep and as it currently setup it will not work because we need to have the subscription match the deployment.

scriptType: pscore
scriptLocation: inlineScript
addSpnToEnvironment: true
inlineScript: |
Write-Host "##vso[task.setvariable variable=ARM_CLIENT_ID;issecret=true]$($env:servicePrincipalId)"
Write-Host "##vso[task.setvariable variable=ARM_TENANT_ID;issecret=true]$($env:tenantId)"
Write-Host "##vso[task.setvariable variable=ARM_OIDC_TOKEN;issecret=true]$($env:idToken)"
CalledFromClient: true
ServiceDirectory: identity
SupportedClouds: 'Public,UsGov,China'
UseFederatedAuth: false
EnvVars:
SYSTEM_ACCESSTOKEN: $(System.AccessToken)
ARM_OIDC_TOKEN: $(ARM_OIDC_TOKEN)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In order to get these variables I think you will need to plumb the PersistOidcToken token open similar to what @benbp is doing in js at Azure/azure-sdk-for-js#31335

Copy link
Member

@benbp benbp Oct 28, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, and we should revert usage of ARM_CLIENT_ID and ARM_TENANT_ID, since these variables are already set as IDENTITY_*_ID

ARM_CLIENT_ID: $(ARM_CLIENT_ID)
ARM_TENANT_ID: $(ARM_TENANT_ID)
CloudConfig:
Public:
SubscriptionConfigurations:
Expand Down
1 change: 0 additions & 1 deletion sdk/identity/test-resources-post.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,6 @@ $azBuildToolsRootPom = "$PSScriptRoot/../../eng/code-quality-reports/pom.xml" |
$funcAppRoot = "$PSScriptRoot/live-test-apps/identity-test-function" | Resolve-Path
$funcAppPom = "$funcAppRoot/pom.xml" | Resolve-Path

az login --service-principal -u $(getVariable('IDENTITY_CLIENT_ID')) -p $(getVariable('IDENTITY_CLIENT_SECRET')) --tenant $(getVariable('IDENTITY_TENANT_ID'))
az account set --subscription $(getVariable('IDENTITY_SUBSCRIPTION_ID'))


Expand Down
2 changes: 1 addition & 1 deletion sdk/identity/test-resources-pre.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ $sshKey = Get-Content $PSScriptRoot/sshKey.pub
$templateFileParameters['sshPubKey'] = $sshKey

# Get the max version that is not preview and then get the name of the patch version with the max value
az login --service-principal -u $TestApplicationId -p $TestApplicationSecret --tenant $TenantId
az login --service-principal -u $TestApplicationId -p $TestApplicationSecret --tenant $TenantId --allow-no-subscriptions --federated-token $env:ARM_OIDC_TOKEN
$versions = az aks get-versions -l westus -o json | ConvertFrom-Json
Write-Host "AKS versions: $($versions | ConvertTo-Json -Depth 100)"
$patchVersions = $versions.values | Where-Object { $_.isPreview -eq $null } | Select-Object -ExpandProperty patchVersions
Expand Down
Loading