azure-az-patch-resource.ps1

<#
.SYNOPSIS
    powershell script to update (patch) existing azure arm template resource settings similar to resources.azure.com

.LINK
    [net.servicePointManager]::Expect100Continue = $true;[net.servicePointManager]::SecurityProtocol = [net.SecurityProtocolType]::Tls12;
    invoke-webRequest "https://raw.githubusercontent.com/jagilber/powershellScripts/master/azure-az-patch-resource.ps1" -outFile "$pwd\azure-az-patch-resource.ps1";
    .\azure-az-patch-resource.ps1 -resourceGroupName {{ resource group name }} -resourceName {{ resource name }} [-patch]

.DESCRIPTION  
    powershell script to update (patch) existing azure arm template resource settings similar to resources.azure.com.
    useful for environments where resources.azure.com is not an option.
    PRECAUTION: when script queries the arm resources, if unable to determine configured api version, 
     the latest api version for that resource will be written to the template.json.

.NOTES  
    File Name  : azure-az-patch-resource.ps1
    Author     : jagilber
    Version    : 230806
    History    :    add ordered

.EXAMPLE 
    .\azure-az-patch-resource.ps1 -resourceGroupName clusterresourcegroup
    enumerate all resources in resource group 'clusteresourcegroup' and generate template.json

.EXAMPLE 
    .\azure-az-patch-resource.ps1 -resourceGroupName clusterresourcegroup -patch
    patch all resources in resource group 'clusteresourcegroup' using existing template.json

.EXAMPLE 
    .\azure-az-patch-resource.ps1 -resourceGroupName clusterresourcegroup -resource nt0
    enumerate resource named 'nt0' in resource group 'clusteresourcegroup' and generate template.json

.EXAMPLE 
    .\azure-az-patch-resource.ps1 -resourceGroupName clusterresourcegroup -resource nt0 -patch
    patch all resource named 'nt0' in resource group 'clusteresourcegroup' using existing template.json

.EXAMPLE 
    .\azure-az-patch-resource.ps1 -resourceGroupName clusterresourcegroup -templatejsonfile clusterresourcegroup.json
    enumerate all resources in resource group 'clusteresourcegroup' and generate clusterresourcegroup.json

.EXAMPLE 
    .\azure-az-patch-resource.ps1 -resourceGroupName clusterresourcegroup -patch -templatejsonfile clusterresourcegroup.json
    patch all resources in resource group 'clusteresourcegroup' using existing clusterresourcegroup.json
#>

[cmdletbinding()]
param (
    [string]$resourceGroupName = '',
    [string[]]$resourceNames = '',
    [string[]]$excludeResourceNames = '',
    [switch]$patch,
    [string]$templateJsonFile = "$psscriptroot/template.json", 
    [string]$templateParameterFile = '', 
    [string]$apiVersion = '' ,
    [string]$schema = 'https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json',
    [int]$sleepSeconds = 1, 
    [ValidateSet('Incremental', 'Complete')]
    [string]$mode = 'Incremental',
    [switch]$useLatestApiVersion,
    [switch]$pre,
    [switch]$detail
)

set-strictMode -Version 3.0
$global:resourceTemplateObj = @{ }
$global:resourceErrors = 0
$global:resourceWarnings = 0
$global:configuredRGResources = [collections.arraylist]::new()
$env:SuppressAzurePowerShellBreakingChangeWarnings = $true
$PSModuleAutoLoadingPreference = 2
$currentErrorActionPreference = $ErrorActionPreference
$currentVerbosePreference = $VerbosePreference
$debugLevel = 'none'

function main () {
    write-host "starting"
    if ($detail) {
        $ErrorActionPreference = 'continue'
        $VerbosePreference = 'continue'
        $debugLevel = 'all'
    }

    if (!(check-module)) {
        return
    }
    
    if (!(@(Get-AzResourceGroup).Count)) {
        write-host "connecting to azure"
        Connect-AzAccount
    }

    if (!(Get-AzContext)) {
        write-host "connecting to azure"
        Connect-AzAccount
    }

    $global:startTime = get-date

    if (!$resourceGroupName -or !$templateJsonFile) {
        write-error 'specify resourceGroupName'
        return
    }

    if ($resourceNames) {
        foreach ($resourceName in $resourceNames) {
            write-host "getting resource $resourceName"
            $resource = @((get-azresource -ResourceGroupName $resourceGroupName -resourceName $resourceName))
            if ($resource) {
                $global:configuredRGResources.AddRange($resource)
            }
            else {
                write-error "resource not found: $resourceName"
            }
        }
    }
    else {
        write-host "getting resource group resource ids $resourceGroupName"
        $resources = @((get-azresource -ResourceGroupName $resourceGroupName))
        $global:configuredRGResources.AddRange($resources)
    }

    if ($excludeResourceNames) {
        #$resources = $resources | where-object Name -NotMatch "$($excludeResourceNames -join "|")"
        $global:configuredRGResources = $global:configuredRGResources.clone() | where-object Name -NotMatch "$($excludeResourceNames -join "|")"
    }

    display-settings -resources $global:configuredRGResources

    if ($global:configuredRGResources.count -lt 1) {
        Write-Warning "error enumerating resource $($error | format-list * | out-string)"
        return
    }

    $deploymentName = "$resourceGroupName-$((get-date).ToString("yyyyMMdd-HHmms"))"

    if ($patch) {
        remove-jobs
        if (!(deploy-template)) { return }
        wait-jobs
    }
    else {
        export-template -configuredResources $global:configuredRGResources
        write-host "template exported to $templateJsonFile" -ForegroundColor Yellow
        write-host "to update arm resource, modify $templateJsonFile.  when finished, execute script with -patch to update resource" -ForegroundColor Yellow

        $error.clear()
        code $templateJsonFile
        if ($error) {
            . $templateJsonFile
        }
    }

    if ($global:resourceErrors -or $global:resourceWarnings) {
        write-warning "deployment may not have been successful: errors: $global:resourceErrors warnings: $global:resourceWarnings"

        if ($DebugPreference -ieq 'continue') {
            write-host "errors: $($error | sort-object -Descending | out-string)"
        }
    }

    write-host "Get-AzResourceGroupDeployment -ResourceGroupName $resourceGroupName -Name $deploymentName -ErrorAction silentlycontinue"
    $deployment = Get-AzResourceGroupDeployment -ResourceGroupName $resourceGroupName -Name $deploymentName -ErrorAction silentlycontinue

    if ($deployment) {
        write-host "deployment:`r`n$($deployment | format-list * | out-string)"
    }

    Write-Progress -Completed -Activity "complete"
    write-host "time elapsed:  $(((get-date) - $global:startTime).TotalMinutes.ToString("0.0")) minutes`r`n"
    write-host 'finished. template stored in $global:resourceTemplateObj' -ForegroundColor Cyan
}

function check-module() {
    $error.clear()
    get-command Connect-AzAccount -ErrorAction SilentlyContinue
    
    if ($error) {
        $error.clear()
        write-warning "azure module for Connect-AzAccount not installed."

        if ((read-host "is it ok to install latest azure az module?[y|n]") -imatch "y") {
            $error.clear()
            install-module az.accounts
            install-module az.resources

            import-module az.accounts
            import-module az.resources
        }
        else {
            return $false
        }

        if ($error) {
            return $false
        }
    }

    return $true
}

function create-jsonTemplate([collections.arraylist]$resources, 
    [string]$jsonFile, 
    [hashtable]$parameters = @{},
    [hashtable]$variables = @{},
    [hashtable]$outputs = @{}
) {
    try {
        $resourceTemplate = [ordered]@{ 
            '$schema'      = $schema
            contentVersion = "1.0.0.0"
            parameters     = $parameters
            variables      = $variables
            resources      = $resources
            outputs        = $outputs
        } | convertto-json -depth 99

        $resourceTemplate | out-file $jsonFile
        write-host $resourceTemplate -ForegroundColor Cyan
        $global:resourceTemplateObj = $resourceTemplate | convertfrom-json
        return $true
    }
    catch { 
        write-error "$($_)`r`n$($error | out-string)"
        return $false
    }
}

function deploy-template() {
    $templateParameters = @{}
    $parameters = @{}
    $variables = @{}
    $outputs = @{}
    
    $json = get-content -raw $templateJsonFile | convertfrom-json
    
    if (!$json -or !$json.resources) {
        write-error "invalid template file $templateJsonFile"
        return
    }

    if ((test-path $templateParameterFile)) {
        $jsonParameters = get-content -raw $templateParameterFile | convertfrom-json
        # convert pscustom object to hashtable
        foreach ($jsonParameter in $jsonParameters.parameters.psobject.properties) {
            $templateParameters.Add($jsonParameter.name, $jsonParameter.value.value)
        }
    }

    $templateJsonFile = Resolve-Path $templateJsonFile
    $tempJsonFile = "$([io.path]::GetDirectoryName($templateJsonFile))\$([io.path]::GetFileNameWithoutExtension($templateJsonFile)).temp.json"
    $resources = @($json.resources)

    foreach ($jsonParameter in $json.parameters.psobject.properties) {
        $parameters.Add($jsonParameter.name, $jsonParameter.value)
    }
    
    foreach ($jsonParameter in $json.variables.psobject.properties) {
        $variables.Add($jsonParameter.name, $jsonParameter.value)
    }

    foreach ($jsonParameter in $json.outputs.psobject.properties) {
        $outputs.Add($jsonParameter.name, $jsonParameter.value)
    }

    # remove provisioningstate as it is not a valid property for deploy and will cause validation error if state is not equal to current state
    foreach ($resource in $resources) {
        $resourceProperties = $resource.properties.psobject.properties
        foreach ($resourceProperty in $resourceProperties) {
            if ($resourceProperty.Name -ieq 'provisioningState') {
                $resourceProperty.Value = $null
                write-host "removing provisioningState from resource: $($resource.id)" -ForegroundColor Yellow
                continue
            }
        }
    }

    create-jsonTemplate -resources $resources -jsonFile $tempJsonFile -parameters $parameters -variables $variables -outputs $outputs | Out-Null

    $error.Clear()
    write-host "validating template: Test-AzResourceGroupDeployment -ResourceGroupName $resourceGroupName ``
        -TemplateFile $tempJsonFile ``
        -Verbose:$detail ``
        -TemplateParameterObject $templateParameters ``
        -Debug:$detail ``
        -Mode $mode" -ForegroundColor Cyan

    $result = Test-AzResourceGroupDeployment -ResourceGroupName $resourceGroupName `
        -TemplateFile $tempJsonFile `
        -Verbose:$detail `
        -TemplateParameterObject $templateParameters `
        -Debug:$detail `
        -Mode $mode

    if (!$error -and !$result) {
        write-host "patching resource with $tempJsonFile" -ForegroundColor Yellow
        start-job -ScriptBlock {
            param ($resourceGroupName, $tempJsonFile, $deploymentName, $mode, $debugLevel, $detail, $templateParameters)
            if ($detail) {
                $VerbosePreference = 'continue'
            }

            write-host "using file: $tempJsonFile"
            write-host "deploying template: New-AzResourceGroupDeployment -Name $deploymentName ``
                -ResourceGroupName $resourceGroupName ``
                -DeploymentDebugLogLevel $debuglevel ``
                -TemplateFile $tempJsonFile ``
                -TemplateParameterObject $templateParameters ``
                -Verbose:$detail ``
                -Mode $mode" -ForegroundColor Cyan

            New-AzResourceGroupDeployment -Name $deploymentName `
                -ResourceGroupName $resourceGroupName `
                -DeploymentDebugLogLevel $debugLevel `
                -TemplateFile $tempJsonFile `
                -TemplateParameterObject $templateParameters `
                -Verbose:$detail `
                -Mode $mode
        } -ArgumentList $resourceGroupName, $tempJsonFile, $deploymentName, $mode, $debugLevel, $detail, $templateParameters
    }
    else {
        write-host "template validation failed: $($error |out-string) $($result | out-string)"
        write-error "template validation failed`r`n$($error | convertto-json)`r`n$($result | convertto-json)"
        return $false
    }

    if ($error) {
        return $false
    }
    else {
        return $true
    }
}

function display-settings($resources) {
    $settings = @()
    foreach ($resource in $resources) {
        $settings += $resource | convertto-json -depth 99
    }
    write-host "current settings: `r`n $settings" -ForegroundColor Green
}

function export-template($configuredResources) {
    write-host "exporting template to $templateJsonFile" -ForegroundColor Yellow
    $resources = [collections.arraylist]@()
    $azResourceGroupLocation = @($configuredResources)[0].Location
    
    write-host "getting latest api versions" -ForegroundColor yellow
    $resourceProviders = Get-AzResourceProvider -Location $azResourceGroupLocation -Pre:$pre

    write-host "getting configured api versions" -ForegroundColor green
    Export-AzResourceGroup -ResourceGroupName $resourceGroupName -Path $templateJsonFile -Force
    $currentConfig = Get-Content -raw $templateJsonFile | convertfrom-json
    $currentApiVersions = $currentConfig.resources | select-object type, apiversion | sort-object -Unique type
    write-host ($currentApiVersions | format-list * | out-string)
    remove-item $templateJsonFile -Force
    
    
    foreach ($azResource in $configuredResources) {
        write-verbose "azresource by id: $($azResource | format-list * | out-string)"
        $resourceApiVersion = $null

        if (!$useLatestApiVersion -and $currentApiVersions.type.contains($azResource.ResourceType)) {
            $rpType = $currentApiVersions | where-object type -ieq $azResource.ResourceType | select-object apiversion
            $resourceApiVersion = $rpType.ApiVersion
            write-host "using configured resource schema api version: $resourceApiVersion to enumerate and save resource: `r`n`t$($azResource.ResourceId)" -ForegroundColor green
        }

        if ($useLatestApiVersion -or !$resourceApiVersion) {
            $resourceProvider = $resourceProviders | where-object ProviderNamespace -ieq $azResource.ResourceType.split('/')[0]
            $rpType = $resourceProvider.ResourceTypes | where-object ResourceTypeName -ieq $azResource.ResourceType.split('/')[1]
            $resourceApiVersion = $rpType.ApiVersions[0]
            write-host "using latest schema api version: $resourceApiVersion to enumerate and save resource: `r`n`t$($azResource.ResourceId)" -ForegroundColor yellow
        }

        $azResource = get-azresource -Id $azResource.ResourceId -ExpandProperties -ApiVersion $resourceApiVersion
        write-verbose "azresource by id and version: $($azResource | format-list * | out-string)"
        $resource = @{
            apiVersion = $resourceApiVersion
            #dependsOn  = @()
            type       = $azResource.ResourceType
            location   = $azResource.Location
            id         = $azResource.ResourceId
            name       = $azResource.Name 
            tags       = $azResource.Tags
            properties = $azResource.properties
        }

        # add other arm objects. vmss sku is an example
        foreach ($item in $azResource.psobject.properties) {
            write-verbose "searching psobject for resourcemanager objects: item: $item"
            if ($item.TypeNameOfValue -imatch 'Microsoft.Azure.Management.ResourceManager') {
                write-verbose "adding psobject for resourcemanager objects: item: $item"
                [void]$resource.Add($item.Name, $azresource."$($item.Name)")
            }
        }

        [void]$resources.Add($resource)
    }

    if (!(create-jsonTemplate -resources $resources -jsonFile $templateJsonFile)) { return }
    return
}

function remove-jobs() {
    try {
        foreach ($job in get-job) {
            write-host "removing job $($job.Name)"
            write-host $job
            $job.StopJob()
            Remove-Job $job -Force
        }
    }
    catch {
        write-host "error:$($Error | out-string)"
        $error.Clear()
    }
}

function wait-jobs() {
    write-log "monitoring jobs"
    while (get-job) {
        foreach ($job in get-job) {
            $jobInfo = (receive-job -Id $job.id)
            if ($jobInfo) {
                write-log -data $jobInfo
            }
            else {
                write-log -data $job
            }

            if ($job.state -ine "running") {
                write-log -data $job

                if ($job.state -imatch "fail" -or $job.statusmessage -imatch "fail") {
                    write-log -data $job
                }

                write-log -data $job
                remove-job -Id $job.Id -Force  
            }

            write-progressInfo
            start-sleep -Seconds $sleepSeconds
        }
    }

    write-log "finished jobs"
}

function write-log($data) {
    if (!$data) { return }
    [text.stringbuilder]$stringData = New-Object text.stringbuilder
    
    if ($data.GetType().Name -eq "PSRemotingJob") {
        foreach ($job in $data.childjobs) {
            if ($job.Information) {
                $stringData.appendline(@($job.Information.ReadAll()) -join "`r`n")
            }
            if ($job.Verbose) {
                $stringData.appendline(@($job.Verbose.ReadAll()) -join "`r`n")
            }
            if ($job.Debug) {
                $stringData.appendline(@($job.Debug.ReadAll()) -join "`r`n")
            }
            if ($job.Output) {
                $stringData.appendline(@($job.Output.ReadAll()) -join "`r`n")
            }
            if ($job.Warning) {
                write-warning (@($job.Warning.ReadAll()) -join "`r`n")
                $stringData.appendline(@($job.Warning.ReadAll()) -join "`r`n")
                $stringData.appendline(($job | format-list * | out-string))
                $global:resourceWarnings++
            }
            if ($job.Error) {
                write-error (@($job.Error.ReadAll()) -join "`r`n")
                $stringData.appendline(@($job.Error.ReadAll()) -join "`r`n")
                $stringData.appendline(($job | format-list * | out-string))
                $global:resourceErrors++
            }
            if ($stringData.tostring().Trim().Length -lt 1) {
                return
            }
        }
    }
    else {
        $stringData = "$(get-date):$($data | format-list * | out-string)"
    }

    write-host $stringData
}

function write-progressInfo() {
    $ErrorActionPreference = $VerbosePreference = 'silentlycontinue'
    $errorCount = $error.Count
    write-verbose "Get-AzResourceGroupDeploymentOperation -ResourceGroupName $resourceGroupName -DeploymentName $deploymentName -ErrorAction silentlycontinue"
    $deploymentOperations = Get-AzResourceGroupDeploymentOperation -ResourceGroupName $resourceGroupName -DeploymentName $deploymentName -ErrorAction silentlycontinue
    $status = "time elapsed:  $(((get-date) - $global:startTime).TotalMinutes.ToString("0.0")) minutes" #`r`n"
    write-verbose $status
    $pattern = "/subscriptions/(?<subscriptionId>.+?)/resourceGroups/(?<resourceGroup>.+?)/providers/(?<provider>.+?)/(?<providerType>.+?)/(?<resource>.+)"

    $count = 0
    Write-Progress -Activity "deployment: $deploymentName resource patching: $resourceGroupName" -Status $status -id ($count++)

    if ($deploymentOperations) {
        write-verbose ("deployment operations: `r`n`t$($deploymentOperations | out-string)")
        
        foreach ($operation in $deploymentOperations) {
            write-verbose ($operation | convertto-json)
            $result = [regex]::Match($operation.targetResource, $pattern, [text.regularexpressions.regexoptions]::IgnoreCase);
            $providerType = $result.Groups['providerType'].Value
            $resource = $result.Groups['resource'].Value
            $currentOperation = "$($providerType):$($resource)"
            $status = "$($operation.provisioningState):$($operation.statusCode)"
            
            if ($operation.statusMessage) {
                $status = "$status $($operation.statusMessage)"
            }
            
            Write-Progress -Activity $currentOperation -id ($count++) -Status $status
        }
    }

    if ($errorCount -ne $error.Count) {
        $error.RemoveRange($errorCount - 1, $error.Count - $errorCount)
    }

    if ($detail) {
        $ErrorActionPreference = $VerbosePreference = 'continue'
    }
}

main
$ErrorActionPreference = $currentErrorActionPreference
$VerbosePreference = $currentVerbosePreference