Pull in Main (#660)

* Check that Portal UI form outputs map to template parameter inputs on pull requests (#620) * Move the workflow scripts to where they're used (#632) * Update descriptions in alt text on main README.md (#633) * Add spike issue template and remove feature request issue template (#635) * Fix for Terraform issue in which the tier 2 subscription parameter is ignored (#638) * Process for handling a broken build (#641) * Clean-up nightly deployments using Azure CLI (#642) * Add instructions for ASC/Defender cleanup (#643) * Pin Bicep to v0.4.1272 (#650) * SBOM generation in PR (#648) * Update policy assignment resource provider version (#652) * Generate SBOMs without .git contents (#654) * Generate SBOM files during PR events (#656) * check to see if the SBOM needs to be regenerated before running the pipeline again * Update Software Bill of Materials (SBOM) Co-authored-by: Microsoft.VisualStudio.Services.TFS <> Co-authored-by: Glenn Musa <[email protected]> Co-authored-by: Brooke Hamilton <[email protected]> Co-authored-by: Vidya Bala <[email protected]> Co-authored-by: JeromeJansen <[email protected]>
Azure · Feb 21, 2022 · 5411212 · 5411212
1 parent ef97494
commit 5411212
Show file tree

Hide file tree

Showing 41 changed files with 5,810 additions and 1,944 deletions.
diff --git a/.azure-devops/nightlybuild/mlz-bicep-azurecloud-pipelines.yml b/.azure-devops/nightlybuild/mlz-bicep-azurecloud-pipelines.yml
@@ -2,6 +2,7 @@
 # Licensed under the MIT License.
 
 schedules:
+
   - cron: "0 4 * * *"
     displayName: "Nightly - mlz bicep azure cloud"
     branches:
@@ -10,125 +11,24 @@ schedules:
     always: true
 
 pool:
-  vmImage: ubuntu-latest
 
-variables:
-  ServiceConnectionName: $(CAzureConnection)
+  vmImage: ubuntu-latest
 
 jobs:
-- job: bicepCommercialCloud
-  steps:
-  - task: AzureCLI@2
-    displayName: "Deploy MLZ Bicep"
-    inputs:
-      azureSubscription: $(ServiceConnectionName)
-      scriptType: 'bash'
-      scriptLocation: 'inlineScript'
-      inlineScript: |
-        datetime=$(date +%s) # gets the current date time as an epoch
-        az deployment sub create \
-          --name $(bDeploymentName) \
-          --location $(Location) \
-          --template-file $(TemplateFile) \
-          --parameters resourcePrefix=$datetime
-
-  - task: AzureCLI@2
-    displayName: "Generate deploymentVariables.json for all addons and examples"
-    inputs:
-      azureSubscription: $(ServiceConnectionName)
-      scriptType: 'bash'
-      scriptLocation: 'inlineScript'
-      inlineScript: |
-        az deployment sub show \
-          --name $(bDeploymentName) \
-          --query properties.outputs \
-          > $(Build.SourcesDirectory)/src/bicep/examples/deploymentVariables.json
-
-  - task: AzureCLI@2
-    displayName: "Extract Values and Hydrate Variables for T3 Deployment"
-    inputs:
-      azureSubscription: $(ServiceConnectionName)
-      scriptType: 'bash'
-      scriptLocation: 'inlineScript'
-      inlineScript: |
-        deploymentoutput=$(az deployment sub show \
-          --name $(bDeploymentName) \
-          --query '{
-              hubSubId: properties.outputs.hub.value.subscriptionId,
-              hubRGroupName: properties.outputs.hub.value.resourceGroupName,
-              hubVNetworkName: properties.outputs.hub.value.virtualNetworkName,
-              hubVNetworkResourceId: properties.outputs.hub.value.virtualNetworkResourceId,
-              logAWspaceResourceId: properties.outputs.logAnalyticsWorkspaceResourceId.value,
-              firewallPrivateIP: properties.outputs.firewallPrivateIPAddress.value
-            }' \
-          --output json)
-
-        hubSubId=$(echo $deploymentoutput | jq  '.hubSubId') \
-          && echo "##vso[task.setvariable variable=hubSubscriptionId;]$hubSubId"
 
-        hubRGroupName=$(echo $deploymentoutput | jq  '.hubRGroupName') \
-          && echo "##vso[task.setvariable variable=hubResourceGroupName;]$hubRGroupName"
-
-        hubVNetworkName=$(echo $deploymentoutput | jq  '.hubVNetworkName') \
-          && echo "##vso[task.setvariable variable=hubVirtualNetworkName;]$hubVNetworkName"
-
-        hubVNetworkResourceId=$(echo $deploymentoutput | jq  '.hubVNetworkResourceId') \
-          && echo "##vso[task.setvariable variable=hubVirtualNetworkResourceId;]$hubVNetworkResourceId"
-
-        logAWspaceResourceId=$(echo $deploymentoutput | jq  '.logAWspaceResourceId') \
-          && echo "##vso[task.setvariable variable=logAnalyticsWorkspaceResourceId;]$logAWspaceResourceId"
-
-        firewallPrivateIP=$(echo $deploymentoutput | jq  '.firewallPrivateIP') \
-          && echo "##vso[task.setvariable variable=firewallPrivateIPAddress;]$firewallPrivateIP"
-
-  - task: AzureCLI@2
-    displayName: "T3 Bicep Deployment"
-    inputs:
-      azureSubscription: $(ServiceConnectionName)
-      scriptType: 'bash'
-      scriptLocation: 'inlineScript'
-      inlineScript: |
-        az deployment sub create \
-           --subscription $(workloadSubId) \
-           --location $(Location) \
-           --name $(workloadName) \
-           --template-file $(T3TemplateFile) \
-           --parameters \
-              workloadName=$(workloadName) \
-              hubSubscriptionId=$(hubSubscriptionId) \
-              hubResourceGroupName=$(hubResourceGroupName) \
-              hubVirtualNetworkName=$(hubVirtualNetworkName) \
-              hubVirtualNetworkResourceId=$(hubVirtualNetworkResourceId) \
-              logAnalyticsWorkspaceResourceId=$(logAnalyticsWorkspaceResourceId) \
-              firewallPrivateIPAddress=$(firewallPrivateIPAddress)
+- job: bicepCommercialCloud
+  displayName: "Nightly deployment of Mission LZ Bicep on AzureCloud"
 
-  - task: AzureCLI@2
-    displayName: "Clean up Subscription Diagnostics Settings"
-    condition: always()
-    inputs:
-      azureSubscription: $(ServiceConnectionName)
-      scriptType: 'bash'
-      scriptLocation: 'inlineScript'
-      inlineScript: | 
-        az monitor diagnostic-settings subscription list \
-          --query "value[].name" \
-          --output tsv \
-        | xargs -t -I % az monitor diagnostic-settings subscription delete \
-          --yes \
-          --name %
+  steps:
 
-  - task: AzureCLI@2
-    displayName: "Clean up Resources"
-    condition: always()
-    inputs:
-      azureSubscription: $(ServiceConnectionName)
-      scriptType: 'bash'
-      scriptLocation: 'inlineScript'
-      inlineScript: |
-        az group list \
-          --query "[].name" \
-          --output tsv \
-        | xargs -t -I % az group delete \
-          --yes \
-          --no-wait \
-          --name %
+  - template: templates/az-deployment.yml
+    parameters:
+      ServiceConnectionName: $(CAzureConnection)
+      DeploymentName: $(bDeploymentName)
+      Location: $(CLocation)
+      WorkloadSubId: $(CSubId)
+      WorkloadName: $(workloadName)
+
+  - template: templates/clean-az-subscription.yml
+    parameters:
+      serviceConnectionName: $(CAzureConnection)
diff --git a/.azure-devops/nightlybuild/mlz-bicep-azuregov-pipelines.yml b/.azure-devops/nightlybuild/mlz-bicep-azuregov-pipelines.yml
@@ -2,6 +2,7 @@
 # Licensed under the MIT License.
 
 schedules:
+
   - cron: "0 4 * * *"
     displayName: "Nightly - mlz bicep azure US Gov Cloud"
     branches:
@@ -10,124 +11,24 @@ schedules:
     always: true
 
 pool:
-  vmImage: ubuntu-latest
 
-variables:
-  GServiceConnectionName: $(GAzureConnection)
+  vmImage: ubuntu-latest
 
 jobs:
-- job: bicepGovCloud
-  steps:
-  - task: AzureCLI@2
-    displayName: "Deploy MLZ Bicep"
-    inputs:
-      azureSubscription: $(GServiceConnectionName)
-      scriptType: 'bash'
-      scriptLocation: 'inlineScript'
-      inlineScript: |
-        datetime=$(date +%s) # gets the current date time as an epoch
-        az deployment sub create \
-          --name $(bDeploymentName) \
-          --location $(GLocation) \
-          --template-file $(TemplateFile) \
-          --parameters resourcePrefix=$datetime
-
-  - task: AzureCLI@2
-    displayName: "Generate deploymentVariables.json for all addons and examples"
-    inputs:
-      azureSubscription: $(GServiceConnectionName)
-      scriptType: 'bash'
-      scriptLocation: 'inlineScript'
-      inlineScript: |
-        az deployment sub show \
-          --name $(bDeploymentName) \
-          --query properties.outputs \
-          > $(Build.SourcesDirectory)/src/bicep/examples/deploymentVariables.json
-
-  - task: AzureCLI@2
-    displayName: "Extract Values and Hydrate Variables for T3 Deployment"
-    inputs:
-      azureSubscription: $(GServiceConnectionName)
-      scriptType: 'bash'
-      scriptLocation: 'inlineScript'
-      inlineScript: |
-        deploymentoutput=$(az deployment sub show \
-          --name $(bDeploymentName) \
-          --query '{
-            hubSubId:properties.outputs.hub.value.subscriptionId,
-            hubRGroupName:properties.outputs.hub.value.resourceGroupName,
-            hubVNetworkName:properties.outputs.hub.value.virtualNetworkName,
-            hubVNetworkResourceId:properties.outputs.hub.value.virtualNetworkResourceId,
-            logAWspaceResourceId:properties.outputs.logAnalyticsWorkspaceResourceId.value,
-            firewallPrivateIP:properties.outputs.firewallPrivateIPAddress.value }' \
-          --output json)
 
-        hubSubId=$(echo $deploymentoutput | jq  '.hubSubId') \
-          && echo "##vso[task.setvariable variable=hubSubscriptionId;]$hubSubId"
-
-        hubRGroupName=$(echo $deploymentoutput | jq  '.hubRGroupName') \
-          && echo "##vso[task.setvariable variable=hubResourceGroupName;]$hubRGroupName"
-
-        hubVNetworkName=$(echo $deploymentoutput | jq  '.hubVNetworkName') \
-          && echo "##vso[task.setvariable variable=hubVirtualNetworkName;]$hubVNetworkName"
-
-        hubVNetworkResourceId=$(echo $deploymentoutput | jq  '.hubVNetworkResourceId') \
-          && echo "##vso[task.setvariable variable=hubVirtualNetworkResourceId;]$hubVNetworkResourceId"
-
-        logAWspaceResourceId=$(echo $deploymentoutput | jq  '.logAWspaceResourceId') \
-          && echo "##vso[task.setvariable variable=logAnalyticsWorkspaceResourceId;]$logAWspaceResourceId"
-
-        firewallPrivateIP=$(echo $deploymentoutput | jq  '.firewallPrivateIP') \
-          && echo "##vso[task.setvariable variable=firewallPrivateIPAddress;]$firewallPrivateIP"
+- job: bicepGovCloud
+  displayName: "Nightly deployment of Mission LZ Bicep on AzureUsGovernment"
 
-  - task: AzureCLI@2
-    displayName: "T3 Bicep Deployment"
-    inputs:
-      azureSubscription: $(GServiceConnectionName)
-      scriptType: 'bash'
-      scriptLocation: 'inlineScript'
-      inlineScript: |
-        az deployment sub create \
-           --subscription $(GSubId) \
-           --location $(GLocation) \
-           --name $(workloadName) \
-           --template-file $(T3TemplateFile) \
-           --parameters \
-              workloadName=$(workloadName) \
-              hubSubscriptionId=$(hubSubscriptionId) \
-              hubResourceGroupName=$(hubResourceGroupName) \
-              hubVirtualNetworkName=$(hubVirtualNetworkName) \
-              hubVirtualNetworkResourceId=$(hubVirtualNetworkResourceId) \
-              logAnalyticsWorkspaceResourceId=$(logAnalyticsWorkspaceResourceId) \
-              firewallPrivateIPAddress=$(firewallPrivateIPAddress)
-   
-  - task: AzureCLI@2
-    displayName: "Clean up Subscription Diagnostics Settings"
-    condition: always()
-    inputs:
-      azureSubscription: $(GServiceConnectionName)
-      scriptType: 'bash'
-      scriptLocation: 'inlineScript'
-      inlineScript: | 
-        az monitor diagnostic-settings subscription list \
-          --query "value[].name" \
-          --output tsv \
-        | xargs -t -I % az monitor diagnostic-settings subscription delete \
-          --yes \
-          --name %
+  steps:
 
-  - task: AzureCLI@2
-    displayName: "Clean up Resources"
-    condition: always()
-    inputs:
-      azureSubscription: $(GServiceConnectionName)
-      scriptType: 'bash'
-      scriptLocation: 'inlineScript'
-      inlineScript: |
-        az group list \
-          --query "[].name" \
-          --output tsv \
-        | xargs -t -I % az group delete \
-          --yes \
-          --no-wait \
-          --name %
+  - template: templates/az-deployment.yml
+    parameters:
+      ServiceConnectionName: $(GAzureConnection)
+      DeploymentName: $(bDeploymentName)
+      Location: $(GLocation)
+      WorkloadSubId: $(GSubId)
+      WorkloadName: $(workloadName)
+
+  - template: templates/clean-az-subscription.yml
+    parameters:
+      serviceConnectionName: $(GAzureConnection)