Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[AzureCLI] Loading service principal profile on request in azure config #8819

Merged
merged 8 commits into from
Nov 19, 2018
Merged

[AzureCLI] Loading service principal profile on request in azure config #8819

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
cd43452
[AzureCLI] Loading service principal profile on request in azure config
thesattiraju Nov 12, 2018
8307879
fixing the name
thesattiraju Nov 14, 2018
22c9bed
Adding logic for deleting the file
thesattiraju Nov 14, 2018
9548cf3
typo
thesattiraju Nov 14, 2018
ed953e7
Accessing them as variables instead
thesattiraju Nov 15, 2018
8925200
clean up
thesattiraju Nov 15, 2018
3042113
Merge branch 'master' of https://github.com/Microsoft/vsts-tasks into…
thesattiraju Nov 16, 2018
901888e
fixing case
thesattiraju Nov 19, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions Tasks/AzureCLIV1/azureclitask.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,13 +132,24 @@ export class azureclitask {
// set az cli config dir
this.setConfigDirectory();

// set config.json
this.loadServicePrincipalsIfRequired(servicePrincipalId, cliPassword, subscriptionID);

//login using svn
this.throwIfError(tl.execSync("az", "login --service-principal -u \"" + servicePrincipalId + "\" -p \"" + cliPassword + "\" --tenant \"" + tenantId + "\""), tl.loc("LoginFailed"));
this.isLoggedIn = true;
//set the subscription imported to the current subscription
this.throwIfError(tl.execSync("az", "account set --subscription \"" + subscriptionID + "\""), tl.loc("ErrorInSettingUpSubscription"));
}

private static loadServicePrincipalsIfRequired(servicePrincipalId, client_key, subscriptionID): void {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

rename the function as well to createServicePrincipalsIfRequired

var loadFileName = tl.getVariable("LOAD_SERVICE_PRINCIPAL");
Copy link
Contributor

@bansalaseem bansalaseem Nov 13, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should not expect the user to specify the file name as the file name is kind of fixed in the az cli code and expect user to specify true/false only.

Secondly LOAD word does not look right. We should change it to CREATE_SERVICE_PRINCIPAL_FILE

Thirdly if there is a logout action in the task, we should delete the file as well.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the scenario for this requirement?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is required for supporting a scenario where the user wants to use the SPN details of the serviceEndpoint while creating a new AKS cluster, instead of creating a new service principal every time.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Got it. It also addresses #8726 . Should the secrets rather be set as secret variables instead of this file for easier consumption? Also I believe this file will get deleted after the task exists (due to logout) - is that correct?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file is a convention followed by az cli which we figured out by following the source code.
I noticed az logout doesn't explicitly delete that file, so I'm adding logic for unlinking upon exit.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If this is the already saved by az cli - then why do we need to store it again?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I meant, the file is a convention for the az aks module i.e. it searches for this file in the config path, otherwise tries to create a new service-principal for AKS cluster creation.
This file is not available by default.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Got it. Given that we have requests for use cases other than aks (as pointed above), and also this file syntax is an internal implementation of aks (subject to change) - should we consider the environment variables so that this feature is more usable for all scenarios.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Azure endpoint can take client key or a certificate. Az CLI today does no support certificate yet (Azure PS does). @Ajay-MS would likely enhance Az CLI as well. Want to know if the solution proposed will scale for both client key and certificate?

if (!!loadFileName) {
loadFileName = loadFileName.trim();
fs.writeFileSync(path.join(this.azCliConfigPath, loadFileName), JSON.stringify({ [subscriptionID]: { client_secret: client_key, service_principal: servicePrincipalId } }));
}
}

private static setConfigDirectory(): void {
var configDirName: string = "c" + new Date().getTime(); // 'c' denotes config
if (tl.osType().match(/^Win/)) {
Expand Down
2 changes: 1 addition & 1 deletion Tasks/AzureCLIV1/task.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
"version": {
"Major": 1,
"Minor": 143,
"Patch": 1
"Patch": 2
},
"minimumAgentVersion": "2.0.0",
"instanceNameFormat": "Azure CLI $(scriptPath)",
Expand Down
2 changes: 1 addition & 1 deletion Tasks/AzureCLIV1/task.loc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
"version": {
"Major": 1,
"Minor": 143,
"Patch": 1
"Patch": 2
},
"minimumAgentVersion": "2.0.0",
"instanceNameFormat": "ms-resource:loc.instanceNameFormat",
Expand Down