Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Migrate Identity Live tests deployment to Fed Auth. #42635

Draft
wants to merge 42 commits into
base: main
Choose a base branch
from
+75 −19
Draft

Migrate Identity Live tests deployment to Fed Auth. #42635

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
42 commits
Select commit Hold shift + click to select a range
d4356d4
update federated auth config
g2vinay Oct 28, 2024
402c03c
update ci
g2vinay Oct 28, 2024
fc40de3
update AKS tests
g2vinay Oct 28, 2024
da2f6ee
update CI yml
g2vinay Oct 28, 2024
3cd1232
Merge branch 'main' of https://github.com/Azure/azure-sdk-for-java in…
g2vinay Oct 28, 2024
e28ac1e
update ci
g2vinay Oct 28, 2024
bd810b3
update pre ps1 to use ARM user
g2vinay Oct 28, 2024
9672d4b
update test resources ps1
g2vinay Oct 28, 2024
24df15f
add persist oidc token flow
g2vinay Oct 29, 2024
0853563
update pre ps1
g2vinay Oct 29, 2024
ff9d5e1
Merge remote-tracking branch 'upstream/main' into update-identity-liv…
g2vinay Nov 1, 2024
7e9ffff
update env vars in tests
g2vinay Nov 4, 2024
6d3fd72
update tests
g2vinay Nov 4, 2024
e4daab6
update ci config
g2vinay Nov 4, 2024
9b9b203
update test enc var
g2vinay Nov 4, 2024
15b0c57
Merge remote-tracking branch 'upstream/main' into update-identity-liv…
g2vinay Nov 4, 2024
9dd568c
update ci to map env vars
g2vinay Nov 4, 2024
1a63b29
update oidc mapping
g2vinay Nov 4, 2024
074969a
update client and tenant env vars
g2vinay Nov 4, 2024
5578c5e
fix tenant id mapping
g2vinay Nov 4, 2024
fda32bb
fetch a new federated token in tests
g2vinay Nov 7, 2024
d840be9
update OIDC token flow
g2vinay Nov 7, 2024
0bce75f
add token rerfresh logic
g2vinay Nov 7, 2024
74bfc10
fix ci yml
g2vinay Nov 7, 2024
0fa2b06
update post resources script
g2vinay Nov 7, 2024
839781c
update post script
g2vinay Nov 7, 2024
4ec4dcf
update ci.yml
g2vinay Nov 7, 2024
7a1af04
update ci
g2vinay Nov 7, 2024
9f3e0a9
update post script
g2vinay Nov 7, 2024
d89d91c
try optimize deploy resources step
g2vinay Nov 7, 2024
7fc1c36
add refresh token logic
g2vinay Nov 7, 2024
fbd0147
update ci
g2vinay Nov 7, 2024
dfb7580
refactor ci
g2vinay Nov 7, 2024
16bd8b0
update ci
g2vinay Nov 8, 2024
786e940
update ci
g2vinay Nov 8, 2024
af25b09
update tests
g2vinay Nov 10, 2024
dea90b1
update tests
g2vinay Nov 10, 2024
fa3caa0
update live tests
g2vinay Nov 10, 2024
e6dc78a
update tests
g2vinay Nov 10, 2024
2c061d7
update ci yml
g2vinay Nov 10, 2024
e079ac2
update ci
g2vinay Nov 10, 2024
85d2a14
update tests
g2vinay Nov 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions sdk/identity/azure-identity/src/test/java/LiveManagedIdentityTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,9 +69,9 @@ public void testManagedIdentityAksDeployment() {
//Setup Env
Configuration configuration = Configuration.getGlobalConfiguration().clone();

String spClientId = configuration.get("IDENTITY_CLIENT_ID");
String secret = configuration.get("IDENTITY_CLIENT_SECRET");
String tenantId = configuration.get("IDENTITY_TENANT_ID");
String spClientId = configuration.get("ARM_CLIENT_ID");
String oidc = configuration.get("ARM_OIDC_TOKEN");
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you want to use this token at the running of the tests you will also need to set it as an env variable in the tests.yml file.

String tenantId = configuration.get("ARM_TENANT_ID");
String resourceGroup = configuration.get("IDENTITY_RESOURCE_GROUP");
String aksCluster = configuration.get("IDENTITY_AKS_CLUSTER_NAME");
String subscriptionId = configuration.get("IDENTITY_SUBSCRIPTION_ID");
Expand All @@ -81,7 +81,7 @@ public void testManagedIdentityAksDeployment() {
String azPath = runCommand(pathCommand, "az").trim();
String kubectlPath = runCommand(pathCommand, "kubectl").trim();

runCommand(azPath, "login", "--service-principal", "-u", spClientId, "-p", secret, "--tenant", tenantId);
runCommand(azPath, "login", "--federated-token",oidc, "--service-principal", "-u", spClientId, "--tenant", tenantId);
runCommand(azPath, "account", "set", "--subscription", subscriptionId);
runCommand(azPath, "aks", "get-credentials", "--resource-group", resourceGroup, "--name", aksCluster,
"--overwrite-existing");
Expand Down
21 changes: 19 additions & 2 deletions sdk/identity/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,12 +71,29 @@ extends:
LiveTestStages:
- template: /eng/pipelines/templates/stages/archetype-sdk-tests-isolated.yml
parameters:
PreSteps:
- task: AzureCLI@2
displayName: Set OIDC variables
env:
ARM_OIDC_TOKEN: $(ARM_OIDC_TOKEN)
ARM_CLIENT_ID: $(ARM_CLIENT_ID)
ARM_TENANT_ID: $(ARM_TENANT_ID)
inputs:
azureSubscription: azure-sdk-tests
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See my other comment https://github.com/Azure/azure-sdk-for-java/pull/42635/files#r1819384979 but you should not need this PreStep and as it currently setup it will not work because we need to have the subscription match the deployment.

scriptType: pscore
scriptLocation: inlineScript
addSpnToEnvironment: true
inlineScript: |
Write-Host "##vso[task.setvariable variable=ARM_CLIENT_ID;issecret=true]$($env:servicePrincipalId)"
Write-Host "##vso[task.setvariable variable=ARM_TENANT_ID;issecret=true]$($env:tenantId)"
Write-Host "##vso[task.setvariable variable=ARM_OIDC_TOKEN;issecret=true]$($env:idToken)"
CalledFromClient: true
ServiceDirectory: identity
SupportedClouds: 'Public,UsGov,China'
UseFederatedAuth: false
EnvVars:
SYSTEM_ACCESSTOKEN: $(System.AccessToken)
ARM_OIDC_TOKEN: $(ARM_OIDC_TOKEN)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In order to get these variables I think you will need to plumb the PersistOidcToken token open similar to what @benbp is doing in js at Azure/azure-sdk-for-js#31335

Copy link
Member

@benbp benbp Oct 28, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, and we should revert usage of ARM_CLIENT_ID and ARM_TENANT_ID, since these variables are already set as IDENTITY_*_ID

ARM_CLIENT_ID: $(ARM_CLIENT_ID)
ARM_TENANT_ID: $(ARM_TENANT_ID)
CloudConfig:
Public:
SubscriptionConfigurations:
Copy link
Member

@weshaggard weshaggard Nov 4, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You should remove $(sub-config-azure-cloud-test-resources) and investigate if $(sub-config-identity-test-resources) is needed any longer as well and if not remove it also.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does referencing IDENTITY_TENANT_ID directly in LiveManagedIdentityTests.java not work?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't end up setting those variables so I had him switch to the ones we set for the azurepipelinecredential

Expand Down
1 change: 0 additions & 1 deletion sdk/identity/test-resources-post.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,6 @@ $azBuildToolsRootPom = "$PSScriptRoot/../../eng/code-quality-reports/pom.xml" |
$funcAppRoot = "$PSScriptRoot/live-test-apps/identity-test-function" | Resolve-Path
$funcAppPom = "$funcAppRoot/pom.xml" | Resolve-Path

az login --service-principal -u $(getVariable('IDENTITY_CLIENT_ID')) -p $(getVariable('IDENTITY_CLIENT_SECRET')) --tenant $(getVariable('IDENTITY_TENANT_ID'))
az account set --subscription $(getVariable('IDENTITY_SUBSCRIPTION_ID'))


Expand Down
2 changes: 1 addition & 1 deletion sdk/identity/test-resources-pre.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ $sshKey = Get-Content $PSScriptRoot/sshKey.pub
$templateFileParameters['sshPubKey'] = $sshKey

# Get the max version that is not preview and then get the name of the patch version with the max value
az login --service-principal -u $TestApplicationId -p $TestApplicationSecret --tenant $TenantId
az login --service-principal -u $TestApplicationId -p $TestApplicationSecret --tenant $TenantId --allow-no-subscriptions --federated-token $env:ARM_OIDC_TOKEN
$versions = az aks get-versions -l westus -o json | ConvertFrom-Json
Write-Host "AKS versions: $($versions | ConvertTo-Json -Depth 100)"
$patchVersions = $versions.values | Where-Object { $_.isPreview -eq $null } | Select-Object -ExpandProperty patchVersions
Expand Down
Loading