-
Notifications
You must be signed in to change notification settings - Fork 12
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
chore: deploy test resources w/ new test packages (#433)
* chore: deploy test resources * pr-fix: missing assignment keyword * pr-fix: correct rg assignment * pr-fix: key vault name assignment * pr-fix: add location param + correct existing service principal condition * pr-fix: add depends on * pr-fix: use correct way to retrieve secret version * pr-fix: add logging for sp-related commands * pr-fix: use solely security-related resources * pr-fix: add logging for secret version * pr-fix: add secret version other way * pr-fix: use property outputs * pr-fix: add logging for deploy outputs * pr-fix: correct new output variable assignment * pr-fix: mark as string * pr-add: integrate tests and key vault * pr-fix: hashicorp template path * pr-fix: add devops resources * pr-fix: add test variables * pr-fix: az identity vulnerability * pr-fix: correct secret value * pr-fix: run secret retrieval as a pre-job * pr-fix: get own key vault secrets * pr-fix: correct parameters * pr-fix: install module az.keyvault * pr-fix: use az keyvault * pr-fix: use client id as var * pr-fix: remove app insights reference * pr-fix: add infra smoke tests * pr-fix: use az cli task * pr-fix: argument syntax * pr-fix: add enabled assertion * pr-fix: correct running * pr-fix: add az module * pr-fix: use new arguments syntax * pr-fix: use higher version of pester * pr-fix: use at least 5.3.0 * pr-fix: use env variables * pr-fix: correct test result * pr-fix: import module * pr-fix: remove param * pr-fix: enable test result * pr-fix: correct env vars * pr-fix: use other env vars * pr-fix: use correct secret version extraction * pr-fix: use pester container for external data * pr-fix: broaden test assertion + trim secret version setup * pr-fix: simplify config value retrieval * pr-fix: remove any spaces from version and secret * pr-fix: use direct setting of variable * pr-fix: clean tests * pr-fix: remove tried smoke tests * Update Arcus.Security.Providers.AzureKeyVault.csproj * Update Arcus.Security.Providers.AzureKeyVault.csproj * pr-fix: use most recent test fixtures * pr-fix: use correct unauthorized secret names * pr-fix: remove remote resource group * Update deploy-test-resources.yml * Update deploy-test-resources.yml * Update deploy-test-resources.yml
- Loading branch information
1 parent
f5e02f2
commit e0b4f97
Showing
26 changed files
with
433 additions
and
513 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| name: Arcus Security - Deploy test resources | ||
|
|
||
| trigger: none | ||
| pr: none | ||
|
|
||
| parameters: | ||
| - name: azureServiceConnection | ||
| displayName: 'Azure service connection' | ||
| type: string | ||
| default: 'Azure Codit-Arcus Service Principal' | ||
| - name: resourceGroupName | ||
| displayName: 'Resource group name' | ||
| default: arcus-security-dev-we-rg | ||
|
|
||
| variables: | ||
| - template: ./variables/build.yml | ||
| - template: ./variables/test.yml | ||
|
|
||
| resources: | ||
| repositories: | ||
| - repository: templates | ||
| type: github | ||
| name: arcus-azure/azure-devops-templates | ||
| endpoint: arcus-azure | ||
|
|
||
| stages: | ||
| - stage: Deploy | ||
| jobs: | ||
| - job: DeployBicep | ||
| displayName: 'Deploy test resources' | ||
| pool: | ||
| vmImage: '$(Vm.Image)' | ||
| steps: | ||
| - task: AzureCLI@2 | ||
| inputs: | ||
| azureSubscription: '${{ parameters.azureServiceConnection }}' | ||
| addSpnToEnvironment: true | ||
| scriptType: 'pscore' | ||
| scriptLocation: 'inlineScript' | ||
| inlineScript: | | ||
| $secretName = $env:ARCUS_SECURITY_KEYVAULT_TESTSECRETNAME | ||
| $secretValue = [System.Guid]::NewGuid().ToString() | ||
| $objectId = (az ad sp show --id $env:servicePrincipalId | ConvertFrom-Json).id | ||
| az deployment sub create ` | ||
| --location westeurope ` | ||
| --template-file ./build/templates/deploy-test-resources.bicep ` | ||
| --parameters location=westeurope ` | ||
| --parameters resourceGroupName=${{ parameters.resourceGroupName }} ` | ||
| --parameters keyVaultName=$env:ARCUS_SECURITY_KEYVAULT_NAME ` | ||
| --parameters secretName=$secretName ` | ||
| --parameters secretValue=$secretValue ` | ||
| --parameters servicePrincipal_objectId=$objectId ` | ||
| | ConvertFrom-Json |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| // Define the location for the deployment of the components. | ||
| param location string | ||
|
|
||
| // Define the name of the resource group where the components will be deployed. | ||
| param resourceGroupName string | ||
|
|
||
| // Define the name of the Key vault. | ||
| param keyVaultName string | ||
|
|
||
| // Define the name of the secret that will be added to the Key vault. | ||
| param secretName string | ||
|
|
||
| // Define the secret value that will be by default added to the Key vault. | ||
| @secure() | ||
| param secretValue string | ||
|
|
||
| // Define the Service Principal ID that needs access full access to the deployed resource group. | ||
| param servicePrincipal_objectId string | ||
|
|
||
| targetScope='subscription' | ||
|
|
||
| module resourceGroup 'br/public:avm/res/resources/resource-group:0.2.3' = { | ||
| name: 'resourceGroupDeployment' | ||
| params: { | ||
| name: resourceGroupName | ||
| location: location | ||
| } | ||
| } | ||
|
|
||
| resource rg 'Microsoft.Resources/resourceGroups@2021-04-01' existing = { | ||
| name: resourceGroupName | ||
| } | ||
|
|
||
| module vault 'br/public:avm/res/key-vault/vault:0.6.1' = { | ||
| name: 'vaultDeployment' | ||
| dependsOn: [ | ||
| resourceGroup | ||
| ] | ||
| scope: rg | ||
| params: { | ||
| name: keyVaultName | ||
| location: location | ||
| roleAssignments: [ | ||
| { | ||
| principalId: servicePrincipal_objectId | ||
| roleDefinitionIdOrName: 'Key Vault Secrets officer' | ||
| } | ||
| ] | ||
| secrets: [ | ||
| { | ||
| name: secretName | ||
| value: secretValue | ||
| } | ||
| ] | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,8 @@ | ||
| variables: | ||
| Arcus.KeyVault.TestKeyName: "ArcusTestSecret" | ||
| Arcus.KeyVault.TestKeyVersion: "8bde7a16366849e28b7abe26732e12e3" | ||
| HashiCorp.Vault.Version: 1.5.0 | ||
| Arcus.AzureFunctions.HttpPort: "5000" | ||
| Arcus.Security.KeyVault.Name: 'arcus-security-kv' | ||
| Arcus.Security.KeyVault.TestSecretName: 'ArcusTestSecret' | ||
| Arcus.General.KeyVault.Name: 'arcus-kv' | ||
| Arcus.General.Unauthorized.ServicePrincipal.ClientId.SecretName: 'Arcus-Unauthorized-ServicePrincipal-ClientId' | ||
| Arcus.General.Unauthorized.ServicePrincipal.ClientSecret.SecretName: 'Arcus-Unauthorized-ServicePrincipal-ClientSecret' | ||
| Arcus.AzureFunctions.HttpPort: '5000' | ||
| HashiCorp.Vault.Version: 1.5.0 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
8 changes: 4 additions & 4 deletions
8
src/Arcus.Security.Tests.Core/Arcus.Security.Tests.Core.csproj
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.