Skip to content

Commit b7446c6

Browse files
stijnmoreelsstijnmoreels
authored
chore: deploy to new Dev tenant (#432)
* chore: deploy test resources * pr-fix: use linux vm * pr-fix: missing backtick * pr-fix: use parameter secret * pr-fix: gen password * pr-fix: gen password * pr-fix: remove location param * pr-fix: add missing params * pr-fix: server name * pr-fix: app service name * pr-fix: correct plan * pr-fix: sql db sku * pr-fix: sql db basic max bytes * pr-fix: use ex max size * pr-fix: change sku * pr-fix: change sku * pr-fix: change server name * pr-fix: update min capacity * pr-fix: update min capacity * pr-fix: update min capacity * pr-fix: update min capacity * pr-fix: correct basic max size * pr-fix: pass in az service connection * pr-fix: expose test variables * pr-fix: add quotes to condition * pr-fix: correct var name * pr-fix: correct arg name * pr-fix: correct appsettings name * pr-fix: use correct role assignments * pr-fix: use correct password * pr-fix: add certificate permissions to built-in logic apps service principal * pr-fix: add role permissions access * pr-fix: correct authz * pr-fix: correct sql param name * pr-fix: use access policies * pr-fix: use correct access token * pr-fix: use correct key perm * pr-fix: sql filewalls * pr-fix: correct sql * pr-fix: correct sql * pr-fix: correct sql * pr-fix: correct ad * pr-fix: secret name * pr-fix: secret name * pr-fix: secret name * pr-fix: logging * pr-fix: tenant id * pr-fix: sql * pr-fix: sql * pr-fix: sql * pr-fix: sql * pr-fix: sql * pr-fix: use server instance * pr-fix: sql instance + connect graph * pr-fix: sql instance var * pr-fix: assign values ourselves * pr-fix: secure string * pr-fix: secure string * pr-fix: secure string * pr-fix: apim rest permissions? * pr-fix: activate all tests * pr-fix: remove commented-out sql tasks * pr-fix: skip both apim tests * temp: re-activate apim tets * Update Arcus.Scripting.DevOps.tests.ps1 * pr-fix: remove update ps tasks
1 parent 92f804a commit b7446c6

14 files changed

Lines changed: 390 additions & 40 deletions

‎build/ci-build.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,10 @@ parameters:
1818
- name: 'Package.Version.ManualTrigger'
1919
type: string
2020
default: 'preview'
21+
- name: azureServiceConnection
22+
displayName: 'Azure service connection'
23+
type: string
24+
default: 'Azure Codit-Arcus Service Principal'
2125
- name: 'UnitTests'
2226
type: object
2327
default:
@@ -62,9 +66,9 @@ resources:
6266
variables:
6367
- group: 'Build Configuration'
6468
- group: 'Arcus Scripting - Integration Testing'
65-
- group: 'Arcus - GitHub Package Registry'
6669
- group: 'MyGet'
6770
- template: ./variables/build.yml
71+
- template: ./variables/test.yml
6872
- name: 'Package.Version'
6973
value: '0.$(Build.BuildNumber)'
7074
- name: 'Prerelease'
@@ -111,6 +115,7 @@ stages:
111115
parameters:
112116
projectName: '$(Project).Tests.Unit'
113117
testName: '$(Project).${{UnitTest.name}}'
118+
azureServiceConnection: ${{ parameters.azureServiceConnection }}
114119

115120
- stage: IntegrationTests
116121
displayName: Integration Tests
@@ -139,6 +144,7 @@ stages:
139144
parameters:
140145
projectName: '$(Project).Tests.Integration'
141146
testName: '$(Project).${{IntegrationTest.name}}'
147+
azureServiceConnection: ${{ parameters.azureServiceConnection }}
142148

143149
- stage: ReleaseToMyget
144150
displayName: 'Release to MyGet'

‎build/deploy-test-resources.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: Arcus Scripting - Deploy test resources
2+
3+
trigger: none
4+
pr: none
5+
6+
parameters:
7+
- name: azureServiceConnection
8+
displayName: 'Azure service connection'
9+
type: string
10+
default: 'Azure Codit-Arcus Service Principal'
11+
- name: resourceGroupName
12+
displayName: 'Resource group name'
13+
default: arcus-scripting-dev-we-rg
14+
15+
variables:
16+
- template: ./variables/build.yml
17+
- template: ./variables/test.yml
18+
19+
stages:
20+
- stage: Deploy
21+
jobs:
22+
- job: DeployBicep
23+
displayName: 'Deploy test resources'
24+
pool:
25+
vmImage: '$(Vm.Linux.Image)'
26+
steps:
27+
- task: AzureCLI@2
28+
env:
29+
SYSTEM_ACCESSTOKEN: $(System.AccessToken)
30+
inputs:
31+
azureSubscription: '${{ parameters.azureServiceConnection }}'
32+
addSpnToEnvironment: true
33+
scriptType: 'pscore'
34+
scriptLocation: 'inlineScript'
35+
inlineScript: |
36+
az deployment sub create `
37+
--location westeurope `
38+
--template-file ./build/templates/deploy-resource-group.bicep `
39+
--parameters resourceGroupName=$env:ARCUS_SCRIPTING_RESOURCEGROUP_NAME `
40+
--parameters location=westeurope
41+
42+
$objectId = (az ad sp show --id $env:servicePrincipalId | ConvertFrom-Json).id
43+
44+
$symbols = '!@#$%^&*=(),.?'.ToCharArray()
45+
$characterList = 'a'..'z' + 'A'..'Z' + '0'..'9' + $symbols
46+
function Gen-Password {
47+
param($length)
48+
do {
49+
$password = ""
50+
for ($i = 0; $i -lt $length; $i++) {
51+
$randomIndex = [System.Security.Cryptography.RandomNumberGenerator]::GetInt32(0, $characterList.Length)
52+
$password += $characterList[$randomIndex]
53+
}
54+
55+
$hasLowerChar = $password -cmatch '[a-z]'
56+
$hasUpperChar = $password -cmatch '[A-Z]'
57+
$hasDigit = $password -match '[0-9]'
58+
$hasSymbol = $password.IndexOfAny($symbols) -ne -1
59+
}
60+
until (($hasLowerChar + $hasUpperChar + $hasDigit + $hasSymbol) -ge 3)
61+
$password
62+
}
63+
64+
$sqlAdminPassword = Gen-Password 14
65+
az deployment group create `
66+
--resource-group $env:ARCUS_SCRIPTING_RESOURCEGROUP_NAME `
67+
--template-file ./build/templates/deploy-test-resources.bicep `
68+
--parameters location=westeurope `
69+
--parameters keyVaultName=$env:ARCUS_SCRIPTING_KEYVAULT_NAME `
70+
--parameters storageAccountName=$env:ARCUS_SCRIPTING_STORAGEACCOUNT_NAME `
71+
--parameters appServiceName=$env:ARCUS_SCRIPTING_APPSERVICE_NAME `
72+
--parameters sqlServerName=$env:ARCUS_SCRIPTING_SQL_SERVERNAME `
73+
--parameters sqlDatabaseName=$env:ARCUS_SCRIPTING_SQL_DATABASENAME `
74+
--parameters sqlAdminUserName=$env:ARCUS_SCRIPTING_SQL_USERNAME `
75+
--parameters sqlAdminPassword=$sqlAdminPassword `
76+
--parameters sqlAdminPassword_secretName=$env:ARCUS_SCRIPTING_SQL_PASSWORD_SECRETNAME `
77+
--parameters integrationAccountName=$env:ARCUS_SCRIPTING_INTEGRATIONACCOUNT_NAME `
78+
--parameters servicePrincipal_objectId=$objectId

‎build/psgallery-release.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@ parameters:
1010
displayName: 'Prerelease string (ex. -alpha, -alpha1, -BETA, -update20171020) or none'
1111
type: 'string'
1212
default: 'none'
13+
- name: azureServiceConnection
14+
displayName: 'Azure service connection'
15+
type: string
16+
default: 'Azure Codit-Arcus Service Principal'
1317
- name: 'UnitTests'
1418
type: object
1519
default:
@@ -56,6 +60,7 @@ variables:
5660
- group: 'Arcus Scripting - Integration Testing'
5761
- group: 'Arcus.Scripting - Releasing PS Gallery'
5862
- template: ./variables/build.yml
63+
- template: ./variables/test.yml
5964
- name: 'Repository'
6065
value: 'arcus-azure/arcus.scripting'
6166
- name: 'Package.Version'
@@ -104,6 +109,7 @@ stages:
104109
parameters:
105110
projectName: '$(Project).Tests.Unit'
106111
testName: '$(Project).${{UnitTest.name}}'
112+
azureServiceConnection: ${{ parameters.azureServiceConnection }}
107113

108114
- stage: IntegrationTests
109115
displayName: Integration Tests
@@ -132,6 +138,7 @@ stages:
132138
parameters:
133139
projectName: '$(Project).Tests.Integration'
134140
testName: '$(Project).${{IntegrationTest.name}}'
141+
azureServiceConnection: ${{ parameters.azureServiceConnection }}
135142

136143
- stage: Release
137144
displayName: 'Release to PowerShell Gallery'

‎build/templates/deploy-resource-group.bicep‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
// Define the name of the resource group.
2+
param resourceGroupName string
3+
4+
// Define the location for the deployment of the components.
5+
param location string
6+
7+
targetScope='subscription'
8+
9+
module resourceGroup 'br/public:avm/res/resources/resource-group:0.2.3' = {
10+
name: 'resourceGroupDeployment'
11+
params: {
12+
name: resourceGroupName
13+
location: location
14+
}
15+
}

‎build/templates/deploy-test-resources.bicep‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
// Define the location for the deployment of the components.
2+
param location string
3+
4+
// Define the name of the storage account that will be created.
5+
param storageAccountName string
6+
7+
// Define the name of the Azure Functions app service that will be created.
8+
param appServiceName string
9+
10+
// Define the name of the Azure SQL server instance that will be created.
11+
param sqlServerName string
12+
13+
// Define the username of the administrator login for the Azure SQL server instance.
14+
param sqlAdminUserName string
15+
16+
// Define the password of the administrator login for the Azure SQL server instance.
17+
@secure()
18+
param sqlAdminPassword string
19+
20+
// Define the Azure Key vault secret name of the administrator login password for the Azure SQL server instance.
21+
param sqlAdminPassword_secretName string
22+
23+
// Define the name of the Azure SQL database that will be created within the Azure SQL server instance.
24+
param sqlDatabaseName string
25+
26+
// Define the name of the integration account that will be created.
27+
param integrationAccountName string
28+
29+
// Define the name of the Key Vault.
30+
param keyVaultName string
31+
32+
// Define the Service Principal ID that needs access full access to the deployed resource group.
33+
param servicePrincipal_objectId string
34+
35+
module storageAccount 'br/public:avm/res/storage/storage-account:0.9.1' = {
36+
name: 'storageAccountDeployment'
37+
params: {
38+
name: storageAccountName
39+
location: location
40+
allowBlobPublicAccess: true
41+
publicNetworkAccess: 'Enabled'
42+
networkAcls: {
43+
bypass: 'AzureServices'
44+
defaultAction: 'Allow'
45+
ipRules: []
46+
virtualNetworkRules: []
47+
}
48+
roleAssignments: [
49+
{
50+
principalId: servicePrincipal_objectId
51+
roleDefinitionIdOrName: 'Storage Blob Data Contributor'
52+
}
53+
{
54+
principalId: servicePrincipal_objectId
55+
roleDefinitionIdOrName: 'Storage Table Data Contributor'
56+
}
57+
]
58+
}
59+
}
60+
61+
module serverfarm 'br/public:avm/res/web/serverfarm:0.2.2' = {
62+
name: 'serverfarmDeployment'
63+
params: {
64+
name: '${appServiceName}-plan'
65+
skuCapacity: 2
66+
skuName: 'Y1'
67+
location: location
68+
}
69+
}
70+
71+
module functionApp 'br/public:avm/res/web/site:0.3.9' = {
72+
name: 'functionAppDeployment'
73+
params: {
74+
kind: 'functionapp'
75+
name: appServiceName
76+
serverFarmResourceId: serverfarm.outputs.resourceId
77+
location: location
78+
enableTelemetry: false
79+
siteConfig: {
80+
alwaysOn: false
81+
}
82+
}
83+
}
84+
85+
module sqlServer 'br/public:avm/res/sql/server:0.4.1' = {
86+
name: 'sqlServerDeployment'
87+
params: {
88+
name: sqlServerName
89+
location: location
90+
administratorLogin: sqlAdminUserName
91+
administratorLoginPassword: sqlAdminPassword
92+
enableTelemetry: false
93+
publicNetworkAccess: 'Enabled'
94+
restrictOutboundNetworkAccess: 'Disabled'
95+
auditSettings: {
96+
state: 'Disabled'
97+
}
98+
databases: [
99+
{
100+
name: sqlDatabaseName
101+
skuName: 'Basic'
102+
skuTier: 'Basic'
103+
maxSizeBytes: 2147483648
104+
}
105+
]
106+
}
107+
}
108+
109+
resource integrationAccount 'Microsoft.Logic/integrationAccounts@2019-05-01' = {
110+
name: integrationAccountName
111+
location: location
112+
properties: {
113+
state: 'Enabled'
114+
}
115+
sku: {
116+
name: 'Free'
117+
}
118+
}
119+
120+
module vault 'br/public:avm/res/key-vault/vault:0.6.1' = {
121+
name: 'vaultDeployment'
122+
params: {
123+
name: keyVaultName
124+
location: location
125+
enableRbacAuthorization: false
126+
sku: 'standard'
127+
accessPolicies: [
128+
{
129+
objectId: servicePrincipal_objectId
130+
permissions: {
131+
secrets: [
132+
'get', 'list', 'set', 'delete'
133+
]
134+
keys: [
135+
'get', 'list', 'create', 'delete'
136+
]
137+
}
138+
}
139+
{
140+
objectId: '0d926a02-88dc-4279-8265-fbcd8178ecb0' // (built-in) Azure Logic Apps service principal
141+
permissions: {
142+
keys: [
143+
'list', 'get', 'decrypt', 'sign'
144+
]
145+
}
146+
}
147+
]
148+
secrets: [
149+
{
150+
name: sqlAdminPassword_secretName
151+
value: sqlAdminPassword
152+
}
153+
]
154+
}
155+
}

0 commit comments

Comments
 (0)