Skip to content

Commit e0b4f97

Browse files
stijnmoreelsstijnmoreels
authored
chore: deploy test resources w/ new test packages (#433)
* chore: deploy test resources * pr-fix: missing assignment keyword * pr-fix: correct rg assignment * pr-fix: key vault name assignment * pr-fix: add location param + correct existing service principal condition * pr-fix: add depends on * pr-fix: use correct way to retrieve secret version * pr-fix: add logging for sp-related commands * pr-fix: use solely security-related resources * pr-fix: add logging for secret version * pr-fix: add secret version other way * pr-fix: use property outputs * pr-fix: add logging for deploy outputs * pr-fix: correct new output variable assignment * pr-fix: mark as string * pr-add: integrate tests and key vault * pr-fix: hashicorp template path * pr-fix: add devops resources * pr-fix: add test variables * pr-fix: az identity vulnerability * pr-fix: correct secret value * pr-fix: run secret retrieval as a pre-job * pr-fix: get own key vault secrets * pr-fix: correct parameters * pr-fix: install module az.keyvault * pr-fix: use az keyvault * pr-fix: use client id as var * pr-fix: remove app insights reference * pr-fix: add infra smoke tests * pr-fix: use az cli task * pr-fix: argument syntax * pr-fix: add enabled assertion * pr-fix: correct running * pr-fix: add az module * pr-fix: use new arguments syntax * pr-fix: use higher version of pester * pr-fix: use at least 5.3.0 * pr-fix: use env variables * pr-fix: correct test result * pr-fix: import module * pr-fix: remove param * pr-fix: enable test result * pr-fix: correct env vars * pr-fix: use other env vars * pr-fix: use correct secret version extraction * pr-fix: use pester container for external data * pr-fix: broaden test assertion + trim secret version setup * pr-fix: simplify config value retrieval * pr-fix: remove any spaces from version and secret * pr-fix: use direct setting of variable * pr-fix: clean tests * pr-fix: remove tried smoke tests * Update Arcus.Security.Providers.AzureKeyVault.csproj * Update Arcus.Security.Providers.AzureKeyVault.csproj * pr-fix: use most recent test fixtures * pr-fix: use correct unauthorized secret names * pr-fix: remove remote resource group * Update deploy-test-resources.yml * Update deploy-test-resources.yml * Update deploy-test-resources.yml
1 parent f5e02f2 commit e0b4f97

26 files changed

+433
-513
lines changed

‎build/ci-build.yml

+5-8
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,10 @@ parameters:
1818
- name: 'Package.Version.ManualTrigger'
1919
type: string
2020
default: 'preview'
21+
- name: azureServiceConnection
22+
displayName: 'Azure service connection'
23+
type: string
24+
default: 'Azure Codit-Arcus Service Principal'
2125

2226
resources:
2327
repositories:
@@ -27,9 +31,6 @@ resources:
2731
endpoint: arcus-azure
2832

2933
variables:
30-
# 'Arcus_ServicePrincipal_AccessKey' is added as secret on build in Azure DevOps
31-
- group: 'Arcus Security - Integration Testing'
32-
- group: 'Arcus - GitHub Package Registry'
3334
- group: 'Build Configuration'
3435
- template: ./variables/build.yml
3536
- template: ./variables/test.yml
@@ -106,14 +107,10 @@ stages:
106107
inputs:
107108
artifact: 'Build'
108109
path: '$(Build.SourcesDirectory)'
109-
- template: 'templates/download-hashicorp-vault.yml'
110-
parameters:
111-
targetFolder: '$(Build.SourcesDirectory)'
112-
version: $(HashiCorp.Vault.Version)
113-
vaultBinVariableName: 'Arcus.HashiCorp.VaultBin'
114110
- template: templates/run-integration-tests.yml
115111
parameters:
116112
dockerProjectName: '$(Project).Tests.Runtimes.AzureFunctions'
113+
azureServiceConnection: '${{ parameters.azureServiceConnection }}'
117114

118115
- stage: ReleaseToMyget
119116
displayName: 'Release to MyGet'

‎build/deploy-test-resources.yml

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
name: Arcus Security - Deploy test resources
2+
3+
trigger: none
4+
pr: none
5+
6+
parameters:
7+
- name: azureServiceConnection
8+
displayName: 'Azure service connection'
9+
type: string
10+
default: 'Azure Codit-Arcus Service Principal'
11+
- name: resourceGroupName
12+
displayName: 'Resource group name'
13+
default: arcus-security-dev-we-rg
14+
15+
variables:
16+
- template: ./variables/build.yml
17+
- template: ./variables/test.yml
18+
19+
resources:
20+
repositories:
21+
- repository: templates
22+
type: github
23+
name: arcus-azure/azure-devops-templates
24+
endpoint: arcus-azure
25+
26+
stages:
27+
- stage: Deploy
28+
jobs:
29+
- job: DeployBicep
30+
displayName: 'Deploy test resources'
31+
pool:
32+
vmImage: '$(Vm.Image)'
33+
steps:
34+
- task: AzureCLI@2
35+
inputs:
36+
azureSubscription: '${{ parameters.azureServiceConnection }}'
37+
addSpnToEnvironment: true
38+
scriptType: 'pscore'
39+
scriptLocation: 'inlineScript'
40+
inlineScript: |
41+
$secretName = $env:ARCUS_SECURITY_KEYVAULT_TESTSECRETNAME
42+
$secretValue = [System.Guid]::NewGuid().ToString()
43+
$objectId = (az ad sp show --id $env:servicePrincipalId | ConvertFrom-Json).id
44+
45+
az deployment sub create `
46+
--location westeurope `
47+
--template-file ./build/templates/deploy-test-resources.bicep `
48+
--parameters location=westeurope `
49+
--parameters resourceGroupName=${{ parameters.resourceGroupName }} `
50+
--parameters keyVaultName=$env:ARCUS_SECURITY_KEYVAULT_NAME `
51+
--parameters secretName=$secretName `
52+
--parameters secretValue=$secretValue `
53+
--parameters servicePrincipal_objectId=$objectId `
54+
| ConvertFrom-Json

‎build/nuget-release.yml

-7
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,6 @@ resources:
1515
endpoint: arcus-azure
1616

1717
variables:
18-
- group: 'Arcus Security - Integration Testing'
19-
- group: 'Arcus - GitHub Package Registry'
2018
- group: 'Build Configuration'
2119
- template: ./variables/build.yml
2220
- template: ./variables/test.yml
@@ -92,11 +90,6 @@ stages:
9290
inputs:
9391
artifact: 'Build'
9492
path: '$(Build.SourcesDirectory)'
95-
- template: 'templates/download-hashicorp-vault.yml'
96-
parameters:
97-
targetFolder: '$(Build.SourcesDirectory)'
98-
version: $(HashiCorp.Vault.Version)
99-
vaultBinVariableName: 'Arcus.HashiCorp.VaultBin'
10093
- template: templates/run-integration-tests.yml
10194
parameters:
10295
dockerProjectName: '$(Project).Tests.Runtimes.AzureFunctions'

‎build/templates/deploy-test-resources.bicep

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
// Define the location for the deployment of the components.
2+
param location string
3+
4+
// Define the name of the resource group where the components will be deployed.
5+
param resourceGroupName string
6+
7+
// Define the name of the Key vault.
8+
param keyVaultName string
9+
10+
// Define the name of the secret that will be added to the Key vault.
11+
param secretName string
12+
13+
// Define the secret value that will be by default added to the Key vault.
14+
@secure()
15+
param secretValue string
16+
17+
// Define the Service Principal ID that needs access full access to the deployed resource group.
18+
param servicePrincipal_objectId string
19+
20+
targetScope='subscription'
21+
22+
module resourceGroup 'br/public:avm/res/resources/resource-group:0.2.3' = {
23+
name: 'resourceGroupDeployment'
24+
params: {
25+
name: resourceGroupName
26+
location: location
27+
}
28+
}
29+
30+
resource rg 'Microsoft.Resources/resourceGroups@2021-04-01' existing = {
31+
name: resourceGroupName
32+
}
33+
34+
module vault 'br/public:avm/res/key-vault/vault:0.6.1' = {
35+
name: 'vaultDeployment'
36+
dependsOn: [
37+
resourceGroup
38+
]
39+
scope: rg
40+
params: {
41+
name: keyVaultName
42+
location: location
43+
roleAssignments: [
44+
{
45+
principalId: servicePrincipal_objectId
46+
roleDefinitionIdOrName: 'Key Vault Secrets officer'
47+
}
48+
]
49+
secrets: [
50+
{
51+
name: secretName
52+
value: secretValue
53+
}
54+
]
55+
}
56+
}

‎build/templates/run-integration-tests.yml

+33
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
parameters:
22
dockerProjectName: ''
3+
azureServiceConnection: ''
34

45
steps:
56
- bash: |
@@ -9,6 +10,38 @@ steps:
910
fi
1011
env:
1112
PROJECT_NAME: ${{ parameters.dockerProjectName }}
13+
- task: AzureCLI@2
14+
displayName: 'Import secrets from Azure Key Vault'
15+
inputs:
16+
azureSubscription: '${{ parameters.azureServiceConnection }}'
17+
addSpnToEnvironment: true
18+
scriptType: 'pscore'
19+
scriptLocation: 'inlineScript'
20+
inlineScript: |
21+
Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
22+
Install-Module -Name Arcus.Scripting.DevOps -AllowClobber
23+
24+
Set-AzDevOpsVariable 'Arcus.Security.TenantId' -Value $env:tenantId -AsSecret
25+
Set-AzDevOpsVariable 'Arcus.Security.ServicePrincipal.ClientId' -Value $env:servicePrincipalId -AsSecret
26+
Set-AzDevOpsVariable 'Arcus.Security.ServicePrincipal.ClientSecret' -Value $env:servicePrincipalKey -AsSecret
27+
28+
$unauthorizedClientId = az keyvault secret show --name $env:ARCUS_GENERAL_UNAUTHORIZED_SERVICEPRINCIPAL_CLIENTID_SECRETNAME --vault-name $env:ARCUS_GENERAL_KEYVAULT_NAME | ConvertFrom-Json
29+
$unauthorizedClientSecret = az keyvault secret show --name $env:ARCUS_GENERAL_UNAUTHORIZED_SERVICEPRINCIPAL_CLIENTSECRET_SECRETNAME --vault-name $env:ARCUS_GENERAL_KEYVAULT_NAME | ConvertFrom-Json
30+
Set-AzDevOpsVariable 'Arcus.Security.Unauthorized.ServicePrincipal.ClientId' -Value $unauthorizedClientId.value -AsSecret
31+
Set-AzDevOpsVariable 'Arcus.Security.Unauthorized.ServicePrincipal.ClientSecret' -Value $unauthorizedClientSecret.value -AsSecret
32+
33+
$testSecret = az keyvault secret show --name $env:ARCUS_SECURITY_KEYVAULT_TESTSECRETNAME --vault-name $env:ARCUS_SECURITY_KEYVAULT_NAME | ConvertFrom-Json
34+
$testSecretVersion = $testSecret.id.Split('/') | Select-Object -Last 1
35+
Write-Host "Test secret '$($testSecret.name)' version is '$testSecretVersion'"
36+
$testSecretValue = $testSecret.value
37+
38+
Set-AzDevOpsVariable -AsSecret -Name 'Arcus.Security.KeyVault.TestSecretValue' -Value $testSecretValue
39+
Set-AzDevOpsVariable -AsSecret -Name 'Arcus.Security.KeyVault.TestSecretVersion' -Value $testSecretVersion
40+
- template: 'download-hashicorp-vault.yml'
41+
parameters:
42+
targetFolder: '$(Build.SourcesDirectory)'
43+
version: $(HashiCorp.Vault.Version)
44+
vaultBinVariableName: 'Arcus.HashiCorp.VaultBin'
1245
- task: UseDotNet@2
1346
displayName: 'Import .NET Core SDK ($(DotNet.Sdk.VersionBC))'
1447
inputs:

‎build/variables/test.yml

+7-4
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
variables:
2-
Arcus.KeyVault.TestKeyName: "ArcusTestSecret"
3-
Arcus.KeyVault.TestKeyVersion: "8bde7a16366849e28b7abe26732e12e3"
4-
HashiCorp.Vault.Version: 1.5.0
5-
Arcus.AzureFunctions.HttpPort: "5000"
2+
Arcus.Security.KeyVault.Name: 'arcus-security-kv'
3+
Arcus.Security.KeyVault.TestSecretName: 'ArcusTestSecret'
4+
Arcus.General.KeyVault.Name: 'arcus-kv'
5+
Arcus.General.Unauthorized.ServicePrincipal.ClientId.SecretName: 'Arcus-Unauthorized-ServicePrincipal-ClientId'
6+
Arcus.General.Unauthorized.ServicePrincipal.ClientSecret.SecretName: 'Arcus-Unauthorized-ServicePrincipal-ClientSecret'
7+
Arcus.AzureFunctions.HttpPort: '5000'
8+
HashiCorp.Vault.Version: 1.5.0

‎src/Arcus.Security.Providers.AzureKeyVault/Arcus.Security.Providers.AzureKeyVault.csproj

+2-2
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
</ItemGroup>
2525

2626
<ItemGroup>
27-
<PackageReference Include="Azure.Identity" Version="1.10.2" />
27+
<PackageReference Include="Azure.Identity" Version="1.11.4" />
2828
<PackageReference Include="Azure.Security.KeyVault.Secrets" Version="4.5.0" />
2929
<PackageReference Include="Microsoft.Extensions.Configuration" Version="6.0.0" />
3030
<PackageReference Include="Polly" Version="7.2.1" />
@@ -34,4 +34,4 @@
3434
<ProjectReference Include="..\Arcus.Security.Core\Arcus.Security.Core.csproj" />
3535
</ItemGroup>
3636

37-
</Project>
37+
</Project>

‎src/Arcus.Security.Tests.Core/Arcus.Security.Tests.Core.csproj

+4-4
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22

33
<PropertyGroup>
4-
<TargetFramework>netstandard2.1</TargetFramework>
4+
<TargetFrameworks>net6.0;net8.0</TargetFrameworks>
55
</PropertyGroup>
66

77
<ItemGroup>
8-
<PackageReference Include="Guard.Net" Version="1.2.0" />
9-
<PackageReference Include="Arcus.Testing.Logging" Version="0.5.0" />
10-
<PackageReference Include="Arcus.Testing.Security.Providers.InMemory" Version="0.5.0" />
8+
<PackageReference Include="Guard.Net" Version="3.0.0" />
9+
<PackageReference Include="Arcus.Testing.Logging.Xunit" Version="1.0.3" />
10+
<PackageReference Include="Arcus.Testing.Security.Providers.InMemory" Version="1.0.3" />
1111
<PackageReference Include="Serilog" Version="2.10.0" />
1212
</ItemGroup>
1313

‎src/Arcus.Security.Tests.Core/Stubs/SpyLogger.cs

-45
This file was deleted.

‎src/Arcus.Security.Tests.Core/Stubs/TestLoggerProvider.cs

-36
This file was deleted.

‎src/Arcus.Security.Tests.Integration/Arcus.Security.Tests.Integration.csproj

+1
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88

99
<ItemGroup>
1010
<FrameworkReference Include="Microsoft.AspNetCore.App" />
11+
<PackageReference Include="Arcus.Testing.Core" Version="1.0.3" />
1112
<PackageReference Include="Arcus.Observability.Telemetry.Serilog.Sinks.ApplicationInsights" Version="3.0.0" />
1213
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="16.7.1" />
1314
<PackageReference Include="Serilog.Extensions.Hosting" Version="3.1.0" />

0 commit comments

Comments
 (0)