Skip to content

Commit 66731ad

Browse files
KirtiWandhareknithinc
KirtiWandhare
authored and
knithinc
committed
Update Canary.Tests.ps1 (#227)
1 parent e81a8cd commit 66731ad

1 file changed

Lines changed: 126 additions & 0 deletions

File tree

‎CanaryValidator/Canary.Tests.ps1‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,7 @@ while ($runCount -le $NumberOfIterations)
171171
-ResourceManagerEndpoint ($asEndpoints.ResourceManagerEndpoint) `
172172
-GalleryEndpoint ($asEndpoints.GalleryEndpoint) `
173173
-GraphEndpoint ($asEndpoints.GraphEndpoint) `
174+
-GraphAudience ($asEndpoints.GraphEndpoint) `
174175
-StorageEndpointSuffix ($asEndpoints.StorageEndpointSuffix) `
175176
-AzureKeyVaultDnsSuffix ($asEndpoints.AzureKeyVaultDnsSuffix) `
176177
-EnableAdfsAuthentication:$asEndpoints.ActiveDirectoryEndpoint.TrimEnd("/").EndsWith("/adfs", [System.StringComparison]::OrdinalIgnoreCase) `
@@ -335,6 +336,7 @@ while ($runCount -le $NumberOfIterations)
335336
-ResourceManagerEndpoint ($asEndpoints.ResourceManagerEndpoint) `
336337
-GalleryEndpoint ($asEndpoints.GalleryEndpoint) `
337338
-GraphEndpoint ($asEndpoints.GraphEndpoint) `
339+
-GraphAudience ($asEndpoints.GraphEndpoint) `
338340
-StorageEndpointSuffix ($asEndpoints.StorageEndpointSuffix) `
339341
-AzureKeyVaultDnsSuffix ($asEndpoints.AzureKeyVaultDnsSuffix) `
340342
-EnableAdfsAuthentication:$asEndpoints.ActiveDirectoryEndpoint.TrimEnd("/").EndsWith("/adfs", [System.StringComparison]::OrdinalIgnoreCase) `
@@ -391,6 +393,130 @@ while ($runCount -le $NumberOfIterations)
391393
}
392394
}
393395

396+
Invoke-Usecase -Name 'RoleAssignmentAndCustomRoleDefinition' -Description "Assign a reader role and create a custom role definition" -UsecaseBlock `
397+
{
398+
$readerRole = Get-AzureRmRoleDefinition -Name Reader
399+
$subscriptionID = (Get-AzureRmSubscription -SubscriptionName $tenantSubscriptionName).SubscriptionId
400+
$servicePrincipal = (Get-AzureRmADServicePrincipal)[0]
401+
$customRoleName = "CustomCanaryRole-" + [Random]::new().Next(1,99)
402+
403+
if ($readerRole)
404+
{
405+
Invoke-Usecase -Name 'ListAssignedRoles' -Description "List assigned roles to Service Principle - $($servicePrincipal.DisplayName)" -UsecaseBlock `
406+
{
407+
Get-AzureRmRoleAssignment -ObjectId $servicePrincipal.Id -ErrorAction Stop
408+
}
409+
410+
$allAssignedRoles = Get-AzureRmRoleAssignment -ObjectId $servicePrincipal.Id -ErrorAction Stop
411+
if (-not $allAssignedRoles -or ($allAssignedRoles -and -not ($allAssignedRoles | Where-Object {$_.RoleDefinitionName -eq $readerRole.Name})))
412+
{
413+
Invoke-Usecase -Name 'AssignReaderRole' -Description "Assign Reader role to Service Principle - $($servicePrincipal.DisplayName)" -UsecaseBlock `
414+
{
415+
New-AzureRmRoleAssignment -Scope "/Subscriptions/$subscriptionID" -RoleDefinitionName $readerRole.Name -ObjectId $servicePrincipal.Id -ErrorAction Stop
416+
}
417+
418+
Invoke-Usecase -Name 'VerifyReaderRoleAssignment' -Description "Verify if the Service Principle has got Reader role assigned successfully" -UsecaseBlock `
419+
{
420+
if (-not (Get-AzureRmRoleAssignment -RoleDefinitionName $readerRole.Name -Scope "/Subscriptions/$subscriptionID" -ErrorAction Stop))
421+
{
422+
throw [System.Exception] "Unable to assign role ($readerRole.Name) to Service Principle ($servicePrincipal.Id) for subscription $tenantSubscriptionName"
423+
}
424+
}
425+
426+
if (Get-AzureRmRoleAssignment -RoleDefinitionName $readerRole.Name -Scope "/Subscriptions/$subscriptionID" -ErrorAction Stop)
427+
{
428+
Invoke-Usecase -Name 'RemoveReaderRoleAssignment' -Description "Remove Reader role assignment from Service Principle - $($servicePrincipal.DisplayName)" -UsecaseBlock `
429+
{
430+
Remove-AzureRmRoleAssignment -Scope "/Subscriptions/$subscriptionID" -RoleDefinitionName $readerRole.Name -ObjectId $servicePrincipal.Id -Force -ErrorAction Stop
431+
}
432+
}
433+
}
434+
}
435+
436+
Invoke-Usecase -Name 'ListExistingRoleDefinitions' -Description "List existing Role Definitions" -UsecaseBlock `
437+
{
438+
$availableRoles = Get-AzureRmRoleDefinition -ErrorAction Stop
439+
if (-not $availableRoles)
440+
{
441+
throw [System.Exception] "No roles are available."
442+
}
443+
else
444+
{
445+
$availableRoles
446+
$availableRolesNames = $availableRoles.Name
447+
$mustHaveRoles = @("Owner", "Reader", "Contributor")
448+
$match = Compare-Object $mustHaveRoles $availableRolesNames
449+
if ($match -and ($match | Where-Object {$_.SideIndicator -eq "<="}))
450+
{
451+
$notAvailableRoles = ($match | Where-Object {$_.SideIndicator -eq "<="}).InputObject
452+
throw [System.Exception] "Some must have Role Definitions are not available. Number of missing Role Definitions - $($notAvailableRoles.Count). Missing Role Definitions - $notAvailableRoles"
453+
}
454+
}
455+
}
456+
457+
if (-not (Get-AzureRmRoleDefinition -Name $customRoleName))
458+
{
459+
Invoke-Usecase -Name 'CustomRoleDefinition' -Description "Create a custom Role Definition - $customRoleName" -UsecaseBlock `
460+
{
461+
$role = Get-AzureRmRoleDefinition -Name Reader
462+
$role.Id = $null
463+
$role.Name = $customRoleName
464+
$role.Description = "Custom role definition for Canary"
465+
$role.Actions.Clear()
466+
$role.Actions.Add("Microsoft.Authorization/*/Read")
467+
$role.AssignableScopes.Clear()
468+
$role.AssignableScopes.Add("/Subscriptions/$subscriptionID")
469+
New-AzureRmRoleDefinition -Role $role -ErrorAction Stop
470+
if (-not (Get-AzureRmRoleDefinition -Name $customRoleName -Scope "/Subscriptions/$subscriptionID" -ErrorAction Stop))
471+
{
472+
throw [System.Exception] "Unable to create custom role ($customRoleName) for subscription $tenantSubscriptionName"
473+
}
474+
}
475+
476+
if(Get-AzureRmRoleDefinition -Name $customRoleName -Scope "/Subscriptions/$subscriptionID" -ErrorAction Stop)
477+
{
478+
Invoke-Usecase -Name 'RemoveCustomRoleDefinition' -Description "Remove custom role definition - $customRoleName" -UsecaseBlock `
479+
{
480+
Remove-AzureRmRoleDefinition -Name $customRoleName -Scope "/Subscriptions/$subscriptionID" -Force -ErrorAction Stop
481+
}
482+
}
483+
}
484+
485+
Invoke-Usecase -Name 'GetProviderOperations' -Description "Get provider operations for all resource providers" -UsecaseBlock `
486+
{
487+
$resourceProviders = Get-AzureRmResourceProvider -ListAvailable
488+
# Some of the RPs have not implemented their operations API yet. So update this exclusion list whenever any RP implements its operations API
489+
$rpOperationsExclusionList = @("Microsoft.Compute", "Microsoft.Commerce", "Microsoft.Gallery", "Microsoft.Insights")
490+
$totalOperationsPerRP = @()
491+
foreach($rp in $resourceProviders)
492+
{
493+
$operations = Get-AzureRMProviderOperation "$($rp.ProviderNamespace)/*" -ErrorAction Stop
494+
$operationObj = New-Object -TypeName System.Object
495+
$operationObj | Add-Member -Type NoteProperty -Name ResourceProvider -Value $rp.ProviderNamespace
496+
if (-not $operations)
497+
{
498+
$operationObj | Add-Member -Type NoteProperty -Name TotalProviderOperations -Value 0
499+
}
500+
else
501+
{
502+
$operationObj | Add-Member -Type NoteProperty -Name TotalProviderOperations -Value $operations.Count
503+
}
504+
$totalOperationsPerRP += $operationObj
505+
}
506+
$totalOperationsPerRP
507+
if ($totalOperationsPerRP -and ($totalOperationsPerRP | Where-Object {$_.TotalProviderOperations -eq 0}))
508+
{
509+
$rpWithNoOperations = ($totalOperationsPerRP | Where-Object {$_.TotalProviderOperations -eq 0}).ResourceProvider
510+
$match = Compare-Object $rpOperationsExclusionList $rpWithNoOperations
511+
if ($match -and ($match | Where-Object {$_.SideIndicator -eq "=>"}))
512+
{
513+
$missed = ($match | Where-Object {$_.SideIndicator -eq "=>"}).InputObject
514+
throw [System.Exception] "Some Resource Providers have zero Provider Operations. Number of Resource Providers with zero Provider Operations - $($missed.Count). Resource Providers with zero Provider Operations - $missed"
515+
}
516+
}
517+
}
518+
}
519+
394520
Invoke-Usecase -Name 'RegisterResourceProviders' -Description "Register resource providers" -UsecaseBlock `
395521
{
396522
Get-AzureRmResourceProvider -ListAvailable | Register-AzureRmResourceProvider -Force

0 commit comments

Comments
 (0)