|
| 1 | +# Logs in to Azure for use by subsequent az / kubectl / helm commands. |
| 2 | +# |
| 3 | +# Prefers Workload Identity Federation (WIF) when a `serviceConnection` |
| 4 | +# name is supplied. Falls back to `az login --identity` for pools that |
| 5 | +# still have a Managed Identity assigned. Pipelines whose pool MI was |
| 6 | +# removed must pass a WIF-capable service connection; without one the |
| 7 | +# MI path will fail. |
| 8 | +parameters: |
| 9 | + - name: serviceConnection |
| 10 | + type: string |
| 11 | + default: '' |
| 12 | + |
| 13 | +steps: |
| 14 | + - script: az --version || sudo tdnf install -y azure-cli |
| 15 | + displayName: "Install azure-cli (if missing)" |
| 16 | + |
| 17 | + - ${{ if ne(parameters.serviceConnection, '') }}: |
| 18 | + - task: AzureCLI@2 |
| 19 | + displayName: "Extract WIF identity" |
| 20 | + inputs: |
| 21 | + azureSubscription: ${{ parameters.serviceConnection }} |
| 22 | + addSpnToEnvironment: true |
| 23 | + scriptType: bash |
| 24 | + scriptLocation: inlineScript |
| 25 | + inlineScript: | |
| 26 | + set -u |
| 27 | + echo "servicePrincipalId set: ${servicePrincipalId:+yes} (len=${#servicePrincipalId})" |
| 28 | + echo "tenantId set: ${tenantId:+yes} (len=${#tenantId})" |
| 29 | + echo "idToken set: ${idToken:+yes} (len=${#idToken})" |
| 30 | + echo "##vso[task.setvariable variable=ARM_CLIENT_ID]$servicePrincipalId" |
| 31 | + echo "##vso[task.setvariable variable=ARM_ID_TOKEN;issecret=true]$idToken" |
| 32 | + echo "##vso[task.setvariable variable=ARM_TENANT_ID]$tenantId" |
| 33 | +
|
| 34 | + - bash: | |
| 35 | + set -eu |
| 36 | + az login \ |
| 37 | + --service-principal \ |
| 38 | + -u "$(ARM_CLIENT_ID)" \ |
| 39 | + --tenant "$(ARM_TENANT_ID)" \ |
| 40 | + --allow-no-subscriptions \ |
| 41 | + --federated-token "$(ARM_ID_TOKEN)" > /dev/null |
| 42 | + az account set -s=$(AZURE_SUBSCRIPTION_ID) |
| 43 | + displayName: "az login (WIF)" |
| 44 | + - ${{ else }}: |
| 45 | + - script: | |
| 46 | + az login -i > /dev/null |
| 47 | + az account set -s=$(AZURE_SUBSCRIPTION_ID) |
| 48 | + displayName: "az login (managed identity)" |
0 commit comments