Skip to content

Commit c1a09f3

Browse files
vthiebaut10andyleejordan
vthiebaut10
authored and
andyleejordan
committed
Add steps to deploy module to ACR
1 parent d65c0d7 commit c1a09f3

7 files changed

Lines changed: 401 additions & 5 deletions

File tree

‎.pipelines/SecretManagement-Official.yml‎

Lines changed: 161 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,17 @@ parameters:
2626
default: false
2727

2828
variables:
29-
system.debug: ${{ parameters.debug }}
30-
BuildConfiguration: Release
31-
WindowsContainerImage: onebranch.azurecr.io/windows/ltsc2022/vse2022:latest
32-
DOTNET_NOLOGO: true
33-
DOTNET_GENERATE_ASPNET_CERTIFICATE: false
29+
- name: system.debug
30+
value: ${{ parameters.debug }}
31+
- name: BuildConfiguration
32+
value: Release
33+
- name: WindowsContainerImage
34+
value: onebranch.azurecr.io/windows/ltsc2022/vse2022:latest
35+
- name: DOTNET_NOLOGO
36+
value: true
37+
- name: DOTNET_GENERATE_ASPNET_CERTIFICATE
38+
value: false
39+
- group: SecretManagementAcr
3440

3541
resources:
3642
repositories:
@@ -185,3 +191,153 @@ extends:
185191
packagesToPush: $(drop)/Microsoft.PowerShell.SecretManagement.Library.$(version).nupkg
186192
nuGetFeedType: external
187193
publishFeedCredentials: PowerShellNuGetOrgPush
194+
- stage: PrepForEv2
195+
condition: ne(variables['Build.Reason'], 'Schedule')
196+
dependsOn: build
197+
variables:
198+
drop: $(Pipeline.Workspace)/drop_build_main
199+
version: $[ stageDependencies.build.main.outputs['package.version'] ]
200+
jobs:
201+
- job: CopyEv2FilesToArtifact
202+
displayName: Copy Ev2 Files To Artifact
203+
variables:
204+
- name: ob_outputDirectory
205+
value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
206+
pool:
207+
timeoutInMinutes: 30
208+
type: windows
209+
steps:
210+
- task: onebranch.pipeline.signing@1
211+
displayName: Sign 1st Party Files
212+
inputs:
213+
command: 'sign'
214+
signing_profile: external_distribution
215+
files_to_sign: '**\*.ps1'
216+
search_root: '$(Build.SourcesDirectory)/EV2Specs/ServiceGroupRoot/Shell'
217+
- download: current
218+
displayName: Download artifacts
219+
- pwsh: |
220+
$modulePath = Join-Path $(drop) -ChildPath 'Microsoft.PowerShell.SecretManagement.$(version).nupkg'
221+
$fileExists = Test-Path $modulePath
222+
Write-Verbose -Verbose "Module file $modulePath Exists: $fileExists"
223+
224+
$srcDir = Join-Path '$(Build.SourcesDirectory)/EV2Specs/ServiceGroupRoot' -ChildPath 'SrcFiles'
225+
New-Item $srcDir -ItemType Directory
226+
227+
$dest = Join-Path $srcDir -ChildPath 'Microsoft.PowerShell.SecretManagement.$(version).nupkg'
228+
Copy-Item -Path $modulePath -Destination $dest
229+
230+
Get-ChildItem '$(Build.SourcesDirectory)/EV2Specs/ServiceGroupRoot/SrcFiles/'
231+
displayName: Move artifact to Ev2 folder
232+
- pwsh: |
233+
$srcPath = Join-Path '$(Build.SourcesDirectory)/EV2Specs/ServiceGroupRoot' -ChildPath 'Shell'
234+
$pathToRunTarFile = Join-Path '$(Build.SourcesDirectory)/EV2Specs/ServiceGroupRoot/Shell' -ChildPath "Run.tar"
235+
tar -cvf $pathToRunTarFile -C $srcPath ./Run
236+
$tarExists = Test-Path $pathToRunTarFile
237+
Write-Verbose -Verbose "Tar file $pathToRunTarFile exists: $tarExists"
238+
displayName: Compress Run script into tar file as needed for EV2 Shell extension
239+
- pwsh: |
240+
$pathToJsonFile = Join-Path -Path '$(Build.SourcesDirectory)/EV2Specs/ServiceGroupRoot' -ChildPath 'SecretManagementToACR.Rollout.json'
241+
$content = Get-Content -Path $pathToJsonFile | ConvertFrom-Json
242+
$envVarArrayLen = $content.shellExtensions.launch.environmentVariables.Length
243+
244+
[xml]$xml = Get-Content Directory.Build.props
245+
$version = $xml.Project.PropertyGroup.ModuleVersion
246+
247+
for ($i=0; $i -lt $envVarArrayLen; $i++)
248+
{
249+
$name = $($content.shellExtensions.launch.environmentVariables[$i].name)
250+
if ($name -eq "DESTINATION_ACR_NAME")
251+
{
252+
$content.shellExtensions.launch.environmentVariables[$i].value = '$(acr_name)'
253+
Write-Verbose -Verbose "ACR Name: $($content.shellExtensions.launch.environmentVariables[$i].value)"
254+
}
255+
elseif ($name -eq "DESTINATION_ACR_URI")
256+
{
257+
$content.shellExtensions.launch.environmentVariables[$i].value = '$(acr_uri)'
258+
Write-Verbose -Verbose "ACR URI: $($content.shellExtensions.launch.environmentVariables[$i].value)"
259+
}
260+
elseif ($name -eq "MI_NAME")
261+
{
262+
$content.shellExtensions.launch.environmentVariables[$i].value = '$(managed_identity_name)'
263+
Write-Verbose -Verbose "MI Name: $($content.shellExtensions.launch.environmentVariables[$i].value)"
264+
}
265+
elseif ($name -eq "MI_CLIENTID")
266+
{
267+
$content.shellExtensions.launch.environmentVariables[$i].value = '$(managed_identity_clientid)'
268+
Write-Verbose -Verbose "MI Client ID: $($content.shellExtensions.launch.environmentVariables[$i].value)"
269+
}
270+
elseif($name -eq "SECRET_MANAGEMENT_VERSION")
271+
{
272+
$content.shellExtensions.launch.environmentVariables[$i].value = $version
273+
Write-Verbose -Verbose "Module version: $($content.shellExtensions.launch.environmentVariables[$i].value)"
274+
}
275+
elseif($name -eq "SECRET_MANAGEMENT_MODULE")
276+
{
277+
$content.shellExtensions.launch.environmentVariables[$i].reference.path = "SrcFiles\\Microsoft.PowerShell.SecretManagement.$(version).nupkg"
278+
Write-Verbose -Verbose "Module Path: $($content.shellExtensions.launch.environmentVariables[$i].reference.path)"
279+
}
280+
}
281+
282+
$identityString = "/subscriptions/$(acr_subscription)/resourcegroups/$(acr_resource_group)/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$(managed_identity_name)"
283+
$content.shellExtensions.launch.identity.userAssignedIdentities[0] = $identityString
284+
285+
Remove-Item -Path $pathToJsonFile
286+
$content | ConvertTo-Json -Depth 6 | Out-File $pathToJsonFile
287+
288+
displayName: 'Replace values in SecretManagementToACR.Rollout.json file'
289+
- pwsh: |
290+
$pathToJsonFile = Join-Path -Path '$(Build.SourcesDirectory)/EV2Specs/ServiceGroupRoot' -ChildPath 'RolloutSpec.json'
291+
$content = Get-Content -Path $pathToJsonFile | ConvertFrom-Json
292+
$content.RolloutMetadata.Notification.Email.To = '$(email_address)'
293+
294+
Remove-Item -Path $pathToJsonFile
295+
$content | ConvertTo-Json -Depth 4 | Out-File $pathToJsonFile
296+
297+
displayName: 'Replace values in RolloutSpecPath.json'
298+
- pwsh: |
299+
$pathToJsonFile = Join-Path -Path '$(Build.SourcesDirectory)/EV2Specs/ServiceGroupRoot' -ChildPath 'ServiceModel.json'
300+
$content = Get-Content -Path $pathToJsonFile | ConvertFrom-Json
301+
$content.ServiceResourceGroups[0].AzureResourceGroupName = '$(acr_resource_group)'
302+
$content.ServiceResourceGroups[0].AzureSubscriptionId = '$(acr_subscription)'
303+
304+
Remove-Item -Path $pathToJsonFile
305+
$content | ConvertTo-Json -Depth 9 | Out-File $pathToJsonFile
306+
307+
displayName: 'Replace values in ServiceModel.json'
308+
- task: CopyFiles@2
309+
inputs:
310+
Contents: 'EV2Specs/**'
311+
TargetFolder: $(ob_outputDirectory)
312+
- stage: 'Prod_release'
313+
displayName: Deploy Images to ACR with EV2
314+
dependsOn:
315+
- PrepForEV2
316+
variables:
317+
- name: ob_release_environment
318+
value: "Production"
319+
- name: repoRoot
320+
value: $(Build.SourcesDirectory)
321+
jobs:
322+
- job: Prod_ReleaseJob
323+
pool:
324+
type: release
325+
steps:
326+
- task: DownloadPipelineArtifact@2
327+
inputs:
328+
targetPath: '$(Pipeline.Workspace)'
329+
artifact: drop_PrepForEV2_CopyEv2FilesToArtifact
330+
displayName: 'Download drop_PrepForEV2_CopyEv2FilesToArtifact artifact that has all files needed'
331+
- task: DownloadPipelineArtifact@2
332+
inputs:
333+
buildType: 'current'
334+
targetPath: '$(Pipeline.Workspace)'
335+
displayName: 'Download to get EV2 Files'
336+
- task: vsrm-ev2.vss-services-ev2.adm-release-task.ExpressV2Internal@1
337+
displayName: 'Ev2: Push to ACR'
338+
inputs:
339+
UseServerMonitorTask: true
340+
EndpointProviderType: ApprovalService
341+
ApprovalServiceEnvironment: Production
342+
ServiceRootPath: '$(Pipeline.Workspace)/drop_PrepForEV2_CopyEv2FilesToArtifact/EV2Specs/ServiceGroupRoot'
343+
RolloutSpecPath: '$(Pipeline.Workspace)/drop_PrepForEV2_CopyEv2FilesToArtifact/EV2Specs/ServiceGroupRoot/RolloutSpec.json'

‎ServiceGroupRoot/RolloutSpec.json‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
{
2+
"$schema": "https://ev2schema.azure.net/schemas/2020-01-01/rolloutSpecification.json",
3+
"contentVersion": "1.0.0.0",
4+
"RolloutMetadata": {
5+
"ServiceModelPath": "ServiceModel.json",
6+
"ScopeBindingsPath": "ScopeBindings.json",
7+
"Name": "OneBranch-Demo-Container-Deployment",
8+
"RolloutType": "Major",
9+
"BuildSource": {
10+
"Parameters": {
11+
"VersionFile": "buildver.txt"
12+
}
13+
},
14+
"Notification": {
15+
"Email": {
16+
"To": "default"
17+
}
18+
}
19+
},
20+
"OrchestratedSteps": [
21+
{
22+
"Name": "UploadSecretManagementToACR",
23+
"TargetType": "ServiceResource",
24+
"TargetName": "SecretManagementToACR",
25+
"Actions": ["Shell/Run"]
26+
}
27+
]
28+
}

‎ServiceGroupRoot/ScopeBindings.json‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{
2+
"$schema": "https://ev2schema.azure.net/schemas/2020-01-01/scopeBindings.json",
3+
"contentVersion": "0.0.0.1",
4+
"scopeBindings": [
5+
{
6+
"scopeTagName": "Global",
7+
"bindings": [
8+
{
9+
"find": "__SUBSCRIPTION_ID__",
10+
"replaceWith": "$azureSubscriptionId()"
11+
},
12+
{
13+
"find": "__RESOURCE_GROUP__",
14+
"replaceWith": "$azureResourceGroup()"
15+
},
16+
{
17+
"find": "__BUILD_VERSION__",
18+
"replaceWith": "$buildVersion()"
19+
}
20+
]
21+
}
22+
]
23+
}

‎ServiceGroupRoot/SecretManagementToACR.Rollout.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"$schema": "https://ev2schema.azure.net/schemas/2020-01-01/rolloutParameters.json",
3+
"contentVersion": "1.0.0.0",
4+
"shellExtensions": [
5+
{
6+
"name": "Run",
7+
"type": "Run",
8+
"properties": {
9+
"maxExecutionTime": "PT2H"
10+
},
11+
"package": {
12+
"reference": {
13+
"path": "Shell/Run.tar"
14+
}
15+
},
16+
"launch": {
17+
"command": [
18+
"/bin/bash",
19+
"-c",
20+
"pwsh ./Run/Run.ps1"
21+
],
22+
"environmentVariables": [
23+
{
24+
"name": "SECRET_MANAGEMENT_MODULE",
25+
"reference":
26+
{
27+
"path": "SrcFiles\\Microsoft.PowerShell.SecretManagement.nupkg"
28+
}
29+
},
30+
{
31+
"name": "DESTINATION_ACR_NAME",
32+
"value": "default"
33+
},
34+
{
35+
"name": "MI_NAME",
36+
"value": "default"
37+
},
38+
{
39+
"name": "MI_CLIENTID",
40+
"value": "default"
41+
},
42+
{
43+
"name": "SECRET_MANAGEMENT_VERSION",
44+
"value": "default"
45+
},
46+
{
47+
"name": "DESTINATION_ACR_URI",
48+
"value": "default"
49+
}
50+
],
51+
"identity": {
52+
"type": "userAssigned",
53+
"userAssignedIdentities": [
54+
"default"
55+
]
56+
}
57+
}
58+
}
59+
]
60+
}

‎ServiceGroupRoot/ServiceModel.json‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
{
2+
"$schema": "https://ev2schema.azure.net/schemas/2020-01-01/serviceModel.json",
3+
"contentVersion": "1.0.0.0",
4+
"ServiceMetadata": {
5+
"ServiceGroup": "OneBranch-SecretManagement",
6+
"Environment": "Test"
7+
},
8+
"ServiceResourceGroupDefinitions": [
9+
{
10+
"Name": "OneBranch-SecretManagement-RGDef",
11+
"ServiceResourceDefinitions": [
12+
{
13+
"Name": "OneBranch-SecretManagement.Shell-SRDef",
14+
"composedOf": {
15+
"extension": {
16+
"shell": [
17+
{
18+
"type": "Run",
19+
"properties": {
20+
"imageName": "adm-mariner-20-l",
21+
"imageVersion": "v5"
22+
}
23+
}
24+
]
25+
}
26+
}
27+
}
28+
]
29+
}
30+
],
31+
"ServiceResourceGroups": [
32+
{
33+
"AzureResourceGroupName": "default",
34+
"Location": "East US",
35+
"InstanceOf": "OneBranch-SecretManagement-RGDef",
36+
"AzureSubscriptionId": "default",
37+
"scopeTags": [
38+
{
39+
"name": "Global"
40+
}
41+
],
42+
"ServiceResources": [
43+
{
44+
"Name": "SecretManagementToACR",
45+
"InstanceOf": "OneBranch-SecretManagement.Shell-SRDef",
46+
"RolloutParametersPath": "SecretManagementToACR.Rollout.json"
47+
}
48+
]
49+
}
50+
]
51+
}

0 commit comments

Comments
 (0)