Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ci: update azure SP federated credentials #1442

Merged
merged 9 commits into from
May 8, 2024
Merged

ci: update azure SP federated credentials #1442

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
d417d10
ci: update Azure SP federated credentials
akashsinghal May 6, 2024
d7b5bc4
fix token scope
akashsinghal May 6, 2024
0608d04
upgrade az cli
akashsinghal May 6, 2024
096f28e
fix
akashsinghal May 6, 2024
d869324
update clean up trigger
akashsinghal May 7, 2024
c2a4647
update trigger
akashsinghal May 7, 2024
fa46c6a
Merge branch 'dev' into akashsinghal/azurespn
akashsinghal May 7, 2024
7e64999
updates
akashsinghal May 7, 2024
5f9861c
Merge branch 'dev' into akashsinghal/azurespn
binbin-li May 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion .github/workflows/build-pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,7 @@ jobs:
permissions:
id-token: write
contents: read
environment: aks-deploy
Copy link
Collaborator

@susanshi susanshi May 7, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was mentioned during the Meeting (but i forgot sorry) , could you remind me how the environment property is used?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

without the env, will the cached token be accessible?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure. Environment are a github construct to represent a target deployment type. So testing, dev, prod, etc. In the environment, you can setup workflows, secrets, and variables that target that environment. So in our case, we would define a new environement azure-test and this environment contains all the necessary creds for our azure e2e tests. Read more about environments here.

In our workflows, we use Azure/login action to auth. The federated credential accepts environment as one of the scopes for federated credential. This means for each unique <org>/ratify combination, we could setup one federated credential that will target an environment azure-test. This means that for deislabs we'd have one cred and for each person's fork we would have another. There are other scopes supported for federated credentials like branches however it becomes cumbersome if we want to manually trigger tests from a specific feature branch. This is why environment is helpful.

Now there is some downside (potentially) for using environment. Now, the new environment will show up on the main github repository name.
image

And what's unfortunate is that for each aks run, it generates 6 entries under Deployments and if there are failures in the latest one (this seems arbitrary what is latest of the matrix), then the deployment shows as failed.

image

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So in conclusion we have 2 options for federated credential scope.

  1. Use branch scope. This means it'll be very cumbersome to trigger AKS tests directly from a feature branch. We would need to settle on the dev branch to run all tests on your fork.
  2. Use environments with the failure reporting following the screenshots above.

steps:
- name: Check out code into the Go module directory
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
Expand All @@ -80,7 +81,9 @@ jobs:
- name: Az CLI login
uses: azure/login@6b2456866fc08b011acb422a92a4aa20e2c4de32 # v2.1.0
with:
creds: '{"clientId":"${{ env.AZURE_CLIENT_ID }}","clientSecret":"${{ secrets.AZURE_CLIENT_SECRET }}","subscriptionId":"${{ env.AZURE_SUBSCRIPTION_ID }}","tenantId":"${{ env.AZURE_TENANT_ID }}"}'
client-id: ${{ env.AZURE_CLIENT_ID }}
tenant-id: ${{ env.AZURE_TENANT_ID }}
subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }}

- name: clean up
run: |
Expand Down
33 changes: 31 additions & 2 deletions .github/workflows/e2e-aks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,18 +26,47 @@ jobs:
AZURE_SUBSCRIPTION_ID: daae1e1a-63dc-454f-825d-b39289070f79
runs-on: ubuntu-latest
timeout-minutes: 30
environment: aks-deploy
permissions:
id-token: write
contents: read
steps:
- name: Check out code into the Go module directory
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
- name: Set up Go 1.21
uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
with:
go-version: '1.21'

- name: Update az cli
run: |
sudo apt-get update
sudo apt-get install apt-transport-https ca-certificates curl gnupg lsb-release
sudo mkdir -p /etc/apt/keyrings
curl -sLS https://packages.microsoft.com/keys/microsoft.asc |
sudo gpg --dearmor -o /etc/apt/keyrings/microsoft.gpg
sudo chmod go+r /etc/apt/keyrings/microsoft.gpg
AZ_DIST=$(lsb_release -cs)
echo "Types: deb
URIs: https://packages.microsoft.com/repos/azure-cli/
Suites: ${AZ_DIST}
Components: main
Architectures: $(dpkg --print-architecture)
Signed-by: /etc/apt/keyrings/microsoft.gpg" | sudo tee /etc/apt/sources.list.d/azure-cli.sources
AZ_VER=2.60.0
sudo apt-get update && sudo apt-get install azure-cli
- name: Az CLI login
uses: azure/login@6b2456866fc08b011acb422a92a4aa20e2c4de32 # v2.1.0
with:
creds: '{"clientId":"${{ env.AZURE_CLIENT_ID }}","clientSecret":"${{ secrets.AZURE_CLIENT_SECRET }}","subscriptionId":"${{ env.AZURE_SUBSCRIPTION_ID }}","tenantId":"${{ env.AZURE_TENANT_ID }}"}'
client-id: ${{ env.AZURE_CLIENT_ID }}
tenant-id: ${{ env.AZURE_TENANT_ID }}
subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }}
- name: Cache AAD tokens
run: |
az version
# Key Vault:
az account get-access-token --scope https://vault.azure.net/.default --output none
# Container Registry:
az account get-access-token --scope https://containerregistry.azure.net/.default --output none

- name: Dependencies e2e
run: |
Expand Down
5 changes: 4 additions & 1 deletion .github/workflows/run-full-validation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,7 @@ jobs:
permissions:
id-token: write
contents: read
environment: aks-deploy
steps:
- name: Check out code into the Go module directory
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
Expand All @@ -70,7 +71,9 @@ jobs:
- name: Az CLI login
uses: azure/login@6b2456866fc08b011acb422a92a4aa20e2c4de32 # v2.1.0
with:
creds: '{"clientId":"${{ env.AZURE_CLIENT_ID }}","clientSecret":"${{ secrets.AZURE_CLIENT_SECRET }}","subscriptionId":"${{ env.AZURE_SUBSCRIPTION_ID }}","tenantId":"${{ env.AZURE_TENANT_ID }}"}'
client-id: ${{ env.AZURE_CLIENT_ID }}
tenant-id: ${{ env.AZURE_TENANT_ID }}
subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }}

- name: clean up
run: |
Expand Down
Loading