search

microsoft / azure-pipelines-tasks

Tasks for Azure Pipelines
https://aka.ms/tfbuild
MIT License
3.51k stars 2.62k forks source link

[enhancement]: Add temporary firewall rule with Agent IP in AzureKeyVault@2 #20652

Open siliconcupcake opened 1 week ago

siliconcupcake commented 1 week ago

Task name

No response

Describe your feature request here

When we download secrets from Key Vault today, the firewall rule prevents the Agent from connecting to the vault. It seems very tedious to add the entire public Agent Pool IP range to the KV firewall rule since it's constantly changing. It would be very useful to have a setup similar to the implementation in SqlAzureDacpacDeployment@1.

  1. Get machine IP
  2. Add it to firewall rule
  3. Download the secrets
  4. Remove the firewall rule