Closed hossam-nasr closed 3 months ago
Updated the main 1esmain.yml
pipeline such that it accepts a useAzureFederatedCredentials
parameter, which is passed all the way down to the test.yml
template, which includes the relevant key vault steps (and sets the relevant env vars) only if useAzureFederatedCredentials
is set to true
. I tested this on a few pipelines and confirmed that if useAzureFederatedCredentials
is false
(the default, basically no change on the client extensions side), the pipeline runs the same test step as before, and without prompting for permissions. If useAzureFederatedCredentials
parameter is set to true
, that's when the Key Vault steps are included and env vars are propagated, and that's when permissions are prompted. Since this is a template parameter and not a runtime condition, this is figured out at "compile time", no two .yml
files needed! @alexweininger Who's the plumber now? 😎
Updated the main
1esmain.yml
pipeline such that it accepts auseAzureFederatedCredentials
parameter, which is passed all the way down to thetest.yml
template, which includes the relevant key vault steps (and sets the relevant env vars) only ifuseAzureFederatedCredentials
is set totrue
. I tested this on a few pipelines and confirmed that ifuseAzureFederatedCredentials
isfalse
(the default, basically no change on the client extensions side), the pipeline runs the same test step as before, and without prompting for permissions. IfuseAzureFederatedCredentials
parameter is set totrue
, that's when the Key Vault steps are included and env vars are propagated, and that's when permissions are prompted. Since this is a template parameter and not a runtime condition, this is figured out at "compile time", no two.yml
files needed!
That is epic, great work.
Who's the plumber now? 😎
I'm happy to hand over my denim overalls and tool box 👷 🪠🧰
Modify the
test.yml
pipeline template to add support for workflow identity federation for nightly testing pipelines. We do this by adding two new steps, one dummy keyvault step to connect to the newly-createdAzCodeE2ETests
service connection for this purpose. The other is a "real" Key Vault step connecting to theAzCodeE2ETestsCredsKV
key vault, to obtain the identifiers required to connect to theAzCodeE2ETests
service connection and obtain an OIDC token in code. Then, the needed environment variables are manually propagated to theTest
step.