azure-pipelines.yml

parameters:
- name: identityType
  displayName: Identity Type
  type: string
  default: Managed Identity with federation
  values:
  - Managed Identity with federation
  - Service Principal with federation
  - Service Principal with secret
  - Strategy
- name: serviceConnectionCreationMode
  displayName: Service Connection creation mode
  type: string
  default: Manual
  values:
  # - Automatic # Not supported
  - Manual
  # - Strategy
- name: concurrency
  displayName: Concurrency
  type: number
  default: 1
- name: testServiceConnection
  displayName: Test Service Connection(s)
  type: boolean
  default: true
- name: destroy
  displayName: Destroy Infrastructure
  type: string
  default: Always
  values:
  - Always
  - Never 
  - 'On failure'
  - 'On success'

name: $(Date:yyyyMMdd)$(Rev:.r)-$(Build.DefinitionVersion)-$(SourceBranchName)-$(Build.BuildId)-create-${{lower(parameters.serviceConnectionCreationMode)}}-${{lower(replace(parameters.identityType,' ','-'))}}

pr:
  autoCancel: false
  branches:
    include:
    - '*'
  drafts: false
  paths:
    exclude:
    - '.devcontainer/**'  
    - 'visuals/**'  
    - '*.md'  
schedules:
- cron: '0 0 * * Tue,Fr'
  displayName: 'Bi-weekly build (UTC)'
  # Run if there are no changes
  always: 'true'
  branches:
    include:
    - main
trigger: none

variables:
- group: 'identity-ci' # Should contain 'azureConnection', 'serviceConnectionTestPipelineId'
- name: application
  value: 'Azure Service Connection'
- name: AZURE_CORE_ONLY_SHOW_ERRORS
  value: 'true'
- name: AZURE_EXTENSION_USE_DYNAMIC_INSTALL
  value: 'yes_without_prompt'
- name: repository
  value: 'azure-identity-scripts'
- name: scriptDirectory
  value: $(Build.SourcesDirectory)/scripts
- name: identityScriptDirectory
  value: $(Build.SourcesDirectory)/scripts/identity/scripts/azure-devops
- name: terraformDirectory  
  value: $(Build.SourcesDirectory)/terraform
- name: TF_IN_AUTOMATION
  value: true
- name: TF_INPUT
  value: 0
- name: TF_WORKSPACE
  value: ci

jobs:
- job: 'Provision'
  displayName: 'Provision'

  pool:
    name: 'Azure Pipelines'
    vmImage: ubuntu-latest

  ${{ if or(eq(parameters.identityType, 'Strategy'),eq(parameters.serviceConnectionCreationMode, 'Strategy'),not(eq(variables['Build.Reason'], 'Manual'))) }}:
    strategy:
      matrix:
        ${{ if or(and(or(eq(parameters.identityType, 'Managed Identity with federation'),eq(parameters.identityType, 'Strategy')),or(eq(parameters.serviceConnectionCreationMode, 'Manual'),eq(parameters.serviceConnectionCreationMode, 'Strategy'))),ne(variables['Build.Reason'], 'Manual'))  }}:
          ManualMSIFederation:
            TF_VAR_azdo_creates_identity: 'false'
            TF_VAR_credential_type: 'FederatedIdentity'
            TF_VAR_create_managed_identity: 'true'
            TF_VAR_resource_suffix: '$(Build.BuildId)mmf'
          ManualMSIFederationACR:
            TF_VAR_azdo_creates_identity: 'false'
            TF_VAR_azdo_service_connection_type: 'ACR'
            TF_VAR_azure_container_registry_name: 'foo'
            TF_VAR_credential_type: 'FederatedIdentity'
            TF_VAR_create_managed_identity: 'true'
            TF_VAR_resource_suffix: '$(Build.BuildId)mmfd'
        ${{ if and(or(eq(parameters.identityType, 'Service Principal with federation'),eq(parameters.identityType, 'Strategy')),or(eq(parameters.serviceConnectionCreationMode, 'Automatic'),eq(parameters.serviceConnectionCreationMode, 'Strategy')))  }}:
          AutomaticAppRegFederation:
            TF_VAR_azdo_creates_identity: 'true'
            TF_VAR_credential_type: 'FederatedIdentity'
            TF_VAR_create_managed_identity: 'false'
            TF_VAR_resource_suffix: '$(Build.BuildId)aaf'
        ${{ if or(and(or(eq(parameters.identityType, 'Service Principal with federation'),eq(parameters.identityType, 'Strategy')),or(eq(parameters.serviceConnectionCreationMode, 'Manual'),eq(parameters.serviceConnectionCreationMode, 'Strategy'))),ne(variables['Build.Reason'], 'Manual'))  }}:
          ManualAppRegFederation:
            TF_VAR_azdo_creates_identity: 'false'
            TF_VAR_credential_type: 'FederatedIdentity'
            TF_VAR_create_managed_identity: 'false'
            TF_VAR_resource_suffix: '$(Build.BuildId)maf'
          ManualAppRegFederationACR:
            TF_VAR_azdo_creates_identity: 'false'
            TF_VAR_azdo_service_connection_type: 'ACR'
            TF_VAR_azure_container_registry_name: 'foo'
            TF_VAR_credential_type: 'FederatedIdentity'
            TF_VAR_create_managed_identity: 'false'
            TF_VAR_resource_suffix: '$(Build.BuildId)mafd'
        ${{ if and(or(eq(parameters.identityType, 'Service Principal with secret'),eq(parameters.identityType, 'Strategy')),or(eq(parameters.serviceConnectionCreationMode, 'Automatic'),eq(parameters.serviceConnectionCreationMode, 'Strategy')))  }}:
          AutomaticAppRegSecret:
            TF_VAR_azdo_creates_identity: 'true'
            TF_VAR_credential_type: 'Secret'
            TF_VAR_create_managed_identity: 'false'
            TF_VAR_resource_suffix: '$(Build.BuildId)aas'
        ${{ if or(and(or(eq(parameters.identityType, 'Service Principal with secret'),eq(parameters.identityType, 'Strategy')),or(eq(parameters.serviceConnectionCreationMode, 'Manual'),eq(parameters.serviceConnectionCreationMode, 'Strategy'))),ne(variables['Build.Reason'], 'Manual'))  }}:
          ManualAppRegSecret:
            TF_VAR_azdo_creates_identity: 'false'
            TF_VAR_credential_type: 'Secret'
            TF_VAR_create_managed_identity: 'false'
            TF_VAR_resource_suffix: '$(Build.BuildId)mas'
      maxParallel: ${{ parameters.concurrency }} # Reserve concurrency for test pipeline (az pipelines run) invoked from this pipeline

  variables:
    ${{ if and(ne(parameters.identityType, 'Strategy'),ne(parameters.serviceConnectionCreationMode, 'Strategy'),eq(variables['Build.Reason'], 'Manual')) }}:
      TF_VAR_azdo_creates_identity: ${{ lower(eq(parameters.serviceConnectionCreationMode, 'Automatic')) }}
      ${{ if lower(contains(parameters.identityType, 'federation')) }}:
        TF_VAR_credential_type: 'FederatedIdentity'
      ${{ else }}:
        TF_VAR_credential_type: 'Secret'
      TF_VAR_create_managed_identity: ${{ lower(contains(parameters.identityType, 'Managed Identity')) }}
      TF_VAR_resource_suffix: $(Build.BuildId)
    managedIdentityResourceGroupLocation: centralus
    managedIdentityResourceGroupName: ${{ split(variables['System.CollectionUri'], '/')[3] }}-service-connections

  steps:
  - checkout: self
    submodules: true
    
  - pwsh: terraform init
    displayName: 'Terraform init'
    workingDirectory: '$(terraformDirectory)'

  # Create resource group for managed identity
  - task: AzureCLI@2
    condition: and(succeeded(),eq(variables['TF_VAR_create_managed_identity'], 'true'))
    displayName: 'Create Managed Identity resource group'
    name: managedIdentityResourceGroup
    inputs:
      azureSubscription: '$(azureConnection)'
      failOnStandardError: true
      scriptType: pscore
      scriptLocation: inlineScript
      inlineScript: |
        az group list --query "[?name == '$(managedIdentityResourceGroupName)'].id" `
                      -o tsv `
                      | Set-Variable -Name managedIdentityResourceGroupId
        
        if (!$managedIdentityResourceGroupId) {
          Write-Host "Creating resource group `"$managedIdentityResourceGroupName`"..."
          az group create --name $(managedIdentityResourceGroupName) `
                          --location $(managedIdentityResourceGroupLocation) `
                          --query id `
                          | Set-Variable -Name managedIdentityResourceGroupId
        } else {
          Write-Host "Resource group `"$managedIdentityResourceGroupName`" already exists"
        }

        Write-Host "##vso[task.setvariable variable=id;isOutput=true]${managedIdentityResourceGroupId}"

  - task: AzureCLI@2
    displayName: 'Terraform apply'
    name: terraform
    inputs:
      azureSubscription: '$(azureConnection)'
      scriptType: pscore
      scriptLocation: inlineScript
      inlineScript: |
        $(identityScriptDirectory)/set_terraform_azurerm_vars.ps1

        # List environment variables
        Get-ChildItem -Path Env: `
                      -Recurse `
                      -Include ARM_*, TF_* `
                      | ForEach-Object { 
                            if ($_.Name -match 'SECRET|TOKEN') {
                                $_.Value = "<redacted>"
                            } 
                            $_
                        } `
                      | Sort-Object -Property Name `
                      | Format-Table -AutoSize

        # Test
        az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 -o json | ConvertFrom-Json | Select-Object -ExcludeProperty accessToken

        terraform apply -auto-approve

        Write-Host "##vso[task.setvariable variable=azdo_service_connection_id;isOutput=true]$(terraform output -raw azdo_service_connection_id)"
        Write-Host "##vso[task.setvariable variable=azdo_service_connection_name;isOutput=true]$(terraform output -raw azdo_service_connection_name)"
        # terraform output -raw linux_os_sku
      addSpnToEnvironment: true
      failOnStandardError: true
      workingDirectory: '$(terraformDirectory)'
    env:
      TF_VAR_azdo_creates_identity: $(TF_VAR_azdo_creates_identity)
      TF_VAR_azdo_organization_url: $(System.CollectionUri)
      TF_VAR_azdo_project_name: $(System.TeamProject)
      TF_VAR_create_managed_identity: $(TF_VAR_create_managed_identity)
      TF_VAR_credential_type: $(TF_VAR_credential_type)
      TF_VAR_managed_identity_resource_group_id: $(managedIdentityResourceGroup.id)
      TF_VAR_resource_suffix: $(TF_VAR_resource_suffix)
      TF_VAR_run_id: $(Build.BuildId)

  - ${{ if parameters.testServiceConnection }}:
    - task: AzureCLI@2
      condition: and(succeeded(),ne(coalesce(variables.serviceConnectionTestPipelineId,'empty'),'empty'),ne(variables['TF_VAR_azdo_service_connection_type'], 'ACR'))
      displayName: 'Test Service Connection'
      timeoutInMinutes: 5
      inputs:
        azureSubscription: '$(azureConnection)'
        failOnStandardError: true
        scriptType: pscore
        scriptLocation: inlineScript
        inlineScript: |
          Write-Host "Service Connection id:   $(terraform.azdo_service_connection_id)"
          Write-Host "Service Connection name: $(terraform.azdo_service_connection_name)"

          az devops configure --defaults organization=$(System.CollectionUri) project="$(System.TeamProject)"

          Write-Host "Authorizing the service connection to use the pipeline..."
          if ([string]::IsNullOrEmpty("$(terraform.azdo_service_connection_name)")) {
            Write-Host "##vso[task.LogIssue type=error]Service connection not found"
            Write-Error "Service connection not found"
            exit 1
          }
          az devops service-endpoint update --id $(terraform.azdo_service_connection_id) `
                                            --enable-for-all true

          Write-Host "Running the test pipeline with parameter serviceConnection=$(terraform.azdo_service_connection_name)..."
          az pipelines run --id $(serviceConnectionTestPipelineId) `
                          --parameters serviceConnection="$(terraform.azdo_service_connection_name)" `
                          -o json `
                          | ConvertFrom-Json `
                          | Set-Variable run
          $run | ConvertTo-Json -Depth 5 | Out-String | Write-Debug
          $run | Format-List | Out-String | Write-Debug
          "{0}{1}/_build/results?buildId={2}&view=results" -f "$(System.CollectionUri)", [uri]::EscapeDataString("$(System.TeamProject)"), $run.id | Write-Host
          Write-Host "Waiting for pipeline run $($run.id) to complete..."
          do {
              Start-Sleep -Seconds 5
              az pipelines runs show --id $run.id `
                                    -o json `
                                    | ConvertFrom-Json `
                                    | Set-Variable run
              $run | ConvertTo-Json | Out-String | Write-Debug
              $run | Format-List | Out-String | Write-Debug
              # pause
              Write-Host "Run status: $($run.status)"
          } while ($run.status -ne 'completed')
          Write-Host "Run result: $($run.result)"

          if ($run.result -notmatch 'succeeded') {
              Write-Host "##vso[task.LogIssue type=error]Service Connection test job failed with result: $($run.result)"
              Write-Error "Run failed with result: $($run.result)"
              exit 1
          }

  - ${{ if not(eq(parameters.destroy, 'Never')) }}:
    - pwsh: |
        Write-Host "##vso[task.setvariable variable=result;isOutput=true]success"
      name: provisioningResult
      displayName: 'Indicate provisioning success'
      condition: succeeded()

  - ${{ if not(eq(parameters.destroy, 'Never')) }}:
    - task: AzureCLI@2
      continueOnError: true # Treat failure as warning during destroy, we will clean up anyway
      ${{ if eq(parameters.destroy, 'Always') }}:
        condition: succeededOrFailed()
      ${{ if eq(parameters.destroy, 'On failure') }}:
        condition: failed()
      ${{ if eq(parameters.destroy, 'On success') }}:
        condition: succeeded()
      displayName: 'Terraform destroy'
      inputs:
        azureSubscription: '$(azureConnection)'
        scriptType: pscore
        scriptLocation: inlineScript
        inlineScript: |
          $(identityScriptDirectory)/set_terraform_azurerm_vars.ps1
          terraform destroy -auto-approve
        addSpnToEnvironment: true
        failOnStandardError: true
        workingDirectory: '$(terraformDirectory)'
      env:
        TF_VAR_azdo_creates_identity: $(TF_VAR_azdo_creates_identity)
        TF_VAR_azdo_organization_url: $(System.CollectionUri)
        TF_VAR_azdo_project_name: $(System.TeamProject)
        TF_VAR_create_managed_identity: $(TF_VAR_create_managed_identity)
        TF_VAR_credential_type: $(TF_VAR_credential_type)
        TF_VAR_managed_identity_resource_group_id: $(managedIdentityResourceGroup.id)
        TF_VAR_resource_suffix: $(TF_VAR_resource_suffix)
        TF_VAR_run_id: $(Build.BuildId)

  - ${{ if not(eq(parameters.destroy, 'Never')) }}:
    - task: AzureCLI@2
      name: teardownAzDO
      ${{ if eq(parameters.destroy, 'Always') }}:
        condition: succeededOrFailed()
      ${{ if eq(parameters.destroy, 'On failure') }}:
        condition: failed()
      ${{ if eq(parameters.destroy, 'On success') }}:
        condition: succeeded()
      continueOnError: true
      displayName: 'Tear down remaining Azure DevOps resources'
      inputs:
        azureSubscription: '$(azureConnection)'
        scriptType: pscore
        scriptLocation: inlineScript
        inlineScript: |
          $ErrorActionPreference = "Continue" # Continue to remove resources if remove by resource group fails
          az devops configure --defaults organization="$(System.CollectionUri)" project="$(System.TeamProject)"
          az devops service-endpoint list --query "[?ends_with(@.name, '-$(Build.BuildId)')].id" `
                                          -o tsv `
                                          | Set-Variable -Name serviceConnectionId
          if (!$serviceConnectionId) {
            Write-Host "No service connections to remove"
            exit 0
          } 

          Write-Host "Removing service connection ${serviceConnectionId}..."
          &{ # az writes information to stderr
            $ErrorActionPreference = 'SilentlyContinue'
            az devops service-endpoint delete --id $(terraform.azdo_service_connection_id) --yes 2>&1
          }
        failOnStandardError: true
        workingDirectory: '$(scriptDirectory)'

- ${{ if not(eq(parameters.destroy, 'Never')) }}:
  - job: 'Teardown'
    ${{ if eq(parameters.destroy, 'Always') }}:
      condition: succeededOrFailed()
    ${{ if eq(parameters.destroy, 'On failure') }}:
      condition: failed()
    ${{ if eq(parameters.destroy, 'On success') }}:
      condition: succeeded()
    dependsOn: 'Provision'
    displayName: 'Destroy (${{ parameters.destroy }})'

    pool:
      name: 'Azure Pipelines'
      vmImage: ubuntu-latest

    steps:
    - task: AzureCLI@2
      name: teardownAzure
      ${{ if eq(parameters.destroy, 'Always') }}:
        condition: succeededOrFailed()
      ${{ if eq(parameters.destroy, 'On failure') }}:
        condition: failed()
      ${{ if eq(parameters.destroy, 'On success') }}:
        condition: succeeded()
      displayName: 'Tear down remaining Azure resources'
      inputs:
        azureSubscription: '$(azureConnection)'
        scriptType: pscore
        scriptLocation: inlineScript
        inlineScript: |
          $ErrorActionPreference = "Continue" # Continue to remove resources if remove by resource group fails
          # Build JMESPath expression
          $tagQuery = "[?tags.application == '$(application)' && tags.repository == '$(repository)' && tags.workspace == '$(TF_WORKSPACE)' && tags.runId == '$(Build.BuildId)' && properties.provisioningState != 'Deleting'].id"
          Write-Host "Removing resources identified by `"$tagQuery`"..."

          # Remove resource groups
          $resourceGroupIDs = $(az group list --query "${tagQuery}" -o tsv)
          if ($resourceGroupIDs) {
            Write-Host "Removing resource group(s) `"${resourceGroupIDs}`"..."
            &{ # az writes information to stderr
              $ErrorActionPreference = 'SilentlyContinue'
              az resource delete --ids $resourceGroupIDs 2>&1
            }
          } else {
            Write-Host "No resource groups to remove"
          }

          # Remove (remaining) resources
          $resourceIDs = $(az resource list --query "${tagQuery}" -o tsv)
          if ($resourceIDs) {
            Write-Host "Removing resources `"${resourceIDs}`"..."
            &{ # az writes information to stderr
              $ErrorActionPreference = 'SilentlyContinue'
              az resource delete --ids $resourceIDs 2>&1
            }
          } else {
            Write-Host "No resources to remove"
          }
        failOnStandardError: true
        workingDirectory: '$(scriptDirectory)'