-
Notifications
You must be signed in to change notification settings - Fork 4.8k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Sync eng/common directory with azure-sdk-tools for PR 2248 (#25408)
* Exclude certain live test deployment outputs from being marked as log secrets * debug * Update subscription configuration merge jobs to use secret handler * Rename subscription config helper function script * Fix variable name reference in scope Co-authored-by: Ben Broderick Phillips <[email protected]>
- Loading branch information
Showing
3 changed files
with
190 additions
and
112 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,93 @@ | ||
| function ShouldMarkValueAsSecret([string]$serviceDirectoryPrefix, [string]$key, [string]$value, [array]$allowedValues = @()) | ||
| { | ||
| $logOutputNonSecret = @( | ||
| # Environment Variables | ||
| "RESOURCEGROUP_NAME", | ||
| # Deployment Outputs | ||
| "CLIENT_ID", | ||
| "TENANT_ID", | ||
| "SUBSCRIPTION_ID", | ||
| "RESOURCE_GROUP", | ||
| "LOCATION", | ||
| "ENVIRONMENT", | ||
| "AUTHORITY_HOST", | ||
| "RESOURCE_MANAGER_URL", | ||
| "SERVICE_MANAGEMENT_URL", | ||
| "ENDPOINT_SUFFIX", | ||
| # This is used in many places and is harder to extract from the base subscription config, so hardcode it for now. | ||
| "STORAGE_ENDPOINT_SUFFIX", | ||
| # Parameters | ||
| "Environment", | ||
| "SubscriptionId", | ||
| "TenantId", | ||
| "TestApplicationId", | ||
| "TestApplicationOid", | ||
| "ProvisionerApplicationId" | ||
| ) | ||
|
|
||
| $suffix1 = $key -replace $serviceDirectoryPrefix, "" | ||
| $suffix2 = $key -replace "AZURE_", "" | ||
| $variants = @($key, $suffix1, $suffix2) | ||
| if ($variants | Where-Object { $logOutputNonSecret -contains $_ }) { | ||
| return $false | ||
| } | ||
|
|
||
| if ($allowedValues -contains $value) { | ||
| return $false | ||
| } | ||
|
|
||
| return $true | ||
| } | ||
|
|
||
| function SetSubscriptionConfiguration([object]$subscriptionConfiguration) | ||
| { | ||
| foreach($pair in $subscriptionConfiguration.GetEnumerator()) { | ||
| if ($pair.Value -is [Hashtable]) { | ||
| foreach($nestedPair in $pair.Value.GetEnumerator()) { | ||
| # Mark values as secret so we don't print json blobs containing secrets in the logs. | ||
| # Prepend underscore to the variable name, so we can still access the variable names via environment | ||
| # variables if they get set subsequently. | ||
| if (ShouldMarkValueAsSecret "AZURE_" $nestedPair.Name $nestedPair.Value) { | ||
| Write-Host "##vso[task.setvariable variable=_$($nestedPair.Name);issecret=true;]$($nestedPair.Value)" | ||
| } | ||
| } | ||
| } else { | ||
| if (ShouldMarkValueAsSecret "AZURE_" $pair.Name $pair.Value) { | ||
| Write-Host "##vso[task.setvariable variable=_$($pair.Name);issecret=true;]$($pair.Value)" | ||
| } | ||
| } | ||
| } | ||
|
|
||
| Write-Host ($subscriptionConfiguration | ConvertTo-Json) | ||
| $serialized = $subscriptionConfiguration | ConvertTo-Json -Compress | ||
| Write-Host "##vso[task.setvariable variable=SubscriptionConfiguration;]$serialized" | ||
| } | ||
|
|
||
| function UpdateSubscriptionConfiguration([object]$subscriptionConfigurationBase, [object]$subscriptionConfiguration) | ||
| { | ||
| foreach ($pair in $subscriptionConfiguration.GetEnumerator()) { | ||
| if ($pair.Value -is [Hashtable]) { | ||
| if (!$subscriptionConfigurationBase.ContainsKey($pair.Name)) { | ||
| $subscriptionConfigurationBase[$pair.Name] = @{} | ||
| } | ||
| foreach($nestedPair in $pair.Value.GetEnumerator()) { | ||
| # Mark values as secret so we don't print json blobs containing secrets in the logs. | ||
| # Prepend underscore to the variable name, so we can still access the variable names via environment | ||
| # variables if they get set subsequently. | ||
| if (ShouldMarkValueAsSecret "AZURE_" $nestedPair.Name $nestedPair.Value) { | ||
| Write-Host "##vso[task.setvariable variable=_$($nestedPair.Name);issecret=true;]$($nestedPair.Value)" | ||
| } | ||
| $subscriptionConfigurationBase[$pair.Name][$nestedPair.Name] = $nestedPair.Value | ||
| } | ||
| } else { | ||
| if (ShouldMarkValueAsSecret "AZURE_" $pair.Name $pair.Value) { | ||
| Write-Host "##vso[task.setvariable variable=_$($pair.Name);issecret=true;]$($pair.Value)" | ||
| } | ||
| $subscriptionConfigurationBase[$pair.Name] = $pair.Value | ||
| } | ||
| } | ||
|
|
||
| $serialized = $subscriptionConfigurationBase | ConvertTo-Json -Compress | ||
| Write-Host ($subscriptionConfigurationBase | ConvertTo-Json) | ||
| Write-Host "##vso[task.setvariable variable=SubscriptionConfiguration;]$serialized" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters