Skip to content

Commit ffbb204

Browse files
authored
SAS token removal from team/user store (#8246)
* SAS token removal from team/user store * Indent workingDirectory to be inline with the other inputs * trying AzureCliCredential instead of DefaultAzureCredential * Use ChainedTokenCredential to exclude ManagedIdentityCredential in pipelines * Revert the repo/label only gen that was used for testing purposes
1 parent 282156d commit ffbb204

3 files changed

Lines changed: 46 additions & 12 deletions

File tree

eng/pipelines/pipeline-owners-extraction.yml

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,24 @@ stages:
2121
Project: internal
2222
DotNetDevOpsFeed: "https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-net/nuget/v3/index.json"
2323
OutputPath: '$(Agent.BuildDirectory)/pipelineOwners.json'
24-
RepoLabelUri: "https://azuresdkartifacts.blob.core.windows.net/azure-sdk-write-teams/repository-labels-blob?$(azuresdkartifacts-azure-sdk-write-teams-sas)"
25-
TeamUserUri: "https://azuresdkartifacts.blob.core.windows.net/azure-sdk-write-teams/azure-sdk-write-teams-blob?$(azuresdkartifacts-azure-sdk-write-teams-sas)"
26-
UserOrgUri: "https://azuresdkartifacts.blob.core.windows.net/azure-sdk-write-teams/user-org-visibility-blob?$(azuresdkartifacts-azure-sdk-write-teams-sas)"
24+
RepoLabelUri: "https://azuresdkartifacts.blob.core.windows.net/azure-sdk-write-teams/repository-labels-blob"
25+
TeamUserUri: "https://azuresdkartifacts.blob.core.windows.net/azure-sdk-write-teams/azure-sdk-write-teams-blob"
26+
UserOrgUri: "https://azuresdkartifacts.blob.core.windows.net/azure-sdk-write-teams/user-org-visibility-blob"
2727
RepoListFile: "$(Build.SourcesDirectory)/tools/github/data/repositories.txt"
2828

2929
steps:
30+
- task: AzureCLI@2
31+
displayName: 'Fetch and store team/user data'
32+
inputs:
33+
azureSubscription: 'Azure SDK Artifacts'
34+
scriptType: pscore
35+
scriptLocation: inlineScript
36+
inlineScript: |
37+
dotnet run -rUri "$(RepoLabelUri)" -tUri "$(TeamUserUri)" -uUri "$(UserOrgUri)" -rlFile "$(RepoListFile)"
38+
workingDirectory: tools/github-team-user-store/GitHubTeamUserStore/GitHubTeamUserStore
39+
env:
40+
GITHUB_TOKEN: $(azuresdkartifacts-azure-sdk-write-teams-github-pat)
41+
3042
- task: DotNetCoreCLI@2
3143
displayName: 'Install Pipeline Owners Extractor'
3244
inputs:
@@ -46,9 +58,3 @@ stages:
4658
artifact: pipelineOwners
4759
condition: succeededOrFailed()
4860

49-
- pwsh: |
50-
dotnet run -rUri "$(RepoLabelUri)" -tUri "$(TeamUserUri)" -uUri "$(UserOrgUri)" -rlFile "$(RepoListFile)"
51-
displayName: 'Fetch and store team/user data'
52-
workingDirectory: tools/github-team-user-store/GitHubTeamUserStore/GitHubTeamUserStore
53-
env:
54-
GITHUB_TOKEN: $(azuresdkartifacts-azure-sdk-write-teams-github-pat)

tools/github-team-user-store/GitHubTeamUserStore/GitHubTeamUserStore/GitHubEventClient.cs

Lines changed: 29 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
using System.Text;
55
using System.Threading.Tasks;
66
using Azure.Storage.Blobs;
7+
using Azure.Identity;
78
using Octokit;
89
using GitHubTeamUserStore.Constants;
910

@@ -158,14 +159,40 @@ public async Task<IReadOnlyList<Team>> GetAllChildTeams(Team team)
158159
/// <summary>
159160
/// Upload the data to blob storage. Uses the BlobUriBuilder to get the blob information to created the
160161
/// Blob clients and upload the data.
162+
/// Credentials:
163+
/// Instead of using DefaultAzureCredential [1] we use ChainedTokenCredential [2] which works
164+
/// as DefaultAzureCredential, but most importantly, it excludes ManagedIdentityCredential.
165+
/// We do so because there is an undesired managed identity available when we run this
166+
/// code in CI/CD pipelines, which takes priority over the desired AzureCliCredential coming
167+
/// from the calling AzureCLI@2 task.
168+
///
169+
/// Running Locally:
170+
/// Your user needs to have Storage Blob Data Contributor access. This is done through
171+
/// https://ms.portal.azure.com/, selecting the azuresdkartifacts storage account, selecting Access Control (IAM)
172+
/// and adding Storage Blob Data Contributor then following the buttons at the bottom to assign this to your user.
173+
/// In Visual Studio select Tools-Options and then search for Azure and select Azure Service Authentication and
174+
/// authenticate. Once that's done the DefaultAzureCredential will use those creds.
175+
///
176+
/// Running in a pipeline:
177+
/// Requires using the AzureCLI or AzurePowerShell task and azure subscription, which was already setup,
178+
/// is 'Azure SDK Artifacts' in both cases the exact line is as follows
179+
/// azureSubscription: 'Azure SDK Artifacts'
180+
/// The DefaultAzureCredential will use the creds setup in the task
161181
/// </summary>
162182
/// <param name="rawJson">The json string, representing the information that will be uploaded to blob storage.</param>
163183
/// <param name="blobUriBuilder">BlobUriBuilder which contains the blob storage information.</param>
164184
/// <returns></returns>
165-
/// <exception cref="ApplicationException">If there is no AZURE_SDK_TEAM_USER_STORE_SAS in the environment</exception>
166185
public async Task UploadDataToBlobStorage(string rawJson, BlobUriBuilder blobUriBuilder)
167186
{
168-
BlobServiceClient blobServiceClient = new BlobServiceClient(blobUriBuilder.ToUri());
187+
var cred = new ChainedTokenCredential(
188+
new EnvironmentCredential(),
189+
new VisualStudioCredential(),
190+
new AzureCliCredential(),
191+
new AzurePowerShellCredential(),
192+
new InteractiveBrowserCredential()
193+
);
194+
BlobServiceClient blobServiceClient = new BlobServiceClient(blobUriBuilder.ToUri(), cred);
195+
169196
BlobContainerClient blobContainerClient = blobServiceClient.GetBlobContainerClient(blobUriBuilder.BlobContainerName);
170197
BlobClient blobClient = blobContainerClient.GetBlobClient(blobUriBuilder.BlobName);
171198
await blobClient.UploadAsync(BinaryData.FromString(rawJson), overwrite: true);

tools/github-team-user-store/GitHubTeamUserStore/GitHubTeamUserStore/GitHubTeamUserStore.csproj

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,8 @@
88
</PropertyGroup>
99

1010
<ItemGroup>
11-
<PackageReference Include="Azure.Storage.Blobs" Version="12.16.0" />
11+
<PackageReference Include="Azure.Identity" Version="1.11.3" />
12+
<PackageReference Include="Azure.Storage.Blobs" Version="12.19.1" />
1213
<PackageReference Include="Octokit" Version="5.0.2" />
1314
<PackageReference Include="System.CommandLine" Version="2.0.0-beta4.22272.1" />
1415
</ItemGroup>

0 commit comments

Comments
 (0)