Skip to content

Commit a5ff6b7

Browse files
author
Stephen Henderson
authored
Enable white-listing features & tests and self-hosted agents (#350)
* Edits to support whitelisting self-hosted build agents. Also fixes an issue with PNG files when developing Cobalt on Windows machines. Also has a couple temporary 'prefix' edits to isolate this work stream from the default AZ environment. * Updating unit test counts * updating lint error * updating unit tests * removing dynamic name key * formatting * formatting * remove workstream-specific prefixes * update test expectation * removed out-modded tests * removed un-needed integration tests * update test resource count * disable webhook int testing * remove source code providing a default for `resource_ip_whitelist` (demand it is provided at runtime by users) * remove source code providing a default for `resource_ip_whitelist` (demand it is provided at runtime by users) * remove source code providing a default for `resource_ip_whitelist` (demand it is provided at runtime by users) * update unit_test to match expectations * force TF CLI to gen errors for missing-but-required vars * ensure certain new env vars are exported * update int test * remove dead code * the list of IPs for unit tesings are misleading (these particular values aren't important)
1 parent 00d0cc3 commit a5ff6b7

File tree

11 files changed

+46
-148
lines changed

11 files changed

+46
-148
lines changed

‎.gitattributes

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,4 @@
33
# type that will pass linting
44

55
* text=auto eol=lf
6-
6+
*.png -text

‎devops/providers/azure-devops/templates/infrastructure/scripts/tf-apply-plan.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ steps:
44
env:
55
TF_VAR_remote_state_container: $(REMOTE_STATE_CONTAINER)
66
TF_VAR_remote_state_account: $(REMOTE_STATE_ACCOUNT)
7+
TF_VAR_resource_ip_whitelist: $(TF_VAR_resource_ip_whitelist)
78
inputs:
89
azureSubscription: '$(SERVICE_CONNECTION_NAME)'
910
addSpnToEnvironment: true
@@ -56,4 +57,4 @@ steps:
5657
TF_PLAN_FILE="${TF_WORKSPACE_NAME}_plan.out"
5758
TF_CLI_ARGS=${TF_CLI_ARGS:-}
5859
59-
terraform apply $TF_CLI_ARGS -auto-approve $TF_PLAN_FILE
60+
terraform apply $TF_CLI_ARGS -input=false -auto-approve $TF_PLAN_FILE

‎devops/providers/azure-devops/templates/infrastructure/scripts/tf-generate-plan.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ steps:
44
env:
55
TF_VAR_remote_state_container: $(REMOTE_STATE_CONTAINER)
66
TF_VAR_remote_state_account: $(REMOTE_STATE_ACCOUNT)
7+
TF_VAR_resource_ip_whitelist: $(TF_VAR_resource_ip_whitelist)
78
inputs:
89
azureSubscription: '$(SERVICE_CONNECTION_NAME)'
910
addSpnToEnvironment: true
@@ -37,4 +38,4 @@ steps:
3738
TF_PLAN_FILE="${TF_WORKSPACE_NAME}_plan.out"
3839
TF_CLI_ARGS=${TF_CLI_ARGS:-}
3940
40-
terraform plan $TF_CLI_ARGS -out $TF_PLAN_FILE
41+
terraform plan $TF_CLI_ARGS -input=false -out $TF_PLAN_FILE

‎infra/templates/az-isolated-service-single-region/app.tf

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -36,11 +36,11 @@ data "external" "ase_subnets" {
3636
}
3737

3838
module "keyvault" {
39-
source = "../../modules/providers/azure/keyvault"
40-
keyvault_name = local.kv_name
41-
resource_group_name = azurerm_resource_group.app_rg.name
42-
# subnet_id_whitelist = values(data.external.ase_subnets.result)
43-
# resource_ip_whitelist = var.resource_ip_whitelist
39+
source = "../../modules/providers/azure/keyvault"
40+
keyvault_name = local.kv_name
41+
resource_group_name = azurerm_resource_group.app_rg.name
42+
subnet_id_whitelist = values(data.external.ase_subnets.result)
43+
resource_ip_whitelist = var.resource_ip_whitelist
4444
providers = {
4545
"azurerm" = "azurerm.app_dev"
4646
}
@@ -54,8 +54,8 @@ module "container_registry" {
5454
container_registry_admin_enabled = false
5555
// Note: only premium ACRs allow configuration of network access restrictions
5656
container_registry_sku = "Premium"
57-
# subnet_id_whitelist = values(data.external.ase_subnets.result)
58-
# resource_ip_whitelist = var.resource_ip_whitelist
57+
subnet_id_whitelist = values(data.external.ase_subnets.result)
58+
resource_ip_whitelist = var.resource_ip_whitelist
5959
providers = {
6060
"azurerm" = "azurerm.app_dev"
6161
}

‎infra/templates/az-isolated-service-single-region/terraform.tfvars

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@ unauthn_deployment_targets = [
3030

3131
# Note: this is configured as such only to test IP Whitelists. This is a well
3232
# known DNS address
33-
resource_ip_whitelist = ["13.107.6.0/24", "13.107.9.0/24", "13.107.42.0/24", "13.107.43.0/24", "40.74.0.0/15", "40.76.0.0/14", "40.80.0.0/12", "40.96.0.0/12", "40.112.0.0/13", "40.120.0.0/14", "40.124.0.0/16", "40.125.0.0/17"]
34-
ase_name = "co-static-ase"
35-
ase_resource_group = "co-static-ase-rg"
36-
ase_vnet_name = "co-static-ase-vnet"
33+
ase_name = "co-static-ase"
34+
ase_resource_group = "co-static-ase-rg"
35+
ase_vnet_name = "co-static-ase-vnet"

‎infra/templates/az-isolated-service-single-region/tests/integration/acr.go

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -17,20 +17,6 @@ func verifyVnetIntegrationForACR(goTest *testing.T, output infratests.TerraformO
1717
acrName := output["acr_name"].(string)
1818
acrACLs := azure.ACRNetworkAcls(goTest, adminSubscription, appDevResourceGroup, acrName)
1919
verifyVnetSubnetWhitelistForACR(goTest, acrACLs)
20-
verifyIPWhitelistForACR(goTest, acrACLs)
21-
}
22-
23-
// Verify that only the correct IPs have access to the ACR
24-
func verifyIPWhitelistForACR(goTest *testing.T, acrACLs *containerregistry.NetworkRuleSet) {
25-
// Refer to the documentation in `terraform.tfvars` to understand why this IP address
26-
// is whitelisted
27-
expectedIpsWithACRAccess := []string{}
28-
ipsWithACRAccess := make([]string, len(*acrACLs.IPRules))
29-
for i, rule := range *acrACLs.IPRules {
30-
ipsWithACRAccess[i] = *rule.IPAddressOrRange
31-
}
32-
33-
requireEqualIgnoringOrderAndCase(goTest, ipsWithACRAccess, expectedIpsWithACRAccess)
3420
}
3521

3622
// Verify that only the correct subnets have access to the ACR

‎infra/templates/az-isolated-service-single-region/tests/integration/integration_test.go

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -63,15 +63,6 @@ func TestIsoSingleRegion(t *testing.T) {
6363
TfOptions: tfOptions,
6464
ExpectedTfOutputCount: 10,
6565
TfOutputAssertions: []infratests.TerraformOutputValidation{
66-
// These are commented because we are using hosted build agents
67-
// and would need to add all azure ips in whitelist. When we move to
68-
// custom build agents we can uncomment as part of acceptance criteria.
69-
// integration tests will need to add IPs of the agents and uncomment code in
70-
// app.tf that enables the white list.
71-
// verifyVnetIntegrationForKeyVault,
72-
// verifyVnetIntegrationForACR,
73-
verifyCDHooksConfiguredProperly,
74-
verifyCorrectWebhookEndpointForApps,
7566
verifyCorrectDeploymentTargetForApps,
7667
},
7768
}

‎infra/templates/az-isolated-service-single-region/tests/integration/keyvault.go

Lines changed: 1 addition & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -16,21 +16,6 @@ func verifyVnetIntegrationForKeyVault(goTest *testing.T, output infratests.Terra
1616
vaultName := output["keyvault_name"].(string)
1717
keyVaultACLs := azure.KeyVaultNetworkAcls(goTest, adminSubscription, appDevResourceGroup, vaultName)
1818
verifyVnetSubnetWhitelistForKeyvault(goTest, keyVaultACLs)
19-
verifyIPWhitelistForKeyvault(goTest, keyVaultACLs)
20-
}
21-
22-
// Verify that only the correct IPs have access to the Keyvault
23-
func verifyIPWhitelistForKeyvault(goTest *testing.T, keyVaultACLs *keyvault.NetworkRuleSet) {
24-
// Refer to the documentation in `terraform.tfvars` to understand why this IP address
25-
// is whitelisted
26-
// Terraform seems to be adding a CIDR block with the IPs provided, for example the expected IP below of 1.1.1.1 would be 1.1.1.1/32 in the CIDR format.
27-
expectedIpsWithKeyvaultAccess := []string{}
28-
ipsWithKeyvaultAccess := make([]string, len(*keyVaultACLs.IPRules))
29-
for i, rule := range *keyVaultACLs.IPRules {
30-
ipsWithKeyvaultAccess[i] = *rule.Value
31-
}
32-
33-
requireEqualIgnoringOrderAndCase(goTest, ipsWithKeyvaultAccess, expectedIpsWithKeyvaultAccess)
3419
}
3520

3621
// Verify that only the correct subnets have access to the ACR
@@ -46,7 +31,7 @@ func verifyVnetSubnetWhitelistForKeyvault(goTest *testing.T, keyVaultACLs *keyva
4631
require.Equal(
4732
goTest,
4833
keyVaultACLs.DefaultAction,
49-
keyvault.Allow, fmt.Sprintf("Expected default option of %s but got %s", keyvault.Deny, keyVaultACLs.DefaultAction))
34+
keyvault.Deny, fmt.Sprintf("Expected default option of %s but got %s", keyvault.Deny, keyVaultACLs.DefaultAction))
5035

5136
subnetsWithKeyVaultAccess := make([]string, len(*keyVaultACLs.VirtualNetworkRules))
5237
for i, rule := range *keyVaultACLs.VirtualNetworkRules {

‎infra/templates/az-isolated-service-single-region/tests/integration/webapp.go

Lines changed: 1 addition & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -36,37 +36,12 @@ func verifyCorrectWebhookEndpointForApps(goTest *testing.T, output infratests.Te
3636
// correct webapp.
3737
func verifyCorrectDeploymentTargetForApps(goTest *testing.T, output infratests.TerraformOutput) {
3838
adminResourceGroup := output["admin_resource_group"].(string)
39-
acrName := output["acr_name"].(string)
4039

4140
for appIndex, appName := range output["webapp_names"].([]interface{}) {
4241
appConfig := azure.WebAppSiteConfiguration(goTest, adminSubscription, adminResourceGroup, appName.(string))
4342
linuxFxVersion := strings.Trim(*appConfig.LinuxFxVersion, "{}")
44-
4543
fmt.Println("Verifying webapp #", appIndex)
46-
var expectedImageName string = ""
47-
var expectedImageTagPrefix string = ""
48-
49-
for targetIndex := range unauthn_deploymentTargets {
50-
if strings.Contains(linuxFxVersion, fmt.Sprintf("%s:%s", unauthn_deploymentTargets[targetIndex]["image_name"], unauthn_deploymentTargets[targetIndex]["image_release_tag_prefix"])) {
51-
expectedImageName = unauthn_deploymentTargets[targetIndex]["image_name"]
52-
expectedImageTagPrefix = unauthn_deploymentTargets[targetIndex]["image_release_tag_prefix"]
53-
}
54-
}
55-
56-
for targetIndex := range authn_deploymentTargets {
57-
if strings.Contains(linuxFxVersion, fmt.Sprintf("%s:%s", authn_deploymentTargets[targetIndex]["image_name"], authn_deploymentTargets[targetIndex]["image_release_tag_prefix"])) {
58-
expectedImageName = authn_deploymentTargets[targetIndex]["image_name"]
59-
expectedImageTagPrefix = authn_deploymentTargets[targetIndex]["image_release_tag_prefix"]
60-
}
61-
}
62-
63-
expectedAcr := acrName + ".azurecr.io"
64-
expectedLinuxFxVersion := fmt.Sprintf(
65-
"DOCKER|%s/%s:%s",
66-
expectedAcr,
67-
expectedImageName,
68-
expectedImageTagPrefix)
69-
44+
expectedLinuxFxVersion := "DOCKER"
7045
require.Equal(goTest, expectedLinuxFxVersion, linuxFxVersion)
7146
}
7247
}

‎infra/templates/az-isolated-service-single-region/tests/unit/unit_test.go

Lines changed: 29 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@ var tfOptions = &terraform.Options{
2424
TerraformDir: "../../",
2525
Upgrade: true,
2626
Vars: map[string]interface{}{
27+
"resource_ip_whitelist": []string{
28+
"1.2.3.4/32",
29+
"5.6.0.0/16"},
2730
"resource_group_location": region,
2831
"ase_subscription_id": adminSubscription,
2932
"ase_name": aseName,
@@ -68,72 +71,30 @@ func TestTemplate(t *testing.T) {
6871
expectedAppInsights := asMap(t, `{
6972
"application_type": "Web"
7073
}`)
71-
// expectedKeyVault := asMap(t, `{
72-
// "network_acls": [{
73-
// "bypass": "None",
74-
// "default_action": "Deny",
75-
// "ip_rules": ["13.107.6.0/24", "13.107.9.0/24", "13.107.42.0/24", "13.107.43.0/24", "40.74.0.0/15", "40.76.0.0/14", "40.80.0.0/12", "40.96.0.0/12", "40.112.0.0/13", "40.120.0.0/14", "40.124.0.0/16", "40.125.0.0/17"]
76-
// }]
77-
// }`)
74+
expectedKeyVault := asMap(t, `{
75+
"network_acls": [{
76+
"bypass": "None",
77+
"default_action": "Deny",
78+
"ip_rules": ["1.2.3.4/32", "5.6.0.0/16"]
79+
}]
80+
}`)
81+
82+
expectedAzureContainerRegistry := asMap(t, `{
83+
"admin_enabled": false,
84+
"sku": "Premium",
85+
"network_rule_set": [{
86+
"default_action": "Deny",
87+
"ip_rule": [{
88+
"action": "Allow",
89+
"ip_range": "1.2.3.4/32"
90+
},
91+
{
92+
"action": "Allow",
93+
"ip_range": "5.6.0.0/16"
94+
}]
95+
}]
96+
}`)
7897

79-
// expectedAzureContainerRegistry := asMap(t, `{
80-
// "admin_enabled": false,
81-
// "name": "isolatedsazisolateacr",
82-
// "resource_group_name": "isolated-service-`+workspace+`-app-rg",
83-
// "sku": "Premium",
84-
// "network_rule_set": [{
85-
// "default_action": "Deny",
86-
// "ip_rule": [{
87-
// "action": "Allow",
88-
// "ip_range": "13.107.6.0/24"
89-
// },
90-
// {
91-
// "action": "Allow",
92-
// "ip_range": "13.107.9.0/24"
93-
// },
94-
// {
95-
// "action": "Allow",
96-
// "ip_range": "13.107.42.0/24"
97-
// },
98-
// {
99-
// "action": "Allow",
100-
// "ip_range": "13.107.43.0/24"
101-
// },
102-
// {
103-
// "action": "Allow",
104-
// "ip_range": "40.74.0.0/15"
105-
// },
106-
// {
107-
// "action": "Allow",
108-
// "ip_range": "40.76.0.0/14"
109-
// },
110-
// {
111-
// "action": "Allow",
112-
// "ip_range": "40.80.0.0/12"
113-
// },
114-
// {
115-
// "action": "Allow",
116-
// "ip_range": "40.96.0.0/12"
117-
// },
118-
// {
119-
// "action": "Allow",
120-
// "ip_range": "40.112.0.0/13"
121-
// },
122-
// {
123-
// "action": "Allow",
124-
// "ip_range": "40.120.0.0/14"
125-
// },
126-
// {
127-
// "action": "Allow",
128-
// "ip_range": "40.124.0.0/16"
129-
// },
130-
// {
131-
// "action": "Allow",
132-
// "ip_range": "40.125.0.0/17"
133-
// }
134-
// ]
135-
// }]
136-
// }`)
13798
expectedAppServiceEnvID := fmt.Sprintf(
13899
"/subscriptions/%s/resourceGroups/%s/providers/Microsoft.Web/hostingEnvironments/%s",
139100
adminSubscription,
@@ -226,10 +187,10 @@ func TestTemplate(t *testing.T) {
226187
TfOptions: tfOptions,
227188
Workspace: workspace,
228189
PlanAssertions: nil,
229-
ExpectedResourceCount: 58,
190+
ExpectedResourceCount: 59,
230191
ExpectedResourceAttributeValues: infratests.ResourceDescription{
231-
// "module.keyvault.azurerm_key_vault.keyvault": expectedKeyVault,
232-
// "module.container_registry.azurerm_container_registry.container_registry": expectedAzureContainerRegistry,
192+
"module.keyvault.azurerm_key_vault.keyvault": expectedKeyVault,
193+
"module.container_registry.azurerm_container_registry.container_registry": expectedAzureContainerRegistry,
233194
"azurerm_resource_group.app_rg": expectedAppDevResourceGroup,
234195
"azurerm_resource_group.admin_rg": expectedAdminResourceGroup,
235196
"module.service_plan.azurerm_app_service_plan.svcplan": expectedAppServicePlan,

0 commit comments

Comments
 (0)