Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Enhancement] Update CI/CD pipeline for CaC solution version upgrade preserving attestations #126

Closed
wants to merge 9 commits into from
Closed

[Enhancement] Update CI/CD pipeline for CaC solution version upgrade preserving attestations #126

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
5a9e157
upgrade in dev pipeline
dutt0 Apr 15, 2024
4e59ee7
upgrade deploy in test pipeline
dutt0 Apr 15, 2024
333a240
remove commented lines
dutt0 Apr 16, 2024
d48eb1b
putting back trigger by release
dutt0 Apr 16, 2024
6346034
remove commented lines
dutt0 Apr 16, 2024
0421a4c
removing branch trigger from workflow
dutt0 Apr 16, 2024
6d396c1
putting back pre clean for test
dutt0 Apr 16, 2024
371032e
Merge branch 'main' into idutta/upgrade_preserve_storage_file
dutt0 Apr 16, 2024
a7d1949
default env var for upgrade strategy
dutt0 Apr 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
91 changes: 10 additions & 81 deletions .github/workflows/deploy_dev_env.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,11 +47,13 @@ jobs:
run: |
$moduleCodeFilesObjs = Get-ChildItem -Path .\src -Recurse -Include *.psm1 -Exclude '*-GSA*','*GuardrailsSolutionAcceleratorSetup*','*Deploy-GuardrailsSolutionAccelerator*'
Write-Host "'$($moduleCodeFilesObjs.count)' module manifest files "

ForEach ($moduleCodeFile in $moduleCodeFilesObjs) {
$moduleManifestFile = Get-Item -Path $moduleCodeFile.FullName.replace('psm1','psd1')

If ($moduleCodeFilesObjs.FullName -icontains $moduleCodeFile.FullName -or $moduleCodeFilesObjs.FullName -icontains $moduleManifestFile.FullName) {
Write-Host "Module '$($moduleCodeFile.BaseName)' found, zipping module files..."

$destPath = "./psmodules/$($moduleCodeFile.BaseName).zip"
If ($moduleCodeFile.DIrectory.Name -eq 'Guardrails-Localization') {
Compress-Archive -Path "$($moduleCodeFile.Directory)/*" -DestinationPath $destPath -Force
Expand Down Expand Up @@ -107,86 +109,6 @@ jobs:
PIPELINEMODULESTAGING_STORAGEACCOUNTNAME: ${{ vars.PIPELINEMODULESTAGING_SANAME_DEV }}
DEVSUBSCRIPTION_ID: ${{ secrets.DEV_AZURE_SUBSCRIPTION_ID}}

- name: Pre-Clean Dev environment
uses: azure/powershell@v1
continue-on-error: true
with:
inlineScript: |
Set-AzContext -SubscriptionId $env:DEVSUBSCRIPTION_ID
ipmo ./src/GuardrailsSolutionAcceleratorSetup
$configFilePath = Join-Path -Path $env:GITHUB_WORKSPACE -ChildPath 'config.json'
$CBSSUBSCRIPTION_DEV_NAME = $env:CBSSUBSCRIPTION_DEV_NAME
$DEVSUBSCRIPTION_ID = $env:DEVSUBSCRIPTION_ID
$LIGHTHOUSEPROVIDER_TENANTID = $env:LIGHTHOUSEPROVIDER_TENANTID
$LIGHTHOUSEPROVIDER_PRINCIPALID = $env:LIGHTHOUSEPROVIDER_PRINCIPALID
$LIGHTHOUSEPROVIDER_MGMTGRPID_DEV = $env:LIGHTHOUSEPROVIDER_MGMTGRPID_DEV
$UNIQUENAME_SUFFIX_DEV = $env:UNIQUENAME_SUFFIX_DEV
$DEVTENANT_BGA1 = $env:DEVTENANT_BGA1
$DEVTENANT_BGA2 = $env:DEVTENANT_BGA2
$PBMMPOLICY_ID = $env:PBMMPOLICY_ID
$LOCATIONPOLICY_ID = $env:LOCATIONPOLICY_ID
$DEVLAW_SEC = $env:DEVLAW_SEC
$DEVLAW_HEALTH = $env:DEVLAW_HEALTH

$configContent = @"
{
"keyVaultName": "kvcac",
"resourcegroup": "rgcac",
"region": "CanadaCentral",
"storageaccountName": "stcac",
"logAnalyticsworkspaceName": "logcac",
"autoMationAccountName": "aacac",
"FirstBreakGlassAccountUPN": "$DEVTENANT_BGA1",
"SecondBreakGlassAccountUPN": "$DEVTENANT_BGA2",
"PBMMPolicyID": "$PBMMPOLICY_ID",
"AllowedLocationPolicyId": "$LOCATIONPOLICY_ID",
"DepartmentNumber": "163",
"CBSSubscriptionName": "$CBSSUBSCRIPTION_DEV_NAME",
"securityLAWResourceId": "$DEVLAW_SEC",
"healthLAWResourceId": "$DEVLAW_HEALTH",
"Locale": "en-CA",
"lighthouseServiceProviderTenantID": "$LIGHTHOUSEPROVIDER_TENANTID",
"lighthousePrincipalDisplayName": "GcPc-CTO-Guardrails_Compliance-Owners",
"lighthousePrincipalId": "$LIGHTHOUSEPROVIDER_PRINCIPALID",
"lighthouseTargetManagementGroupID": "$LIGHTHOUSEPROVIDER_MGMTGRPID_DEV",
"subscriptionId": "$DEVSUBSCRIPTION_ID",
"SSCReadOnlyServicePrincipalNameAPPID": "00000000-0000-0000-0000-000000000000",
"uniqueNameSuffix": "$UNIQUENAME_SUFFIX_DEV",
"securityRetentionDays": "730",
"cloudUsageProfiles": "3"
}
"@
Set-Content -Path $configFilePath -Value $configContent
Push-Location -Path setup

try {
$ErrorActionPreference = 'Stop'
remove-gsacentralizedReportingCustomerComponents -Force -configFilePath $configFilePath -verbose
Remove-GSACentralizedDefenderCustomerComponents -Force -configFilePath $configFilePath -verbose
Remove-GSACoreResources -Force -Wait -configFilePath $configFilePath -verbose
}
catch {
throw "Failed test deploy of solution with error: $_"
}
finally {
If (!$?) {throw "Failed test deploy of solution with error: $($error[0]) $_"}
Pop-Location
}
azPSVersion: "latest"
env:
DEVTENANT_DOMAIN: ${{ vars.DEVTENANT_DOMAIN }}
DEVSUBSCRIPTION_ID: ${{ vars.DEVSUBSCRIPTION_ID }}
CBSSUBSCRIPTION_DEV_NAME: ${{ vars.CBSSUBSCRIPTION_DEV_NAME }}
LIGHTHOUSEPROVIDER_TENANTID: ${{ vars.LIGHTHOUSEPROVIDER_TENANTID }}
LIGHTHOUSEPROVIDER_PRINCIPALID: ${{ vars.LIGHTHOUSEPROVIDER_PRINCIPALID }}
LIGHTHOUSEPROVIDER_MGMTGRPID_DEV: ${{ vars.LIGHTHOUSEPROVIDER_MGMTGRPID_DEV }}
UNIQUENAME_SUFFIX_DEV: ${{ vars.UNIQUENAME_SUFFIX_DEV }}
DEVTENANT_BGA1: ${{ vars.DEVTENANT_BGA1 }}
DEVTENANT_BGA2: ${{ vars.DEVTENANT_BGA2 }}
PBMMPOLICY_ID: ${{ vars.PBMMPOLICY_ID }}
LOCATIONPOLICY_ID: ${{ vars.LOCATIONPOLICY_ID }}
DEVLAW_SEC: ${{ vars.DEVLAW_SEC }}
DEVLAW_HEALTH: ${{ vars.DEVLAW_HEALTH }}
- name: Relogin AZ
uses: azure/login@v1
with:
Expand Down Expand Up @@ -246,28 +168,35 @@ jobs:
# Load tags JSON content into a variable
$setupFileRelativePath = "setup/tags.json"
$setupFullPath = Join-Path $env:GITHUB_WORKSPACE $setupFileRelativePath

$jsonContent = Get-Content -Raw -Path $setupFullPath | ConvertFrom-Json

# Add additional tags for dev tenant
$jsonContent | Add-Member -Type NoteProperty -Name 'ClientOrganization' -Value 'SSC'
$jsonContent | Add-Member -Type NoteProperty -Name 'CostCenter' -Value 'SSC Cloud Operations'
$jsonContent | Add-Member -Type NoteProperty -Name 'DataSensitivity' -Value 'PB'
$jsonContent | Add-Member -Type NoteProperty -Name 'ProjectContact' -Value 'Amrinder'
$jsonContent | Add-Member -Type NoteProperty -Name 'ProjectName' -Value 'ComplianceAsCodeAzure'
$jsonContent | Add-Member -Type NoteProperty -Name 'TechnicalContact' -Value 'Amrinder'

# Save the modified content back to the tags JSON file
$jsonContent | ConvertTo-Json | Set-Content -Path $setupFullPath

$storageContext = (Get-AzStorageAccount -ResourceGroupName $env:PIPELINEMODULESTAGING_RGNAME -Name $env:PIPELINEMODULESTAGING_STORAGEACCOUNTNAME).context
$modulesStagingURI = $storageContext.BlobEndpoint.ToString() + 'psmodules'

$alternatePSModulesURL = $modulesStagingURI
Write-Output "alternatePSModulesURL is '$alternatePSModulesURL'"

$optionalParams = @{}
if ($alternatePSModulesURL) {
$optionalParams['alternatePSModulesURL'] = $alternatePSModulesURL
}

try {
$ErrorActionPreference = 'Stop'
ipmo ./src/GuardrailsSolutionAcceleratorSetup
Deploy-GuardrailsSolutionAccelerator -configFilePath $configFilePath -newComponents CoreComponents, CentralizedCustomerDefenderForCloudSupport, CentralizedCustomerReportingSupport -Yes @optionalParams -verbose
Deploy-GuardrailsSolutionAccelerator -configFilePath $configFilePath -update -Yes @optionalParams -verbose
}
catch {
throw "Failed test deploy of solution with error: $_"
Expand Down
84 changes: 1 addition & 83 deletions .github/workflows/sign-scripts-development.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -172,88 +172,6 @@ jobs:
PIPELINEMODULESTAGING_STORAGEACCOUNTNAME: ${{ vars.PIPELINEMODULESTAGING_SANAME }}
SUBSCRIPTIONID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

- name: Pre-Clean Test environment
uses: azure/powershell@v1
continue-on-error: true
with:
inlineScript: |
Set-AzContext -SubscriptionId $env:TESTSUBSCRIPTION_ID
ipmo ./src/GuardrailsSolutionAcceleratorSetup

$configFilePath = Join-Path -Path $env:GITHUB_WORKSPACE -ChildPath 'config.json'
$CBSSUBSCRIPTION_NAME = $env:CBSSUBSCRIPTION_NAME
$TESTSUBSCRIPTION_ID = $env:TESTSUBSCRIPTION_ID
$LIGHTHOUSEPROVIDER_TENANTID = $env:LIGHTHOUSEPROVIDER_TENANTID
$LIGHTHOUSEPROVIDER_PRINCIPALID = $env:LIGHTHOUSEPROVIDER_PRINCIPALID
$LIGHTHOUSEPROVIDER_MGMTGRPID = $env:LIGHTHOUSEPROVIDER_MGMTGRPID
$UNIQUENAME_SUFFIX = $env:UNIQUENAME_SUFFIX
$TESTTENANT_BGA1 = $env:TESTTENANT_BGA1
$TESTTENANT_BGA2 = $env:TESTTENANT_BGA2
$PBMMPOLICY_ID = $env:PBMMPOLICY_ID
$LOCATIONPOLICY_ID = $env:LOCATIONPOLICY_ID
$TESTSEC_RESRC_ID = $env:TESTSEC_RESRC_ID
$TESTHEALTHLAW_RESRC_ID = $env:TESTHEALTHLAW_RESRC_ID

$configContent = @"
{
"keyVaultName": "gsapipe",
"resourcegroup": "gsapipe",
"region": "CanadaCentral",
"storageaccountName": "gsapipe",
"logAnalyticsworkspaceName": "gsapipe",
"autoMationAccountName": "gsapipe",
"FirstBreakGlassAccountUPN": "$TESTTENANT_BGA1",
"SecondBreakGlassAccountUPN": "$TESTTENANT_BGA2",
"PBMMPolicyID": "$PBMMPOLICY_ID",
"AllowedLocationPolicyId": "$LOCATIONPOLICY_ID",
"DepartmentNumber": "163",
"CBSSubscriptionName": "$CBSSUBSCRIPTION_NAME",
"securityLAWResourceId": "$TESTSEC_RESRC_ID",
"healthLAWResourceId": "$TESTHEALTHLAW_RESRC_ID",
"Locale": "en-CA",
"lighthouseServiceProviderTenantID": "$LIGHTHOUSEPROVIDER_TENANTID",
"lighthousePrincipalDisplayName": "SSC CSPM TEAM",
"lighthousePrincipalId": "$LIGHTHOUSEPROVIDER_PRINCIPALID",
"lighthouseTargetManagementGroupID": "$LIGHTHOUSEPROVIDER_MGMTGRPID",
"subscriptionId": "$TESTSUBSCRIPTION_ID",
"SSCReadOnlyServicePrincipalNameAPPID": "00000000-0000-0000-0000-000000000000",
"uniqueNameSuffix": "$UNIQUENAME_SUFFIX",
"securityRetentionDays": "730",
"cloudUsageProfiles": "3"
}
"@
Set-Content -Path $configFilePath -Value $configContent

Push-Location -Path setup

try {
$ErrorActionPreference = 'Stop'
remove-gsacentralizedReportingCustomerComponents -Force -configFilePath $configFilePath -verbose
Remove-GSACentralizedDefenderCustomerComponents -Force -configFilePath $configFilePath -verbose
Remove-GSACoreResources -Force -Wait -configFilePath $configFilePath -verbose
}
catch {
throw "Failed test deploy of solution with error: $_"
}
finally {
If (!$?) {throw "Failed test deploy of solution with error: $($error[0]) $_"}
Pop-Location
}
azPSVersion: "latest"
env:
TESTTENANT_DOMAIN: ${{ vars.TESTTENANT_DOMAIN }}
TESTSUBSCRIPTION_ID: ${{ vars.TESTSUBSCRIPTION_ID }}
CBSSUBSCRIPTION_NAME: ${{ vars.CBSSUBSCRIPTION_NAME }}
LIGHTHOUSEPROVIDER_TENANTID: ${{ vars.LIGHTHOUSEPROVIDER_TENANTID }}
LIGHTHOUSEPROVIDER_PRINCIPALID: ${{ vars.LIGHTHOUSEPROVIDER_PRINCIPALID }}
LIGHTHOUSEPROVIDER_MGMTGRPID: ${{ vars.LIGHTHOUSEPROVIDER_MGMTGRPID }}
UNIQUENAME_SUFFIX: ${{ vars.UNIQUENAME_SUFFIX }}
TESTTENANT_BGA1: ${{ vars.TESTTENANT_BGA1 }}
TESTTENANT_BGA2: ${{ vars.TESTTENANT_BGA2 }}
PBMMPOLICY_ID: ${{ vars.PBMMPOLICY_ID }}
LOCATIONPOLICY_ID: ${{ vars.LOCATIONPOLICY_ID }}
TESTSEC_RESRC_ID: ${{ vars.TESTSEC_RESRC_ID }}
TESTHEALTHLAW_RESRC_ID: ${{ vars.TESTHEALTHLAW_RESRC_ID }}
- name: ReLogin AZ (due to timeout issue)
uses: azure/login@v1
with:
Expand Down Expand Up @@ -341,7 +259,7 @@ jobs:
try {
$ErrorActionPreference = 'Stop'
ipmo ./src/GuardrailsSolutionAcceleratorSetup
Deploy-GuardrailsSolutionAccelerator -configFilePath $configFilePath -newComponents CoreComponents, CentralizedCustomerDefenderForCloudSupport, CentralizedCustomerReportingSupport -Yes @optionalParams -verbose
Deploy-GuardrailsSolutionAccelerator -configFilePath $configFilePath -update -Yes @optionalParams -verbose
}
catch {
throw "Failed test deploy of solution with error: $_"
Expand Down
Loading