Skip to content

Commit f530b05

Browse files
authored
AzureFileCopyV6: Supports WIF and remove usage of SAS token. (#19650)
* new task creation * sas removal+ WIF+ Azlogin * build * update finally block * task version to 237 * remove sas tc * update gdnguidlines to fix pr failure * added v6 in make-option.json * updated gdn * updated releaseNotes * updated utility.ps1 file * added issue link * add RBAC related link * Storage context creation with Microsoft Entra credentials. * build storage context creation with Microsoft Entra credentials.
1 parent 9e519cb commit f530b05

File tree

117 files changed

+18355
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

117 files changed

+18355
-0
lines changed

.gdn/.gdnbaselines

+66
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,72 @@
1313
}
1414
},
1515
"results": {
16+
"407cc257f37ce2a1a83660de9e661902b2aad514f7ca760e16ed4ac555cff1c3": {
17+
"signature": "407cc257f37ce2a1a83660de9e661902b2aad514f7ca760e16ed4ac555cff1c3",
18+
"alternativeSignatures": [
19+
"fee414b5ea08713bc228b9edf15baee950baba8f8fa35f9c67be6e86795b77ee"
20+
],
21+
"memberOf": [
22+
"default"
23+
],
24+
"createdDate": "2024-03-20 15:10:36Z"
25+
},
26+
"9115d8d02bc9d2b3aa7a0509f742da5087765a603bf954512923566fa4ffa946": {
27+
"signature": "9115d8d02bc9d2b3aa7a0509f742da5087765a603bf954512923566fa4ffa946",
28+
"alternativeSignatures": [
29+
"5330e2e2159d8073e5a7492e49d705b60c40b85436b9406e2ef4b8a19af77cca"
30+
],
31+
"memberOf": [
32+
"default"
33+
],
34+
"createdDate": "2024-03-20 15:10:36Z"
35+
},
36+
"784fc91626d8ee62fd3f99d56999618147f2b68218768aeeb7ea064ded65e6db": {
37+
"signature": "784fc91626d8ee62fd3f99d56999618147f2b68218768aeeb7ea064ded65e6db",
38+
"alternativeSignatures": [
39+
"b67a25df17a2218170da5aa5eff32ed84727c6ba9f02f7a2308c7162a0821dfa"
40+
],
41+
"memberOf": [
42+
"default"
43+
],
44+
"createdDate": "2024-03-20 15:10:36Z"
45+
},
46+
"158c4b23b4ff681530f30aa80653ae6261210f9777a2cfd0f3535ebc66dfb227": {
47+
"signature": "158c4b23b4ff681530f30aa80653ae6261210f9777a2cfd0f3535ebc66dfb227",
48+
"alternativeSignatures": [
49+
"c832f5a0cc0e2ce50496a2860c006279a37505b1a69c6a2ccb70295481910468"
50+
],
51+
"memberOf": [
52+
"default"
53+
],
54+
"createdDate": "2024-03-20 10:25:39Z",
55+
"justification": "PSAvoidUsingConvertToSecureStringWithPlainText"
56+
},
57+
"2c02eec8cf96bc63fb8ff72417da0e84215ba8dead870baedfdad351e7659372": {
58+
"signature": "2c02eec8cf96bc63fb8ff72417da0e84215ba8dead870baedfdad351e7659372",
59+
"alternativeSignatures": [
60+
"92f202b770c277f86d23afc5fc79c53b64a7f2fe00544f9f4e0019e36403fd40"
61+
],
62+
"memberOf": [
63+
"default"
64+
],
65+
"createdDate": "2024-03-20 10:25:39Z",
66+
"justification": "PSAvoidUsingUsernameAndPasswordParams"
67+
},
68+
"60a0aa841d38e44479e47d9d4349475efeb49a3e8f4cd8adfbe8ec832160713b": {
69+
"signature": "60a0aa841d38e44479e47d9d4349475efeb49a3e8f4cd8adfbe8ec832160713b",
70+
"alternativeSignatures": [
71+
"30cc30f55e8853b028db85e8d8056968a779e3376453b4a28abafd228153f6be"
72+
],
73+
"memberOf": [
74+
"default"
75+
],
76+
"createdDate": "2024-03-20 10:25:39Z",
77+
"justification": "PSAvoidUsingConvertToSecureStringWithPlainText"
78+
},
79+
80+
81+
1682
"a2a4017726eb18c7612da6ab3828cfdfd1218160fbd5d373c715476df1847499": {
1783
"signature": "a2a4017726eb18c7612da6ab3828cfdfd1218160fbd5d373c715476df1847499",
1884
"alternativeSignatures": [

.github/CODEOWNERS

+4
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,10 @@ Tasks/AzureFileCopyV3/ @microsoft/release-management-task-team @manolerazvan
4343

4444
Tasks/AzureFileCopyV4/ @microsoft/release-management-task-team @manolerazvan
4545

46+
Tasks/AzureFileCopyV5/ @microsoft/release-management-task-team @manolerazvan
47+
48+
Tasks/AzureFileCopyV6/ @microsoft/release-management-task-team @manolerazvan
49+
4650
Tasks/AzureFunctionAppV1/ @finvamp1 @patelchandni @microsoft/release-management-task-team @manolerazvan
4751

4852
Tasks/AzureFunctionAppV2/ @finvamp1 @patelchandni @microsoft/release-management-task-team @manolerazvan
+257
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,257 @@
1+
[CmdletBinding()]
2+
param()
3+
4+
Trace-VstsEnteringInvocation $MyInvocation
5+
6+
# Get inputs for the task
7+
$sourcePath = Get-VstsInput -Name SourcePath -Require
8+
$destination = Get-VstsInput -Name Destination -Require
9+
$connectedServiceName = Get-VstsInput -Name ConnectedServiceNameARM -Require
10+
$storageAccount = Get-VstsInput -Name StorageAccountRM
11+
$containerName = Get-VstsInput -Name ContainerName
12+
$blobPrefix = Get-VstsInput -Name BlobPrefix
13+
$environmentName = Get-VstsInput -Name EnvironmentNameRM
14+
$resourceFilteringMethod = Get-VstsInput -Name ResourceFilteringMethod
15+
$machineNames = Get-VstsInput -Name MachineNames
16+
$vmsAdminUserName = Get-VstsInput -Name VmsAdminUsername
17+
$vmsAdminPassword = Get-VstsInput -Name VmsAdminPassword
18+
$targetPath = Get-VstsInput -Name TargetPath
19+
$additionalArgumentsForBlobCopy = Get-VstsInput -Name AdditionalArgumentsForBlobCopy
20+
$additionalArgumentsForVMCopy = Get-VstsInput -Name AdditionalArgumentsForVMCopy
21+
$cleanTargetBeforeCopy = Get-VstsInput -Name CleanTargetBeforeCopy -AsBool
22+
$copyFilesInParallel = Get-VstsInput -Name CopyFilesInParallel -AsBool
23+
$skipCACheck = Get-VstsInput -Name SkipCACheck -AsBool
24+
$enableCopyPrerequisites = Get-VstsInput -Name EnableCopyPrerequisites -AsBool
25+
26+
if ($destination -ne "AzureBlob") {
27+
$blobPrefix = ""
28+
}
29+
30+
# Constants
31+
$useHttpsProtocolOption = ''
32+
$ErrorActionPreference = 'Stop'
33+
$telemetrySet = $false
34+
$isPremiumStorage = $false
35+
36+
$sourcePath = $sourcePath.Trim('"')
37+
$storageAccount = $storageAccount.Trim()
38+
$containerName = $containerName.Trim().ToLower()
39+
40+
$additionalArgumentsForBlobCopy = $additionalArgumentsForBlobCopy.Trim()
41+
$additionalArgumentsForVMCopy = $additionalArgumentsForVMCopy.Trim()
42+
$useDefaultArgumentsForBlobCopy = ($additionalArgumentsForBlobCopy -eq "")
43+
44+
# azcopy location on automation agent
45+
$azCopyExeLocation = 'AzCopy\AzCopy.exe'
46+
$azCopyLocation = [System.IO.Path]::GetDirectoryName($azCopyExeLocation)
47+
48+
# Import RemoteDeployer
49+
Import-Module $PSScriptRoot\ps_modules\RemoteDeployer
50+
51+
# Initialize Azure.
52+
Import-Module $PSScriptRoot\ps_modules\VstsAzureHelpers_
53+
54+
$endpoint = Get-VstsEndpoint -Name $connectedServiceName -Require
55+
56+
# Update PSModulePath for hosted agent
57+
. "$PSScriptRoot\Utility.ps1"
58+
59+
CleanUp-PSModulePathForHostedAgent
60+
61+
$vstsEndpoint = Get-VstsEndpoint -Name SystemVssConnection -Require
62+
$vstsAccessToken = $vstsEndpoint.auth.parameters.AccessToken
63+
64+
if (Get-Module Az.Accounts -ListAvailable) {
65+
$encryptedToken = ConvertTo-SecureString $vstsAccessToken -AsPlainText -Force
66+
Initialize-AzModule -Endpoint $endpoint -connectedServiceNameARM $connectedServiceName -encryptedToken $encryptedToken
67+
}
68+
else {
69+
Write-Verbose "No module found with name: Az.Accounts"
70+
throw ("Could not find the module Az.Accounts with given version. If the module was recently installed, retry after restarting the Azure Pipelines task agent.")
71+
}
72+
73+
# Import the loc strings.
74+
Import-VstsLocStrings -LiteralPath $PSScriptRoot/Task.json
75+
76+
# Load all dependent files for execution
77+
. "$PSScriptRoot\AzureFileCopyRemoteJob.ps1"
78+
79+
# Enabling detailed logging only when system.debug is true
80+
$enableDetailedLogging = ($env:system_debug -eq "true")
81+
82+
# Telemetry
83+
Import-Module $PSScriptRoot\ps_modules\TelemetryHelper
84+
85+
# Sanitizer
86+
Import-Module $PSScriptRoot\ps_modules\Sanitizer
87+
$useSanitizerCall = Get-SanitizerCallStatus
88+
$useSanitizerActivate = Get-SanitizerActivateStatus
89+
90+
if ($useSanitizerCall) {
91+
$sanitizedArgumentsForBlobCopy = Protect-ScriptArguments -InputArgs $additionalArgumentsForBlobCopy -TaskName "AzureFileCopyV5"
92+
$sanitizedArgumentsForVMCopy = Protect-ScriptArguments -InputArgs $additionalArgumentsForVMCopy -TaskName "AzureFileCopyV5"
93+
}
94+
95+
if ($useSanitizerActivate) {
96+
$additionalArgumentsForBlobCopy = $sanitizedArgumentsForBlobCopy -join " "
97+
$additionalArgumentsForVMCopy = $sanitizedArgumentsForVMCopy -join " "
98+
}
99+
100+
#### MAIN EXECUTION OF AZURE FILE COPY TASK BEGINS HERE ####
101+
try {
102+
try {
103+
# Importing required version of azure cmdlets according to azureps installed on machine
104+
$azureUtility = Get-AzureUtility
105+
106+
Write-Verbose -Verbose "Loading $azureUtility"
107+
. "$PSScriptRoot/$azureUtility"
108+
109+
# Telemetry for endpoint id
110+
$telemetryJsonContent = "{`"endpointId`":`"$connectedServiceName`"}"
111+
Write-Host "##vso[telemetry.publish area=TaskEndpointId;feature=AzureFileCopy]$telemetryJsonContent"
112+
113+
114+
# creating storage context to be used while creating container, deleting container
115+
$storageContext = Create-AzureStorageContextWithConnectedAcc -StorageAccountName $storageAccount
116+
117+
# Geting Azure Storage Account type
118+
$storageAccountType = Get-StorageAccountType $storageAccount $endpoint $connectedServiceName $vstsAccessToken
119+
Write-Verbose "Obtained Storage Account type: $storageAccountType"
120+
if (-not [string]::IsNullOrEmpty($storageAccountType) -and $storageAccountType.Contains('Premium')) {
121+
$isPremiumStorage = $true
122+
}
123+
124+
# creating temporary container for uploading files if no input is provided for container name
125+
if ([string]::IsNullOrEmpty($containerName) -or ($destination -ne "AzureBlob")) {
126+
$containerName = [guid]::NewGuid().ToString()
127+
Write-Verbose "Container Name input not found. Creating Temporary container for uploading files."
128+
Create-AzureContainer -containerName $containerName -storageContext $storageContext
129+
}
130+
else {
131+
#checking if the containerName provided exist or not
132+
$containerPresent = Get-AzureContainer -containerName $containerName -storageContext $storageContext
133+
134+
#creating container if the containerName provided does not exist
135+
if ($null -eq $containerPresent) {
136+
Write-Verbose "Creating container if the containerName provided does not exist"
137+
Create-AzureContainer -containerName $containerName -storageContext $storageContext
138+
}
139+
}
140+
141+
142+
# Getting Azure Blob Storage Endpoint
143+
$blobStorageEndpoint = Get-blobStorageEndpoint -storageAccountName $storageAccount -endpoint $endpoint -vstsAccessToken $vstsAccessToken
144+
145+
# Setting environment variable for tracking Azure Pipelines usage in AzCopy telemetry
146+
$env:AZCOPY_USER_AGENT_PREFIX = "TFS_useragent"
147+
}
148+
catch {
149+
Write-Verbose $_.Exception.ToString()
150+
Write-Telemetry "Task_InternalError" "TemporaryCopyingToBlobContainerFailed"
151+
throw
152+
}
153+
154+
# Set optional arguments for azcopy blob upload
155+
if ($useDefaultArgumentsForBlobCopy) {
156+
# Adding default optional arguments:
157+
# log-level: Defines the log verbosity for the log file. Default is INFO(all requests/responses)
158+
159+
Write-Verbose "Using default AzCopy arguments for uploading to blob storage"
160+
161+
$additionalArgumentsForBlobCopy = "--log-level=INFO"
162+
163+
# Add more arguments if required
164+
165+
# Premium storage accounts only support page blobs
166+
if ($isPremiumStorage) {
167+
Write-Verbose "Setting BlobType to page for Premium Storage account."
168+
$additionalArgumentsForBlobCopy += " --blob-type=PageBlob"
169+
}
170+
171+
# $root container does not support sub folders. So excluding recursive copy option for $root container.
172+
if ($containerName -ne '$root') {
173+
Write-Verbose "Adding argument for recursive copy"
174+
$additionalArgumentsForBlobCopy += " --recursive"
175+
}
176+
}
177+
178+
Check-ContainerNameAndArgs -containerName $containerName -additionalArguments $additionalArgumentsForBlobCopy
179+
180+
# Uploading files to container
181+
Upload-FilesToAzureContainer -sourcePath $sourcePath `
182+
-endPoint $endpoint `
183+
-storageAccountName $storageAccount `
184+
-containerName $containerName `
185+
-blobPrefix $blobPrefix `
186+
-blobStorageEndpoint $blobStorageEndpoint `
187+
-azCopyLocation $azCopyLocation `
188+
-additionalArguments $additionalArgumentsForBlobCopy `
189+
-destinationType $destination `
190+
-useDefaultArguments $useDefaultArgumentsForBlobCopy `
191+
-cleanTargetBeforeCopy $cleanTargetBeforeCopy `
192+
-useSanitizerActivate $useSanitizerActivate
193+
194+
# Complete the task if destination is azure blob
195+
if ($destination -eq "AzureBlob") {
196+
# Get URI for output variable
197+
$storageAccountContainerURI = $storageContext.BlobEndPoint + $containerName + "/"
198+
Write-Host "##vso[task.setvariable variable=StorageContainerUri]$storageAccountContainerURI"
199+
200+
Remove-EndpointSecrets
201+
Write-Verbose "Completed Azure File Copy Task for Azure Blob Destination"
202+
203+
return
204+
}
205+
206+
# Copying files to Azure VMs
207+
try {
208+
# Normalize admin username
209+
if ($vmsAdminUserName -and (-not $vmsAdminUserName.StartsWith(".\")) -and ($vmsAdminUserName.IndexOf("\") -eq -1) -and ($vmsAdminUserName.IndexOf("@") -eq -1)) {
210+
$vmsAdminUserName = ".\" + $vmsAdminUserName
211+
}
212+
# getting azure vms properties(name, fqdn, winrmhttps port)
213+
$azureVMResourcesProperties = Get-AzureVMResourcesProperties -resourceGroupName $environmentName `
214+
-resourceFilteringMethod $resourceFilteringMethod -machineNames $machineNames -enableCopyPrerequisites $enableCopyPrerequisites `
215+
-connectedServiceName $connectedServiceName -vstsAccessToken $vstsAccessToken
216+
217+
$azureVMsCredentials = Get-AzureVMsCredentials -vmsAdminUserName $vmsAdminUserName -vmsAdminPassword $vmsAdminPassword
218+
219+
# Get Invoke-RemoteScript parameters
220+
$invokeRemoteScriptParams = Get-InvokeRemoteScriptParameters -azureVMResourcesProperties $azureVMResourcesProperties `
221+
-networkCredentials $azureVMsCredentials `
222+
-skipCACheck $skipCACheck
223+
224+
# Copies files on azureVMs
225+
Copy-FilesToAzureVMsFromStorageContainer -targetMachineNames $invokeRemoteScriptParams.targetMachineNames `
226+
-credential $invokeRemoteScriptParams.credential `
227+
-protocol $invokeRemoteScriptParams.protocol `
228+
-sessionOption $invokeRemoteScriptParams.sessionOption `
229+
-blobStorageEndpoint $blobStorageEndpoint `
230+
-containerName $containerName `
231+
-targetPath $targetPath `
232+
-cleanTargetBeforeCopy $cleanTargetBeforeCopy `
233+
-copyFilesInParallel $copyFilesInParallel `
234+
-additionalArguments $additionalArgumentsForVMCopy `
235+
-azCopyToolLocation $azCopyLocation `
236+
-fileCopyJobScript $AzureFileCopyRemoteJob `
237+
-enableDetailedLogging $enableDetailedLogging `
238+
-useSanitizerActivate $useSanitizerActivate
239+
240+
Write-Output (Get-VstsLocString -Key "AFC_CopySuccessful" -ArgumentList $sourcePath, $environmentName)
241+
}
242+
catch {
243+
Write-Verbose $_.Exception.ToString()
244+
245+
Write-Telemetry "Task_InternalError" "CopyingToAzureVMFailed"
246+
throw
247+
}
248+
finally {
249+
Remove-AzureContainer -containerName $containerName -storageContext $storageContext
250+
Remove-EndpointSecrets
251+
Write-Verbose "Completed Azure File Copy Task for Azure VMs Destination" -Verbose
252+
Trace-VstsLeavingInvocation $MyInvocation
253+
}
254+
}
255+
finally {
256+
Disconnect-AzureAndClearContext -authScheme $endpoint.Auth.Scheme -ErrorAction SilentlyContinue
257+
}

0 commit comments

Comments
 (0)