mirror of
https://github.com/actions/runner-images.git
synced 2025-12-12 03:57:32 +00:00
Cleanup AD principal resources (#5481)
This commit is contained in:
Aleksandr Chebotov
committed by
GitHub
GitHub
parent
3caf4a3e5c
commit
f2c7e4b929
@@ -132,150 +132,172 @@ Function GenerateResourcesAndImage {
|
|||||||
[bool] $EnableHttpsTrafficOnly = $False
|
[bool] $EnableHttpsTrafficOnly = $False
|
||||||
)
|
)
|
||||||
|
|
||||||
$builderScriptPath = Get-PackerTemplatePath -RepositoryRoot $ImageGenerationRepositoryRoot -ImageType $ImageType
|
|
||||||
$ServicePrincipalClientSecret = $env:UserName + [System.GUID]::NewGuid().ToString().ToUpper()
|
|
||||||
$InstallPassword = $env:UserName + [System.GUID]::NewGuid().ToString().ToUpper()
|
|
||||||
|
|
||||||
if ([string]::IsNullOrEmpty($AzureClientId))
|
|
||||||
{
|
|
||||||
Connect-AzAccount
|
|
||||||
} else {
|
|
||||||
$AzSecureSecret = ConvertTo-SecureString $AzureClientSecret -AsPlainText -Force
|
|
||||||
$AzureAppCred = New-Object System.Management.Automation.PSCredential($AzureClientId, $AzSecureSecret)
|
|
||||||
Connect-AzAccount -ServicePrincipal -Credential $AzureAppCred -Tenant $AzureTenantId
|
|
||||||
}
|
|
||||||
Set-AzContext -SubscriptionId $SubscriptionId
|
|
||||||
|
|
||||||
$alreadyExists = $true;
|
|
||||||
try {
|
try {
|
||||||
Get-AzResourceGroup -Name $ResourceGroupName
|
$builderScriptPath = Get-PackerTemplatePath -RepositoryRoot $ImageGenerationRepositoryRoot -ImageType $ImageType
|
||||||
Write-Verbose "Resource group was found, will delete and recreate it."
|
$ServicePrincipalClientSecret = $env:UserName + [System.GUID]::NewGuid().ToString().ToUpper()
|
||||||
|
$InstallPassword = $env:UserName + [System.GUID]::NewGuid().ToString().ToUpper()
|
||||||
|
|
||||||
|
if ([string]::IsNullOrEmpty($AzureClientId))
|
||||||
|
{
|
||||||
|
Connect-AzAccount
|
||||||
|
} else {
|
||||||
|
$AzSecureSecret = ConvertTo-SecureString $AzureClientSecret -AsPlainText -Force
|
||||||
|
$AzureAppCred = New-Object System.Management.Automation.PSCredential($AzureClientId, $AzSecureSecret)
|
||||||
|
Connect-AzAccount -ServicePrincipal -Credential $AzureAppCred -Tenant $AzureTenantId
|
||||||
|
}
|
||||||
|
Set-AzContext -SubscriptionId $SubscriptionId
|
||||||
|
|
||||||
|
$alreadyExists = $true;
|
||||||
|
try {
|
||||||
|
Get-AzResourceGroup -Name $ResourceGroupName
|
||||||
|
Write-Verbose "Resource group was found, will delete and recreate it."
|
||||||
|
}
|
||||||
|
catch {
|
||||||
|
Write-Verbose "Resource group was not found, will create it."
|
||||||
|
$alreadyExists = $false;
|
||||||
|
}
|
||||||
|
|
||||||
|
if ($alreadyExists) {
|
||||||
|
if($Force -eq $true) {
|
||||||
|
# Cleanup the resource group if it already exitsted before
|
||||||
|
Remove-AzResourceGroup -Name $ResourceGroupName -Force
|
||||||
|
New-AzResourceGroup -Name $ResourceGroupName -Location $AzureLocation
|
||||||
|
} else {
|
||||||
|
$title = "Delete Resource Group"
|
||||||
|
$message = "The resource group you specified already exists. Do you want to clean it up?"
|
||||||
|
|
||||||
|
$yes = New-Object System.Management.Automation.Host.ChoiceDescription "&Yes", `
|
||||||
|
"Delete the resource group including all resources."
|
||||||
|
|
||||||
|
$no = New-Object System.Management.Automation.Host.ChoiceDescription "&No", `
|
||||||
|
"Keep the resource group and continue."
|
||||||
|
|
||||||
|
$stop = New-Object System.Management.Automation.Host.ChoiceDescription "&Stop", `
|
||||||
|
"Stop the current action."
|
||||||
|
|
||||||
|
$options = [System.Management.Automation.Host.ChoiceDescription[]]($yes, $no, $stop)
|
||||||
|
$result = $host.ui.PromptForChoice($title, $message, $options, 0)
|
||||||
|
|
||||||
|
switch ($result)
|
||||||
|
{
|
||||||
|
0 { Remove-AzResourceGroup -Name $ResourceGroupName -Force; New-AzResourceGroup -Name $ResourceGroupName -Location $AzureLocation }
|
||||||
|
1 { <# Do nothing #> }
|
||||||
|
2 { exit }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
New-AzResourceGroup -Name $ResourceGroupName -Location $AzureLocation
|
||||||
|
}
|
||||||
|
|
||||||
|
# This script should follow the recommended naming conventions for azure resources
|
||||||
|
$storageAccountName = if($ResourceGroupName.EndsWith("-rg")) {
|
||||||
|
$ResourceGroupName.Substring(0, $ResourceGroupName.Length -3)
|
||||||
|
} else { $ResourceGroupName }
|
||||||
|
|
||||||
|
# Resource group names may contain special characters, that are not allowed in the storage account name
|
||||||
|
$storageAccountName = $storageAccountName.Replace("-", "").Replace("_", "").Replace("(", "").Replace(")", "").ToLower()
|
||||||
|
$storageAccountName += "001"
|
||||||
|
|
||||||
|
|
||||||
|
# Storage Account Name can only be 24 characters long
|
||||||
|
if ($storageAccountName.Length -gt 24){
|
||||||
|
$storageAccountName = $storageAccountName.Substring(0, 24)
|
||||||
|
}
|
||||||
|
|
||||||
|
New-AzStorageAccount -ResourceGroupName $ResourceGroupName -AccountName $storageAccountName -Location $AzureLocation -SkuName "Standard_LRS" -AllowBlobPublicAccess $AllowBlobPublicAccess -EnableHttpsTrafficOnly $EnableHttpsTrafficOnly
|
||||||
|
|
||||||
|
if ([string]::IsNullOrEmpty($AzureClientId)) {
|
||||||
|
# Interactive authentication: A service principal is created during runtime.
|
||||||
|
$spDisplayName = [System.GUID]::NewGuid().ToString().ToUpper()
|
||||||
|
$startDate = Get-Date
|
||||||
|
$endDate = $startDate.AddYears(1)
|
||||||
|
|
||||||
|
if ('Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential' -as [type]) {
|
||||||
|
$credentials = [Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential]@{
|
||||||
|
StartDate = $startDate
|
||||||
|
EndDate = $endDate
|
||||||
|
Password = $ServicePrincipalClientSecret
|
||||||
|
}
|
||||||
|
$sp = New-AzADServicePrincipal -DisplayName $spDisplayName -PasswordCredential $credentials
|
||||||
|
$spClientId = $sp.ApplicationId
|
||||||
|
$azRoleParam = @{
|
||||||
|
RoleDefinitionName = "Contributor"
|
||||||
|
ServicePrincipalName = $spClientId
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if ('Microsoft.Azure.PowerShell.Cmdlets.Resources.MSGraph.Models.ApiV10.MicrosoftGraphPasswordCredential' -as [type]) {
|
||||||
|
$credentials = [Microsoft.Azure.PowerShell.Cmdlets.Resources.MSGraph.Models.ApiV10.MicrosoftGraphPasswordCredential]@{
|
||||||
|
StartDateTime = $startDate
|
||||||
|
EndDateTime = $endDate
|
||||||
|
}
|
||||||
|
$sp = New-AzADServicePrincipal -DisplayName $spDisplayName
|
||||||
|
$appCred = New-AzADAppCredential -ApplicationId $sp.AppId -PasswordCredentials $credentials
|
||||||
|
$spClientId = $sp.AppId
|
||||||
|
$azRoleParam = @{
|
||||||
|
RoleDefinitionName = "Contributor"
|
||||||
|
PrincipalId = $sp.Id
|
||||||
|
}
|
||||||
|
$ServicePrincipalClientSecret = $appCred.SecretText
|
||||||
|
}
|
||||||
|
|
||||||
|
Start-Sleep -Seconds $SecondsToWaitForServicePrincipalSetup
|
||||||
|
New-AzRoleAssignment @azRoleParam
|
||||||
|
Start-Sleep -Seconds $SecondsToWaitForServicePrincipalSetup
|
||||||
|
$sub = Get-AzSubscription -SubscriptionId $SubscriptionId
|
||||||
|
$tenantId = $sub.TenantId
|
||||||
|
|
||||||
|
# Remove ADPrincipal after the script completed
|
||||||
|
$isCleanupADPrincipal = $true
|
||||||
|
} else {
|
||||||
|
# Parametrized Authentication via given service principal: The service principal with the data provided via the command line
|
||||||
|
# is used for all authentication purposes.
|
||||||
|
$spClientId = $AzureClientId
|
||||||
|
$credentials = $AzureAppCred
|
||||||
|
$ServicePrincipalClientSecret = $AzureClientSecret
|
||||||
|
$tenantId = $AzureTenantId
|
||||||
|
}
|
||||||
|
|
||||||
|
Get-LatestCommit -ErrorAction SilentlyContinue
|
||||||
|
|
||||||
|
$packerBinary = Get-Command "packer"
|
||||||
|
if (-not ($packerBinary)) {
|
||||||
|
throw "'packer' binary is not found on PATH"
|
||||||
|
}
|
||||||
|
|
||||||
|
if($RestrictToAgentIpAddress -eq $true) {
|
||||||
|
$AgentIp = (Invoke-RestMethod http://ipinfo.io/json).ip
|
||||||
|
Write-Host "Restricting access to packer generated VM to agent IP Address: $AgentIp"
|
||||||
|
}
|
||||||
|
|
||||||
|
& $packerBinary build -on-error=ask `
|
||||||
|
-var "client_id=$($spClientId)" `
|
||||||
|
-var "client_secret=$($ServicePrincipalClientSecret)" `
|
||||||
|
-var "subscription_id=$($SubscriptionId)" `
|
||||||
|
-var "tenant_id=$($tenantId)" `
|
||||||
|
-var "location=$($AzureLocation)" `
|
||||||
|
-var "resource_group=$($ResourceGroupName)" `
|
||||||
|
-var "storage_account=$($storageAccountName)" `
|
||||||
|
-var "install_password=$($InstallPassword)" `
|
||||||
|
-var "allowed_inbound_ip_addresses=$($AgentIp)" `
|
||||||
|
$builderScriptPath
|
||||||
}
|
}
|
||||||
catch {
|
catch {
|
||||||
Write-Verbose "Resource group was not found, will create it."
|
Write-Error $_
|
||||||
$alreadyExists = $false;
|
|
||||||
}
|
}
|
||||||
|
finally {
|
||||||
|
# Remove ADServicePrincipal and ADApplication
|
||||||
|
if ($isCleanupADPrincipal) {
|
||||||
|
Write-Host "`nRemoving ${spDisplayName}/${spClientId}:"
|
||||||
|
if (Get-AzADServicePrincipal -DisplayName $spDisplayName) {
|
||||||
|
Write-Host " [+] ADServicePrincipal"
|
||||||
|
Remove-AzADServicePrincipal -DisplayName $spDisplayName -Confirm:$false
|
||||||
|
}
|
||||||
|
|
||||||
if ($alreadyExists) {
|
if (Get-AzADApplication -DisplayName $spDisplayName) {
|
||||||
if($Force -eq $true) {
|
Write-Host " [+] ADApplication"
|
||||||
# Cleanup the resource group if it already exitsted before
|
Remove-AzADApplication -DisplayName $spDisplayName -Confirm:$false
|
||||||
Remove-AzResourceGroup -Name $ResourceGroupName -Force
|
|
||||||
New-AzResourceGroup -Name $ResourceGroupName -Location $AzureLocation
|
|
||||||
} else {
|
|
||||||
$title = "Delete Resource Group"
|
|
||||||
$message = "The resource group you specified already exists. Do you want to clean it up?"
|
|
||||||
|
|
||||||
$yes = New-Object System.Management.Automation.Host.ChoiceDescription "&Yes", `
|
|
||||||
"Delete the resource group including all resources."
|
|
||||||
|
|
||||||
$no = New-Object System.Management.Automation.Host.ChoiceDescription "&No", `
|
|
||||||
"Keep the resource group and continue."
|
|
||||||
|
|
||||||
$stop = New-Object System.Management.Automation.Host.ChoiceDescription "&Stop", `
|
|
||||||
"Stop the current action."
|
|
||||||
|
|
||||||
$options = [System.Management.Automation.Host.ChoiceDescription[]]($yes, $no, $stop)
|
|
||||||
$result = $host.ui.PromptForChoice($title, $message, $options, 0)
|
|
||||||
|
|
||||||
switch ($result)
|
|
||||||
{
|
|
||||||
0 { Remove-AzResourceGroup -Name $ResourceGroupName -Force; New-AzResourceGroup -Name $ResourceGroupName -Location $AzureLocation }
|
|
||||||
1 { <# Do nothing #> }
|
|
||||||
2 { exit }
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
} else {
|
|
||||||
New-AzResourceGroup -Name $ResourceGroupName -Location $AzureLocation
|
|
||||||
}
|
}
|
||||||
|
|
||||||
# This script should follow the recommended naming conventions for azure resources
|
|
||||||
$storageAccountName = if($ResourceGroupName.EndsWith("-rg")) {
|
|
||||||
$ResourceGroupName.Substring(0, $ResourceGroupName.Length -3)
|
|
||||||
} else { $ResourceGroupName }
|
|
||||||
|
|
||||||
# Resource group names may contain special characters, that are not allowed in the storage account name
|
|
||||||
$storageAccountName = $storageAccountName.Replace("-", "").Replace("_", "").Replace("(", "").Replace(")", "").ToLower()
|
|
||||||
$storageAccountName += "001"
|
|
||||||
|
|
||||||
|
|
||||||
# Storage Account Name can only be 24 characters long
|
|
||||||
if ($storageAccountName.Length -gt 24){
|
|
||||||
$storageAccountName = $storageAccountName.Substring(0, 24)
|
|
||||||
}
|
|
||||||
|
|
||||||
New-AzStorageAccount -ResourceGroupName $ResourceGroupName -AccountName $storageAccountName -Location $AzureLocation -SkuName "Standard_LRS" -AllowBlobPublicAccess $AllowBlobPublicAccess -EnableHttpsTrafficOnly $EnableHttpsTrafficOnly
|
|
||||||
|
|
||||||
if ([string]::IsNullOrEmpty($AzureClientId)) {
|
|
||||||
# Interactive authentication: A service principal is created during runtime.
|
|
||||||
$spDisplayName = [System.GUID]::NewGuid().ToString().ToUpper()
|
|
||||||
$startDate = Get-Date
|
|
||||||
$endDate = $startDate.AddYears(1)
|
|
||||||
|
|
||||||
if ('Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential' -as [type]) {
|
|
||||||
$credentials = [Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential]@{
|
|
||||||
StartDate = $startDate
|
|
||||||
EndDate = $endDate
|
|
||||||
Password = $ServicePrincipalClientSecret
|
|
||||||
}
|
|
||||||
$sp = New-AzADServicePrincipal -DisplayName $spDisplayName -PasswordCredential $credentials
|
|
||||||
$spClientId = $sp.ApplicationId
|
|
||||||
$azRoleParam = @{
|
|
||||||
RoleDefinitionName = "Contributor"
|
|
||||||
ServicePrincipalName = $spClientId
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if ('Microsoft.Azure.PowerShell.Cmdlets.Resources.MSGraph.Models.ApiV10.MicrosoftGraphPasswordCredential' -as [type]) {
|
|
||||||
$credentials = [Microsoft.Azure.PowerShell.Cmdlets.Resources.MSGraph.Models.ApiV10.MicrosoftGraphPasswordCredential]@{
|
|
||||||
StartDateTime = $startDate
|
|
||||||
EndDateTime = $endDate
|
|
||||||
}
|
|
||||||
$sp = New-AzADServicePrincipal -DisplayName $spDisplayName
|
|
||||||
$appCred = New-AzADAppCredential -ApplicationId $sp.AppId -PasswordCredentials $credentials
|
|
||||||
$spClientId = $sp.AppId
|
|
||||||
$azRoleParam = @{
|
|
||||||
RoleDefinitionName = "Contributor"
|
|
||||||
PrincipalId = $sp.Id
|
|
||||||
}
|
|
||||||
$ServicePrincipalClientSecret = $appCred.SecretText
|
|
||||||
}
|
|
||||||
|
|
||||||
Start-Sleep -Seconds $SecondsToWaitForServicePrincipalSetup
|
|
||||||
New-AzRoleAssignment @azRoleParam
|
|
||||||
Start-Sleep -Seconds $SecondsToWaitForServicePrincipalSetup
|
|
||||||
$sub = Get-AzSubscription -SubscriptionId $SubscriptionId
|
|
||||||
$tenantId = $sub.TenantId
|
|
||||||
# "", "Note this variable-setting script for running Packer with these Azure resources in the future:", "==============================================================================================", "`$spClientId = `"$spClientId`"", "`$ServicePrincipalClientSecret = `"$ServicePrincipalClientSecret`"", "`$SubscriptionId = `"$SubscriptionId`"", "`$tenantId = `"$tenantId`"", "`$spObjectId = `"$spObjectId`"", "`$AzureLocation = `"$AzureLocation`"", "`$ResourceGroupName = `"$ResourceGroupName`"", "`$storageAccountName = `"$storageAccountName`"", "`$install_password = `"$install_password`"", ""
|
|
||||||
} else {
|
|
||||||
# Parametrized Authentication via given service principal: The service principal with the data provided via the command line
|
|
||||||
# is used for all authentication purposes.
|
|
||||||
$spClientId = $AzureClientId
|
|
||||||
$credentials = $AzureAppCred
|
|
||||||
$ServicePrincipalClientSecret = $AzureClientSecret
|
|
||||||
$tenantId = $AzureTenantId
|
|
||||||
}
|
|
||||||
|
|
||||||
Get-LatestCommit -ErrorAction SilentlyContinue
|
|
||||||
|
|
||||||
$packerBinary = Get-Command "packer"
|
|
||||||
if (-not ($packerBinary)) {
|
|
||||||
throw "'packer' binary is not found on PATH"
|
|
||||||
}
|
|
||||||
|
|
||||||
if($RestrictToAgentIpAddress -eq $true) {
|
|
||||||
$AgentIp = (Invoke-RestMethod http://ipinfo.io/json).ip
|
|
||||||
Write-Host "Restricting access to packer generated VM to agent IP Address: $AgentIp"
|
|
||||||
}
|
|
||||||
|
|
||||||
& $packerBinary build -on-error=ask `
|
|
||||||
-var "client_id=$($spClientId)" `
|
|
||||||
-var "client_secret=$($ServicePrincipalClientSecret)" `
|
|
||||||
-var "subscription_id=$($SubscriptionId)" `
|
|
||||||
-var "tenant_id=$($tenantId)" `
|
|
||||||
-var "location=$($AzureLocation)" `
|
|
||||||
-var "resource_group=$($ResourceGroupName)" `
|
|
||||||
-var "storage_account=$($storageAccountName)" `
|
|
||||||
-var "install_password=$($InstallPassword)" `
|
|
||||||
-var "allowed_inbound_ip_addresses=$($AgentIp)" `
|
|
||||||
$builderScriptPath
|
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user