Azure DevOps 管道

Question

我是 Azure DevOps 的新手，我正在尝试使用 Azure DevOps 创建一个管道，用于将我的 terraform 代码部署到 AWS 上，用于身份验证我知道我们可以使用服务原则，但这意味着我需要指定我的访问权限和我不想做的 azure DevOps 中的秘密密钥，所以我想检查是否还有其他方法可以做到这一点？

Answer 1

For accessing/storing these kinds of secrets you can try the Azure Key Vault

Store all your secrets in Azure Key Vault secrets.

When you want to access secrets:

• Ensure the Azure service connection has at least Get and List permissions on the vault. You can set these permissions in the Azure
  portal:

  • Open the Settings blade for the vault, choose Access policies, then Add new.

  • In the Add access policy blade, choose Select principal and select the service principal for your client account.

  • In the Add access policy blade, choose Secret permissions and ensure that Get and List are checked (ticked).

  • Choose OK to save the changes.

Reference

Answer 2

You can use

1. Secure Azure DevOps Variables or Variable Groups
2. Azure Key Vault
3. If you use a Service Principal, then you need a password / certificate as well to authenticate. Maybe you can also try to work with MSI (Managed Service Identity). In that case, the AAD will take care of the secret storage.

Answer 3

If you don't want to store credentials on Azure Devops itself, best way is to store credentials in a credential store (Azure Key Vault) and access it through a service connection. I assume that you are using YAML based pipelines. If so use the following steps to integrate your pipeline with the key vault,

Prerequisites,

• Azure key vault is set up and keys are securely stored

Steps,

1. In edit mode of the pipeline click on the kebab menu (three dots on upper right corner) and select Triggers
2. On the opened menu click on the Variables tab and then Variable Groups
3. Open Manage variable groups in a new tab
4. Click on + Variable group button to add a new variable
5. Give a name and a description. Switch on the Link secrets from an Azure key vault as variables toggle.
6. Add a new service connection and once authenticated select the key vault name
7. Now add variables in to the variable group
8. Once done save the variable group and go back to the previous tab in step 2 and link the new variable group.
9. Once done save the pipeline

Important : You need to grant secret read permission to the service connection's service principal from your key vault. Reference: Link secrets from an Azure key vault

Answer 4

Perhaps use the Azure Devops Libary > Variable Groups to securely store you keys.

Alternatively you may be able to use the Project Settings> Service connection. Perhaps using credentials connection or a generic on.

Answer 5

Service principals is the industry standard for this case. You should create a specific service principal for Azure DevOps and limit its scope to only what's necessary.

Answer 6

1- 您必须在您的 AWS 机器上为具有有限服务的 Devops 管道创建私钥 2- 将密钥存储在 Devops 管道的安全库中 3- 从您的 AWS 防火墙禁用来自未知 IP 地址的 SSH 连接，并加入白名单Devops 代理 IP 地址，要获取 ips 列表，请检查此链接https://docs.microsoft.com/en-us/azure/devops/pipelines/agents/hosted?view=vsts&tabs=yaml#agent-ip-ranges

Answer 7

you can write variables into your powershell script file and can use powershell task into your pipeline. Now give powershell file path into this task and just give variables names. It will work like a charm.

Answer 8

对于服务原则连接，您需要有服务原则ID和服务原则密钥服务原则ID与应用程序ID相同服务原则密钥存在于证书和秘密中

Answer 9

You can use Azure Key Vault for storing all your keys and secrets. Give permission to your Azure pipeline to fetch keys from Key Vault.

Following link will guide you from scratch to develop a pipeline and fetch keys:

https://azuredevopslabs.com/labs/vstsextend/azurekeyvault/

Answer 10

The only method to truly not store AWS credentials in Azure/Azure DevOps would be to make a hosted build pool inside your AWS account. These machines will have the azure DevOps agent installed and registered to your Organization and to a specific agent pool. Then add the needed permissions to the Iam instance profile attached to these build servers. When running your terraform commands using this agent pool, terraform will have access to the credentials on the instance. The same concept works for a container based build pool in AWS ECS.

Answer 11

Continuous integration and continuous delivery (CI/CD) are considered by most to be the backbone of DevOps. Things start to get really interesting when you combine these practices with programmable infrastructure and a suite of services that allow you to automate the entire lifecycle of an application.

The goal with this guide is to give you a practical example of what that all looks like when you're building, testing, and deploying applications with Azure DevOps Services. I'll walk you through the end-to-end process of building a fully automated build and release pipeline for a Node and Express application. We'll use Azure DevOps Services to create the CI/CD pipeline and Azure App Service for deploying to development/staging and production.