如何在 azure 管道中实现等效的 az login

Question

I have an integration test that needs to access the cosmosdb in azure cloud. Locally I need to login to the azure and then run the test

az login 
poetry run pytest test/integration 

My question is how can I implement the equivalent of az login in the azure DevOps pipeline? Isn't the Azure DevOps Server is already connected to the Azure cloud naturally?

Answer 1

The recommended way to access resources in Azure is to create an Azure Resource Manager -type service connection from Project Settings -> Service Connections -> New Service Connection -> Azure Resource Manager -> Service Principal (automatic). Creating a service connection requires you to have sufficient rights to the target Azure Subscription.

A service connection is essentially a service principal that then needs to be authorized to access the resources needed. In this case, you'd have to grant this service principal the (absolutely minimal) access it needs in order to perform the tests.

I'm not an expert on Cosmos DB, but I do know that it supports multiple ways of securely accessing the data, so you might want to explore options like logging in with access keys as well. You can run Az Cli commands in pipeline with the Azure Cli task like this:

- task: AzureCLI@2
  displayName: Azure CLI
  inputs:
    azureSubscription: '$(azureSubscriptionName)'
    scriptType: pscore
    scriptLocation: inlineScript
    inlineScript: |          
      az command parameters

With the service connection name in $(azureSubscriptionName) and actual command (s) with inlineScript (or reference a physical script if that's more suitable). Just remember that you are operating in Azure via the service connection/principal, so you need to grant that sufficient rights to do what needs to be done.

There are multiple ways to do this, so a bit of exploration is required. Also, there seems to be something called Cosmod DB emulator and you might want to check that out first - when running unit/integration tests, the best practice would be not having to access an actual resource at all.

(If you are actually running tests on Azure DevOps Server, and not Azure DevOps Service, there might be some additional obstacles I'm not aware of - haven't used the on-premises version in a while)

https://docs.microsoft.com/en-us/azure/devops/pipelines/library/connect-to-azure?view=azure-devops https://docs.microsoft.com/en-us/azure/cosmos-db/secure-access-to-data?tabs=using-primary-key https://docs.microsoft.com/en-us/azure/cosmos-db/role-based-access-control https://docs.microsoft.com/en-us/azure/cosmos-db/tutorial-setup-ci-cd https://docs.microsoft.com/en-us/azure/devops/pipelines/tasks/deploy/azure-cli?view=azure-devops