Skip to content

Commit

Permalink
Revert m214 changes to keyvaulttaskV1/2 (#17503)
Browse files Browse the repository at this point in the history
* git checkout upstream/releases/m213 -- Tasks\AzureKeyVaultV1\*
git checkout upstream/releases/m213 -- Tasks\AzureKeyVaultV2\*

* update versions
  • Loading branch information
merlynomsft authored Dec 20, 2022
1 parent f67ce24 commit 9ae5034
Show file tree
Hide file tree
Showing 11 changed files with 246 additions and 1,149 deletions.
13 changes: 2 additions & 11 deletions Tasks/AzureKeyVaultV1/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ Ensure the Azure endpoint has at least Get and List permissions for Secrets on t

For example, if there is a secret name: connectionString, a task variable `$(connectionString)` is created with the latest fetched value of the respective secret from Azure key vault. And this secret variable would be available to be consumed in subsequent tasks.

Certificates are also fetched from the vault as secrets. In this case, the task variable would contain the content of the PFX in base64 string format. To convert the string into a PFX file from the task variable, the following sample PowerShell code can be used (after passing the certificate variable as a parameter to the script):
If it is a certificate (example: a PFX file) that is fetched from the vault, then the task variable would contain the content of the PFX in string format. To retrieve the PFX file from the task variable, the following sample PowerShell code can be used (after passing the certificate variable as a parameter to the script):

```powershell
# Task parameters: $(PfxSecret)
Expand All @@ -61,16 +61,7 @@ Certificates are also fetched from the vault as secrets. In this case, the task
$certCollection.Import($kvSecretBytes, $null, [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable)
```

Here's an example of how you can import the certificate into a local store:

```powershell
$CertStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("My","LocalMachine")
$CertStore.Open("ReadWrite")
$CertStore.AddRange($certCollection)
$CertStore.Close()
```

Alternatively, if the certificate file needs to be stored as a PFX file on the hard disk then it is good practice to encrypt it with a password:
If the certificate file needs to be stored on the hard disk then it is good practice to encrypt it with a password:

```powershell
# Get the file created
Expand Down
18 changes: 9 additions & 9 deletions Tasks/AzureKeyVaultV1/Tests/L0.ts
Original file line number Diff line number Diff line change
Expand Up @@ -31,11 +31,11 @@ describe('Azure Key Vault', function () {

assert(tr.stdout.indexOf("getSecretValue is called for secret4") < 0, "getSecretValue should not be called for secret4");

assert(tr.stdout.indexOf("##vso[task.setvariable variable=secret1;isOutput=false;issecret=true;]secret1-value") > 0, "##vso[task.setvariable variable=secret1;isOutput=false;issecret=true;]secret1-value");
assert(tr.stdout.indexOf("##vso[task.setvariable variable=secret2;isOutput=false;issecret=true;]secret2-value") > 0, "##vso[task.setvariable variable=secret2;isOutput=false;issecret=true;]secret2-value");
assert(tr.stdout.indexOf("##vso[task.setvariable variable=secret3;isOutput=false;issecret=true;]secret3-value") > 0, "##vso[task.setvariable variable=secret3;isOutput=false;issecret=true;]secret3-value");
assert(tr.stdout.indexOf("##vso[task.setvariable variable=secret1;issecret=true;]secret1-value") > 0, "##vso[task.setvariable variable=secret1;issecret=true;]secret1-value");
assert(tr.stdout.indexOf("##vso[task.setvariable variable=secret2;issecret=true;]secret2-value") > 0, "##vso[task.setvariable variable=secret2;issecret=true;]secret2-value");
assert(tr.stdout.indexOf("##vso[task.setvariable variable=secret3;issecret=true;]secret3-value") > 0, "##vso[task.setvariable variable=secret3;issecret=true;]secret3-value");

assert(tr.stdout.indexOf("##vso[task.setvariable variable=secret4;isOutput=false;issecret=true;]secret4-value") < 0, "secret4 value should not be set");
assert(tr.stdout.indexOf("##vso[task.setvariable variable=secret4;issecret=true;]secret4-value") < 0, "secret4 value should not be set");

done();
}
Expand All @@ -62,12 +62,12 @@ describe('Azure Key Vault', function () {
assert(tr.stdout.indexOf("getSecretValue is called for secret2") > 0, "getSecretValue is called for secret2");
assert(tr.stdout.indexOf("getSecretValue is called for secret3/versionIdentifierGuid") > 0, "getSecretValue is called for secret3/versionIdentifierGuid");

assert(tr.stdout.indexOf("##vso[task.setvariable variable=secret1;isOutput=false;issecret=true;]secret1-value") > 0, "##vso[task.setvariable variable=secret1;issecret=true;]secret1-value");
assert(tr.stdout.indexOf("##vso[task.setvariable variable=secret2;isOutput=false;issecret=true;]secret2-value") > 0, "##vso[task.setvariable variable=secret2;issecret=true;]secret2-value");
assert(tr.stdout.indexOf("##vso[task.setvariable variable=secret3;isOutput=false;issecret=true;]secret3/versionIdentifierGuid-value") > 0, "##vso[task.setvariable variable=secret3;issecret=true;]secret3/versionIdentifierGuid-value");
assert(tr.stdout.indexOf("##vso[task.setvariable variable=secret3/versionIdentifierGuid;isOutput=false;issecret=true;]secret3/versionIdentifierGuid-value") > 0, "##vso[task.setvariable variable=secret3/versionIdentifierGuid;issecret=true;]secret3/versionIdentifierGuid-value");
assert(tr.stdout.indexOf("##vso[task.setvariable variable=secret1;issecret=true;]secret1-value") > 0, "##vso[task.setvariable variable=secret1;issecret=true;]secret1-value");
assert(tr.stdout.indexOf("##vso[task.setvariable variable=secret2;issecret=true;]secret2-value") > 0, "##vso[task.setvariable variable=secret2;issecret=true;]secret2-value");
assert(tr.stdout.indexOf("##vso[task.setvariable variable=secret3;issecret=true;]secret3/versionIdentifierGuid-value") > 0, "##vso[task.setvariable variable=secret3;issecret=true;]secret3/versionIdentifierGuid-value");
assert(tr.stdout.indexOf("##vso[task.setvariable variable=secret3/versionIdentifierGuid;issecret=true;]secret3/versionIdentifierGuid-value") > 0, "##vso[task.setvariable variable=secret3/versionIdentifierGuid;issecret=true;]secret3/versionIdentifierGuid-value");

assert(tr.stdout.indexOf("##vso[task.setvariable variable=secret4;isOutput=false;issecret=true;]secret4-value") < 0, "secret4 value should not be set");
assert(tr.stdout.indexOf("##vso[task.setvariable variable=secret4;issecret=true;]secret4-value") < 0, "secret4 value should not be set");

done();
}
Expand Down
Loading

0 comments on commit 9ae5034

Please sign in to comment.