Updated messages and correcteed repository URL information.
This commit is contained in:
@@ -1,6 +1,6 @@
|
|||||||
# Azure DevOps Azure Federated Auth Task
|
# Azure DevOps Azure Federated Auth Task
|
||||||
|
|
||||||
Private Azure DevOps extension with a single task: `AzureFederatedAuth@1`.
|
Azure DevOps extension with a single task: `AzureFederatedAuth@1`.
|
||||||
|
|
||||||
The task requests an OIDC token for a selected AzureRM service connection and exports:
|
The task requests an OIDC token for a selected AzureRM service connection and exports:
|
||||||
|
|
||||||
@@ -14,7 +14,7 @@ The task requests an OIDC token for a selected AzureRM service connection and ex
|
|||||||
- Linux agents (YAML pipelines)
|
- Linux agents (YAML pipelines)
|
||||||
- Job setting that exposes OAuth token (`System.AccessToken`)
|
- Job setting that exposes OAuth token (`System.AccessToken`)
|
||||||
- AzureRM service connection with workload identity federation
|
- AzureRM service connection with workload identity federation
|
||||||
- Visual Studio Marketplace publisher account (required to publish/share this extension, even for private org-only usage)
|
- Visual Studio Marketplace publisher account (required to publish/share this extension, including org-only usage)
|
||||||
|
|
||||||
## Build
|
## Build
|
||||||
|
|
||||||
|
|||||||
36
overview.md
Normal file
36
overview.md
Normal file
@@ -0,0 +1,36 @@
|
|||||||
|
# Azure Federated Auth Task
|
||||||
|
|
||||||
|
`AzureFederatedAuth@1` is an Azure Pipelines task that requests an OIDC token for an AzureRM service connection configured for workload identity federation.
|
||||||
|
|
||||||
|
It is designed for pipelines that need ARM federation variables without storing long-lived secrets.
|
||||||
|
|
||||||
|
## What It Sets
|
||||||
|
|
||||||
|
- `ARM_OIDC_TOKEN` (secret)
|
||||||
|
- `ARM_TENANT_ID`
|
||||||
|
- `ARM_CLIENT_ID`
|
||||||
|
- `GIT_ACCESS_TOKEN` (secret, optional)
|
||||||
|
|
||||||
|
## Task Input
|
||||||
|
|
||||||
|
- `serviceConnectionARM` (required): Azure Resource Manager service connection
|
||||||
|
- `setGitAccessToken` (optional): exchanges OIDC assertion for Azure DevOps scope and sets `GIT_ACCESS_TOKEN`
|
||||||
|
|
||||||
|
## Prerequisites
|
||||||
|
|
||||||
|
- AzureRM service connection using workload identity federation
|
||||||
|
- Pipeline access to `System.AccessToken`
|
||||||
|
- Linux YAML agents
|
||||||
|
|
||||||
|
## Example
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
- task: AzureFederatedAuth@1
|
||||||
|
inputs:
|
||||||
|
serviceConnectionARM: 'my-arm-service-connection'
|
||||||
|
setGitAccessToken: true
|
||||||
|
```
|
||||||
|
|
||||||
|
## Repository
|
||||||
|
|
||||||
|
https://gitea.koszewscy.waw.pl/koszewscy/ado-azurefederatedauth-task.git
|
||||||
@@ -2,7 +2,7 @@
|
|||||||
"name": "azure-federated-auth-task",
|
"name": "azure-federated-auth-task",
|
||||||
"version": "1.0.0",
|
"version": "1.0.0",
|
||||||
"private": true,
|
"private": true,
|
||||||
"description": "Azure DevOps private task to fetch OIDC token for AzureRM service connection.",
|
"description": "Azure DevOps task to fetch OIDC token for AzureRM service connection.",
|
||||||
"main": "dist/index.js",
|
"main": "dist/index.js",
|
||||||
"scripts": {
|
"scripts": {
|
||||||
"build": "tsc -p tsconfig.json",
|
"build": "tsc -p tsconfig.json",
|
||||||
|
|||||||
@@ -3,16 +3,16 @@
|
|||||||
"id": "11c532b8-f2bd-45f8-ac94-3b7e44608cc4",
|
"id": "11c532b8-f2bd-45f8-ac94-3b7e44608cc4",
|
||||||
"name": "AzureFederatedAuth",
|
"name": "AzureFederatedAuth",
|
||||||
"friendlyName": "Azure Federated Auth",
|
"friendlyName": "Azure Federated Auth",
|
||||||
"description": "Requests an OIDC token for an AzureRM service connection and exports ARM_OIDC_TOKEN, ARM_TENANT_ID, ARM_CLIENT_ID, and optionally GIT_ACCESS_TOKEN for Azure DevOps Git HTTPS auth.",
|
"description": "Gets OIDC token and sets ARM vars (optionally GIT_ACCESS_TOKEN).",
|
||||||
"helpMarkDown": "Private task for YAML pipelines on Linux agents.",
|
"helpMarkDown": "For details, see: https://gitea.koszewscy.waw.pl/koszewscy/ado-azurefederatedauth-task.git",
|
||||||
"category": "Deploy",
|
"category": "Deploy",
|
||||||
"author": "private",
|
"author": "skoszewski-lab",
|
||||||
"version": {
|
"version": {
|
||||||
"Major": 1,
|
"Major": 1,
|
||||||
"Minor": 0,
|
"Minor": 0,
|
||||||
"Patch": 0
|
"Patch": 3
|
||||||
},
|
},
|
||||||
"instanceNameFormat": "Configure Azure federated auth for $(serviceConnectionARM)",
|
"instanceNameFormat": "Configure federated auth: $(serviceConnectionARM)",
|
||||||
"inputs": [
|
"inputs": [
|
||||||
{
|
{
|
||||||
"name": "serviceConnectionARM",
|
"name": "serviceConnectionARM",
|
||||||
@@ -25,10 +25,10 @@
|
|||||||
{
|
{
|
||||||
"name": "setGitAccessToken",
|
"name": "setGitAccessToken",
|
||||||
"type": "boolean",
|
"type": "boolean",
|
||||||
"label": "Also set GIT_ACCESS_TOKEN for Azure DevOps Git HTTPS auth",
|
"label": "Set GIT_ACCESS_TOKEN for Azure DevOps Git",
|
||||||
"defaultValue": "false",
|
"defaultValue": "false",
|
||||||
"required": false,
|
"required": false,
|
||||||
"helpMarkDown": "When enabled, exchanges the OIDC token for an Entra access token scoped to Azure DevOps (499b84ac-1321-427f-aa17-267ca6975798/.default) and sets secret variable GIT_ACCESS_TOKEN."
|
"helpMarkDown": "Exchange OIDC for Azure DevOps scope and set secret GIT_ACCESS_TOKEN."
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"execution": {
|
"execution": {
|
||||||
|
|||||||
@@ -2,14 +2,19 @@
|
|||||||
"manifestVersion": 1,
|
"manifestVersion": 1,
|
||||||
"id": "azuredevops-get-oidc-token-task",
|
"id": "azuredevops-get-oidc-token-task",
|
||||||
"name": "Azure DevOps AzureFederatedAuth Task",
|
"name": "Azure DevOps AzureFederatedAuth Task",
|
||||||
"version": "1.0.0",
|
"version": "1.0.3",
|
||||||
"publisher": "skoszewski-lab",
|
"publisher": "skoszewski-lab",
|
||||||
"targets": [
|
"targets": [
|
||||||
{
|
{
|
||||||
"id": "Microsoft.VisualStudio.Services"
|
"id": "Microsoft.VisualStudio.Services"
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"description": "Private Azure DevOps task to request an OIDC token for an AzureRM service connection and expose Terraform ARM variables.",
|
"description": "Azure DevOps task to request an OIDC token for an AzureRM service connection and expose Terraform ARM variables.",
|
||||||
|
"content": {
|
||||||
|
"details": {
|
||||||
|
"path": "overview.md"
|
||||||
|
}
|
||||||
|
},
|
||||||
"categories": [
|
"categories": [
|
||||||
"Azure Pipelines"
|
"Azure Pipelines"
|
||||||
],
|
],
|
||||||
@@ -24,6 +29,10 @@
|
|||||||
{
|
{
|
||||||
"path": "images",
|
"path": "images",
|
||||||
"addressable": true
|
"addressable": true
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"path": "overview.md",
|
||||||
|
"addressable": true
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"contributions": [
|
"contributions": [
|
||||||
|
|||||||
Reference in New Issue
Block a user