Skip to content

Microsoft.Authorization: Publish templates on different scopes - #1033

Merged
Alexander Sehr (AlexanderSehr) merged 49 commits into
mainfrom
users/alsehr/rbac
Mar 1, 2022
Merged

Alexander Sehr (AlexanderSehr) merged 49 commits into
mainfrom
users/alsehr/rbac

Conversation

@AlexanderSehr

@AlexanderSehr Alexander Sehr (AlexanderSehr) commented Feb 22, 2022 •

Copy link
Copy Markdown
Contributor

Change

Features

  • Change model for nested files to be treated as child modules to align with other modules for publishing. This is a breaking change for the MS authorisation namespace
  • Updates on parameters metadata and add limits where they apply.
  • Testing now across all different scope types for each module where applicable.
  • added cuaID support for resource group scope deployments and outputs for resource group name to align with pester tests requirements.
  • added guidance and examples for using the modules across different scopes
  • Modules (root and children) are now publishable to template specs and bicep registry
  • Workflows for this namespace now point to the root deploy instead of the subscription child as the SP now supports management group deployments

Other changes

  • dependency pipeline additional policy assignment at management group scope.

known issues:

GitHub workflows [setting remove modules to false]

Authorization: RoleAssignments

Authorization: RoleDefinitions

Authorization: PolicyDefinitions

Authorization: PolicySetDefinitions

Authorization: PolicyAssignments

Authorization: PolicyExemptions

Screenshots

image

image

Type of Change

Please delete options that are not relevant.

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update (Wiki)

@github-actions

github-actions Bot commented Feb 22, 2022 •

Copy link
Copy Markdown

Unit Test Results

    1 files  ±    0  1 suites  ±0   49s ⏱️ - 3m 3s
    4 tests  -   31  4 ✔️  - 31      0 💤 ±    0  0 ❌ ±0 
134 runs   - 368  4 ✔️  - 31  130 💤  - 337  0 ❌ ±0 

Results for commit bf8879f. ± Comparison against base commit 3bd8c62.

This pull request removes 35 and adds 4 tests. Note that renamed tests count towards both.
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ API version tests [All apiVersions in the template should be 'recent'].In [Microsoft.ApiManagement/service/apiVersionSets] used resource type [service/apiVersionSets] should use on of the recent API version(s). Currently using [2021-08-01]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ API version tests [All apiVersions in the template should be 'recent'].In [Microsoft.ApiManagement/service/apis/policies] used resource type [service/apis/policies] should use on of the recent API version(s). Currently using [2021-08-01]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ API version tests [All apiVersions in the template should be 'recent'].In [Microsoft.ApiManagement/service/apis] used resource type [service/apis/policies] should use on of the recent API version(s). Currently using [2021-08-01]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ API version tests [All apiVersions in the template should be 'recent'].In [Microsoft.ApiManagement/service/apis] used resource type [service/apis] should use on of the recent API version(s). Currently using [2021-08-01]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ API version tests [All apiVersions in the template should be 'recent'].In [Microsoft.ApiManagement/service/authorizationServers] used resource type [service/authorizationServers] should use on of the recent API version(s). Currently using [2021-08-01]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ API version tests [All apiVersions in the template should be 'recent'].In [Microsoft.ApiManagement/service/backends] used resource type [service/backends] should use on of the recent API version(s). Currently using [2021-08-01]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ API version tests [All apiVersions in the template should be 'recent'].In [Microsoft.ApiManagement/service/caches] used resource type [service/caches] should use on of the recent API version(s). Currently using [2021-08-01]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ API version tests [All apiVersions in the template should be 'recent'].In [Microsoft.ApiManagement/service/identityProviders] used resource type [service/identityProviders] should use on of the recent API version(s). Currently using [2021-08-01]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ API version tests [All apiVersions in the template should be 'recent'].In [Microsoft.ApiManagement/service/namedValues] used resource type [service/namedValues] should use on of the recent API version(s). Currently using [2021-08-01]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ API version tests [All apiVersions in the template should be 'recent'].In [Microsoft.ApiManagement/service/policies] used resource type [service/policies] should use on of the recent API version(s). Currently using [2021-08-01]
…
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ API version tests [All apiVersions in the template should be 'recent'].In [Microsoft.Authorization/roleDefinitions/managementGroup] used resource type [roleDefinitions] should use on of the recent API version(s). Currently using [2018-01-01-preview]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ API version tests [All apiVersions in the template should be 'recent'].In [Microsoft.Authorization/roleDefinitions/resourceGroup] used resource type [roleDefinitions] should use on of the recent API version(s). Currently using [2018-01-01-preview]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ API version tests [All apiVersions in the template should be 'recent'].In [Microsoft.Authorization/roleDefinitions/subscription] used resource type [roleDefinitions] should use on of the recent API version(s). Currently using [2018-01-01-preview]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ API version tests [All apiVersions in the template should be 'recent'].In [Microsoft.Authorization/roleDefinitions] used resource type [roleDefinitions] should use on of the recent API version(s). Currently using [2018-01-01-preview]

♻️ This comment has been updated with latest results.

@ahmadabdalla
Ahmad Abdalla (ahmadabdalla) marked this pull request as draft February 23, 2022 23:31
Co-authored-by: Marius Storhaug <Marius.Storhaug@microsoft.com>
…ultiPrincipals/.bicep/nested_rbac.bicep

Co-authored-by: Marius Storhaug <Marius.Storhaug@microsoft.com>
Co-authored-by: Marius Storhaug <Marius.Storhaug@microsoft.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

blocked if an issue is blocked [cat] azure devops category: Azure DevOps [cat] modules category: modules [cat] pipelines category: pipelines [cat] publishing category: publishing enhancement New feature or request

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

Microsoft.Authorization Namespace: Should publish templates for different scopes Conversion Script's handling of special cases

3 participants