microsoft / teamcloud

Enable enterprise development teams to create secure compliant cloud development environments.

TeamCloud

TeamCloud is a tool that enables enterprise IT organizations to provide application development teams "self-serve" access to secure compliant cloud development environments.

There are several components that make up the TeamCloud solution.

TeamCloud CLI

The TeamCloud CLI is an extension for the Azure CLI. It can be used by application development teams to create and manage Projects, and by TeamCloud admins to create new TeamCloud instances or manage existing instances.

Install TeamCloud CLI

To install the Azure CLI TeamCloud extension, simply run the following command:

az extension add --source https://github.com/microsoft/TeamCloud/releases/latest/download/tc-0.5.3-py2.py3-none-any.whl -y

Update TeamCloud CLI

To update Azure CLI TeamCloud extension to the latest version:

az tc update

or for the latest pre-release version:

az tc update --pre

TeamCloud Instance

At the center of the tool is a TeamCloud instance (the source code in this repository). An enterprise deploys a single TeamCloud instance to an Azure subscription managed by its IT organization.

A TeamCloud instance is composed of two parts:

1. A web portal
2. A REST API that enables TeamCloud admins to manage the TeamCloud instance, and application development teams to create and manage Projects.
3. An internal orchestration service (sometimes referred to as "the orchestrator") that communicates handles deployment and management.

TeamCloud Azure Resources

A TeamCloud instance is made up of the following Azure resources:

• App Services
• Function Apps
• App Configuration
• Cosmos DB
• Storage Accounts
• Key Vault
• Application Insights

These resources are deployed using the CLI. After installing the CLI use az tc deploy -h deployment instructions.

TeamCloud Website

Although the TeamCloud CLI exposes all functionality provided by TeamCloud, you can also deploy a client website to interact with your instance.

Projects

A TeamCloud instance define templates (Project Types) for a policy-compliant, secure, cloud development environment, which software development teams can create on-demand. In the context of TeamCloud, these cloud development environments are called Projects.

About

This project is in active development and will change. As the tool becomes ready for use, it will be versioned and released.

We will do our best to conduct all development openly by documenting features and requirements, and managing the project using issues, milestones, and projects.

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

teamcloud's Issues

Add provider handshake command

TeamCloud User Delete Orchestration

Provider: Azure DevTest Labs

Projects API

ProjectsController

• List: GET api/projects
• Get: GET: api/projects/{projectId:guid}
• Create: POST: api/projects
• Update: PUT: api/projects
• Delete: DELETE: api/projects/{projectId:guid}

Project User Delete Orchestration

Todo item one

Multi-task issue:

• Task one
• Task two
• Task three
• Task four

TeamCloud User Create Orchestration

Custom Binding for Azure Functions to simplify implementing Providers

Create a custom binding for Azure Functions (distributed as a NuGet package) that will be used to simplify creating Providers (as Functions).

More details to follow...

Test Issue

Activity function to create a Resource Group for new Projects

TeamCloud Tags API

TeamCloudTagsController

• List: GET api/tags
• Get: GET: api/tags/{key}
• Create: POST: api/tags
• Update: PUT: api/tags
• Delete: DELETE: api/tags/{key}

Create (or use existing) validators/formatters for different types of azure resources

Project Delete Orchestration

ProjectDeleteOrchestration

TeamCloud Users API

TeamCloudUsersController

• List: GET api/users
• Get: GET: api/users/{userId:guid}
• Create: POST: api/users
• Update: PUT: api/users
• Delete: DELETE: api/users/{userId:guid}

Project Delete API and Orchestrations

Project Tags API

ProjectTagsController

• List: GET api/projects/{projectId:guid}/tags
• Get: GET: api/projects/{projectId:guid}/tags/{key}
• Create: POST: api/projects/{projectId:guid}/tags
• Update: PUT: api/projects{projectId:guid}/tags
• Delete: DELETE: api/projects/{projectId:guid}/tags/{key}

Remove hard-coded auth variables

EventGrid subscription setup

Disable Auth until an initial TeamCloud config yaml is posted

• We want to post the initial teamcloud.yaml file via the deploy script
• To do this via curl, auth should be disabled until an initial teamcloud.yaml is posted
• We should also validate that the initial config contains at least one user with role == owner

Auth throws null ref if project doesn't exist

ystem.NullReferenceException: Object reference not set to an instance of an object.
   at TeamCloud.API.Startup.ResolveClaimsAsync(Guid userId, HttpContext httpContext) in /Users/colbylwilliams/GitHub/microsoft/TeamCloud/src/TeamCloud.API/Startup.cs:line 232
   at TeamCloud.API.Startup.<ConfigureAuthentication>b__6_3(TokenValidatedContext context) in /Users/colbylwilliams/GitHub/microsoft/TeamCloud/src/TeamCloud.API/Startup.cs:line 165
   at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.HandleAuthenticateAsync()
   at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.HandleAuthenticateAsync()
   at Microsoft.AspNetCore.Authentication.AuthenticationHandler`1.AuthenticateAsync()
   at Microsoft.AspNetCore.Authentication.AuthenticationService.AuthenticateAsync(HttpContext context, String scheme)
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at TeamCloud.API.Middleware.EnsureTeamCloudConfigurationMiddleware.InvokeAsync(HttpContext context, RequestDelegate next) in /Users/colbylwilliams/GitHub/microsoft/TeamCloud/src/TeamCloud.API/Middleware/EnsureTeamCloudConfiguration.cs:line 41
   at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.<>c__DisplayClass5_1.<<UseMiddlewareInterface>b__1>d.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)

TeamCloud tags orchestrator commands

• OrchestratorTeamCloudTagCreateCommand
• OrchestratorTeamCloudTagDeleteCommand
• OrchestratorTeamCloudTagUpdateCommand

Project Update Orchestration

Todo item two

[cli] Unit tests

TeamCloud User Update Orchestration

Update the three (mock) Providers to call the correct orchestration (create, update, delete)

They currently just call create regardless of the actual command.

Variables -> Properties

Project Create Orchestration

ProjectCreateOrchestration

1. Create a new project and save to the database (via activity functions)
2. Create an Azure resource group for the project (and update project in db)
3. Invoke the Create command on each Provider (accounting for dependencies)
4. Wait for Create commands to complete, then invoke the Init Command on each Provider (accounting for dependencies)

Update deploy script to post initial teamcloud.yaml config

Project User Create Orchestration

Ensure that subscription has ownership permissions with the Service Principle

Create service principal for project

Provider: Azure DevOps

Errors

• Gracefully handle exceptions in providers and add them to command result
• Consolidate exceptions from providers

Validate the resource name prefix upon posting a new config

Fix config YAML Serialization

Validate Project Names are unique for new Projects

When the user tries to create a new project, check the DB for an existing project with that name, if there's already a project in the DB with that name, return an error.

Zip deploy API and Orchestrator to Azure

Update azuredeploy.json for API

TeamCloud Config API

TeamCloudController

• Get: GET: api/config
• Create: POST: api/config
• Update: PUT: api/config

Project Update API and Orchestrations

Project Definition overhaul

Create interface for invoking Providers and waiting on event callback (webhook)

Activity function to create an Identity (Service Principal) for new Projects

Project User Update Orchestration

Create mock provider to deploy and develop against

Project tags orchestrator commands

• OrchestratorProjectTagCreateCommand
• OrchestratorProjectTagDeleteCommand
• OrchestratorProjectTagUpdateCommand

Set up initial configuration post (and check for existing configuration)

Create interface for querying microsoft graph API to get user ID from email address

Project Users API

ProjectUsersController

• List: GET api/projects/{projectId:guid}/users
• Get: GET: api/projects/{projectId:guid}/users/{userId:guid}
• Create: POST: api/projects/{projectId:guid}/users
• Update: PUT: api/projects{projectId:guid}/users
• Delete: DELETE: api/projects/{projectId:guid}/users/{userId:guid}