microsoft / teamcloud-providers

Providers for TeamCloud.

TeamCloud Providers

TeamCloud is a tool that enables enterprise IT organizations to provide application development teams "self-serve" access to secure compliant cloud development environments.

This repository contains TeamCloud Providers. In the context of TeamCloud, a Provider represents an abstract implementation of a service that manages a resource or resources (i.e. a GitHub repository or an Azure resource) for a cloud development environment (or "Project").

An organization creates and deploys its own Providers or deploys Providers from this repo to Azure. It then registers the Providers with its TeamCloud instance. When a development team sends a request to TeamCloud to create a new (or update an existing) Project, TeamCloud invokes each registered Provider to create, update, or delete it's corresponding resource(s).

About

TeamCloud and the Providers in this repository are in active development and will change. As the these Providers become ready for use, they will be versioned and released.

We will do our best to conduct all development openly by documenting features and requirements, and managing the project using issues, milestones, and projects.

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

teamcloud-providers's Issues

Document teamcloud-actions/setup action

Rename Providers.GitHub to Providers.GitHub.Repos

[Azure/DevOps] Zip deployment to Azure

Register an offer to create generic repo for a project

Add support for generic repo components

Workflows are referencing vulnerable actions

Hello, there!

As part of the university research we are currently doing regarding the security of Github Actions, we noticed that one or many of the workflows that are part of this repository are referencing vulnerable versions of the third-party actions. As part of a disclosure process, we decided to open issues to notify GitHub Community.

Please note that there are could be some false positives in our methodology, thus not all of the open issues could be valid. If that is the case, please let us know, so that we can improve on our approach. You can contact me directly using an email: ikoishy [at] ncsu.edu

Thanks in advance

1. The workflow build-runners.yml is referencing action gittools/actions/gitversion/setup using references v0.9.9. However this reference is missing the commit 90150b4 which may contain fix to the vulnerability.
2. The workflow build-runners.yml is referencing action gittools/actions/gitversion/execute using references v0.9.9. However this reference is missing the commit 90150b4 which may contain fix to the vulnerability.

The vulnerability fix that is missing by actions' versions could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider updating the reference to the action.

If you end up updating the reference, please let us know. We need the stats for the paper :-)

[Azure/DevTestLabs] Command implementation

• ProviderProjectCreateCommand
• ProviderProjectDeleteCommand
• ProviderProjectUpdateCommand
• ProviderRegisterCommand

Make KeyVault names more unique in arm templates

Currently, in the provider ARM templates the KeyVaultName is generated using:
"keyVaultName": "[concat('kv', uniqueString(resourceGroup().id))]",. When a resource group containing a KeyVault is deleted, the KeyVault is "soft deleted". Because we default the Resource Group name to the Provider name (i.e. TeamCloud.Providers.GitHub), when you delete the resource group, then try to redeploy the provider, it errors out in conflict because the KeyVault already exist (just soft deleted). So... we need to add more "uniqueness" to the KeyVault name.

Implement new GitHub actions/workflow provider

Pending success of issue #30

[GitHub] Implement commands

• ProviderProjectCreateCommand
• ProviderProjectDeleteCommand
• ProviderProjectUpdateCommand
• ProviderRegisterCommand

Create NuGet package for TeamCloud.Providers.Core

• Configure the TeamCloud.Providers.Core project to create .nupkg and .symbols.nupkg files on build (I tried briefly to get this to work, but moved on)
• Uncomment code in pre_release.yml workflow file to publish packages to MyGet (dev) feeds and release assets
• Uncomment code in ci_package.yml workflow file to publish packages to MyGet (dev) feeds
• Uncomment code in promote_release.yml workflow file to pull packages from release assets and publish packages in MyGet (and later NuGet) feeds

Actions for build automation

• Package and deploy TeamCloud.Providers.Core
• Build and test Azure Providers
• Create publish zips for releases
• Split ci builds and release build

Update index.json for GitHub.Repos and GitHub.Actions

Register links

• Project
• Team
• Repository

Prototype new GitHub actions/workflow provider

[Azure/AppInsights] Command implementation

• ProviderProjectCreateCommand
• ProviderProjectDeleteCommand
• ProviderProjectUpdateCommand
• ProviderRegisterCommand

Add shared Providers.GitHub project between GitHub.Actions and GitHub.Repos

Fix User.Id Guid -> String issues in Providers.Core and Azure.Resources

The change from Guid Ids to String Ids broke some role assignment code in
TeamCloud.Providers.Core.TeamCloudProvidersCoreExtensions and TeamCloud.Azure.Resources, and possibly other places too.

Azure providers shouldn't depend on a configuration service

Attempting to zip deploy (via CLI) Azure.AppInsights provider to Azure succeeds, however the function runtime fails to start the functions because the function is looking for a connection string to a configuration service (likely in Startup.cs somewhere?).

Add support for service providers to handle the same command more than one time (virtual)

[azure.devtestlabs] Provider removes lab identity permissions (reader) on lab resource during sync

Describe the bug
Permissions granted to the labs managed identity are removed during sync, as the responsible activity doesn't respect the managed identity as user.

To Reproduce
n.a.

Expected behavior
The labs managed identity keeps its role assignment during user sync.

Additional context
Add any other context about the problem here.

Test Issue One

Add support for template repo components

Move GitHub action to new TeamCloud-Actions repo

Register offers for each template repo in the associated github organization

Create a GitHub Action for the GitHub.Actions provider

[azure.devops] Provider register command failes

Describe the bug
The azure.devops provider can't be registered when the provider is returning an identity.

To Reproduce
Use the usual register provider workflow

Expected behavior
Provider is registered and the returned result contains the provider identity

Additional context
n/a

Create GitHub (enterprise?) provider

Add provider type to each provider to index.json

[azure.appinsights] User sync fails when processing a ProjectCreateCommand

Describe the bug
ProjectUsersActivity failed: Project user role 'None' is not supported.

To Reproduce
Create a new project and check the provider trace

Expected behavior
Project user role 'None' is skipped during the user sync.

Additional context
n/a

Change in Azure DevTestLab API breaks DTL deployment

Describe the bug
DTL changed the way to assign a MSI for environment deployments.

{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.","details":[{"code":"BadRequest","message":"{\r\n \"error\": {\r\n \"code\": \"ServiceRunnerIsDeprecatedEnvironment\",\r\n \"message\": \"Service runner with IdentityUsageType of 'Environment' is deprecated. Use lab.Identity.UserAssignedIdentities instead.\"\r\n }\r\n}"}]}

To Reproduce
Steps to reproduce the behavior: Run a project deployment with DTL provider involved

Expected behavior
No error

Additional context
Add any other context about the problem here.

Command implementation

• ProviderProjectCreateCommand
• ProviderProjectDeleteCommand
• ProviderProjectUpdateCommand
• ProviderRegisterCommand

Return completed command result with warning if command type is ignored

[GitHub] Implement extended commands

• ProviderProjectUserCreateCommand
• ProviderProjectUserDeleteCommand
• ProviderProjectUserUpdateCommand
• ProviderTeamCloudUserCreateCommand
• ProviderTeamCloudUserDeleteCommand
• ProviderTeamCloudUserUpdateCommand

Add support for declaring required query parameters in provider startup

[Azure/AppInsights] Zip deployment to Azure

[Azure/DevTestLabs] Zip deployment to Azure

Implement support for EventGrid subscriptions

Use the DevTest Lab provider as a sample, as this provider will need this feature fist.

Create helper/extension methods to send authenticated (using managed identity) to urls in ProviderApis in Providers.Core