Auto generated pipelines should have access to test keyvaults

[deyaaeldeen]

Required keyvaults are supposed to be linked by default for live test when pipelines are auto generated by pipeline generator

[weshaggard]

@deyaaeldeen can you please give an example of which needed secrets are missing? We do try to hook up the secrets but maybe there is a new required one missing.

[deyaaeldeen]

@praveenkuttappan has context on this issue but basically an auto-generated pipeline is failing because it apparently doesn't have access to the AzureSDK-TestSecrets2 KV.

[weshaggard]

OK we should look at what variable group those secrets are in and determine if this is something we can easily fix. If it requires a custom set of secrets for a given pipeline this is not something we can fix generically.

[deyaaeldeen]

The secrets needed are listed in tests.yml: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/cognitivelanguage/ai-language-text/tests.yml

[weshaggard]

Those definitely look unique and specific to that one test pipeline so it will be difficult to automatically handle those cases. Just for context we aren't just giving permissions to a KV in the pipeline we are giving permission to a variable group which needs to explicitly list out the secrets that are needed for the pipeline so when there are pipelines with a custom set of secrets needed that will have to be configured manually. I will also add we generally try to avoid needing a custom set of secrets and instead try and generate tokens and such as part of the arm template which can then be controlled by our template provisioning scripts.

[benbp]

I'm going to mark this as a duplicate of #2572. @deyaaeldeen I am trying to deprecate all usages of hardcoded secret references in the yaml in favor of either arm/bicep templates as @weshaggard mentioned, or via a subscription configuration.

For the specific pipelines in question, I have added a variable group reference in the pipeline definition for Test Secrets for JS Live Tests (group number 70) which should get them working with the existing secret references.

[deyaaeldeen]

Thanks a lot @weshaggard and @benbp for the explanations and the help!