ADD support for PodIdentityProvider config in azure pipeline trigger #4867

toniiiik · 2023-08-08T12:11:33Z

Support of PodIdentityProvider for azure pipelines scaler.

Checklist

(https://github.com/kedacore/governance/blob/main/SCALERS.md)

I have verified that my change is according to the deprecations & breaking changes policy
Tests have been added
Changelog has been updated and is aligned with our changelog requirements
A PR is opened to update the documentation on (repo) (if applicable)
Commits are signed with Developer Certificate of Origin (DCO - learn more)

Fixes #

Relates to #

doc #1206

github-actions · 2023-08-08T12:11:46Z

Thank you for your contribution! 🙏 We will review your PR as soon as possible.

🏖️ Over the summer, the response time will be longer than usual due to maintainers taking time off so please bear with us.

While you are waiting, make sure to:

Add an entry in our changelog in alphabetical order and link related issue
Update the documentation, if needed
Add unit & e2e tests for your changes
GitHub checks are passing
Is the DCO check failing? Here is how you can fix DCO issues

Learn more about:

Our contribution guide

pkg/scalers/azure_pipelines_scaler.go

JorTurFer · 2023-08-24T18:36:15Z

Hi @toniiiik,
Thanks for this awesome feature! ❤️
We are adding all the required stuff in background for the e2e tests because our DevOps organization is currently attached to other tenant different from the infrastructure tenant. I hope to fix this soon but I wanted to share it with you

toniiiik · 2023-09-01T09:52:30Z

Hi @toniiiik,
Thanks for this awesome feature! ❤️
We are adding all the required stuff in background for the e2e tests because our DevOps organization is currently attached to other tenant different from the infrastructure tenant. I hope to fix this soon but I wanted to share it with you

Hi @JorTurFer thank you sharing this info. Do you have some estimation when it will be ready?

JorTurFer · 2023-10-18T11:08:39Z

I plan to prepare all the pending stuff this week, sorry for the terrible huge delay, we have had faced with some blockers in the process but I think that we are ready to it

luck2bhanu · 2023-11-01T09:41:38Z

Hi
Just to be sure this feature enables us to workload identity or pod identity because pod identity is not supported anymore

toniiiik · 2023-11-01T15:01:25Z

Hi Just to be sure this feature enables us to workload identity or pod identity because pod identity is not supported anymore

hi @luck2bhanu, yes azure-workload is only one supprted pod identity provider. Please see linked doc PR.

JonasCordsen · 2023-11-03T07:20:12Z

This is a very nice feature, is there any ETA?

JorTurFer · 2023-11-03T07:32:15Z

Kindly reminder @tomkerkhove : Have you linked the AAD with AzDO?

tomkerkhove · 2023-11-03T13:05:38Z

No, would you mind dropping me an email please?

norbinto · 2023-11-07T08:17:56Z

It would be an awesome feature for the next release

JorTurFer · 2023-11-21T21:03:26Z

No, would you mind dropping me an email please?

I'll send you an email

zroubalik

@tomkerkhove @JorTurFer do you have any update here please?

ezYakaEagle442 · 2023-12-27T09:33:26Z

@tomkerkhove Hi !
Could you please share an ETA for this PR ?

tomkerkhove · 2024-01-02T09:12:48Z

We're working on it, had to set up new ADO org and project which is in place now and @JorTurFer is actively working on the rest of it

JorTurFer · 2024-01-02T22:16:52Z

I'm facing some issues adding the identity to the AzDO directly, I'll try using an AAD group tomorrow

JorTurFer · 2024-01-02T23:47:05Z

/run-e2e azure_pipelines_aad_wi
Update: You can check the progress here

JorTurFer · 2024-01-03T00:11:08Z

It seems that the token isn't working properly:

2024-01-03T00:07:40Z	ERROR	scale_handler	error resolving auth params	{"type": "ScaledObject", "namespace": "azure-pipelines-test-ns", "name": "azure-pipelines-test-so", "scalerIndex": 0, "error": "error parsing azure Pipelines metadata: agent pool with id `11` not found: the Azure DevOps REST API returned error. urlString: https://dev.azure.com/kedaoss/_apis/distributedtask/pools?poolID=11 status: 401 response: {\"$id\":\"1\",\"innerException\":null,\"message\":\"TF401444: Please sign-in at least once as e0372f7f-a362-47fb-9631-74a5c4ba8bbf\\\\e0372f7f-a362-47fb-9631-74a5c4ba8bbf\\\\48a9fa1b-211e-436f-ae08-0c9651555054 in a web browser to enable access to the service.\",\"typeName\":\"Microsoft.TeamFoundation.Framework.Server.UnauthorizedRequestException, Microsoft.TeamFoundation.Framework.Server\",\"typeKey\":\"UnauthorizedRequestException\",\"errorCode\":0,\"eventId\":3000}"}
github.com/kedacore/keda/v2/pkg/scaling.(*scaleHandler).buildScalers
	/workspace/pkg/scaling/scalers_builder.go:83
github.com/kedacore/keda/v2/pkg/scaling.(*scaleHandler).performGetScalersCache
	/workspace/pkg/scaling/scale_handler.go:355
github.com/kedacore/keda/v2/pkg/scaling.(*scaleHandler).GetScalersCache
	/workspace/pkg/scaling/scale_handler.go:280
github.com/kedacore/keda/v2/controllers/keda.(*ScaledObjectReconciler).getScaledObjectMetricSpecs
	/workspace/controllers/keda/hpa.go:211
github.com/kedacore/keda/v2/controllers/keda.(*ScaledObjectReconciler).newHPAForScaledObject
	/workspace/controllers/keda/hpa.go:77
github.com/kedacore/keda/v2/controllers/keda.(*ScaledObjectReconciler).createAndDeployNewHPA
	/workspace/controllers/keda/hpa.go:50
github.com/kedacore/keda/v2/controllers/keda.(*ScaledObjectReconciler).ensureHPAForScaledObjectExists
	/workspace/controllers/keda/scaledobject_controller.go:442
github.com/kedacore/keda/v2/controllers/keda.(*ScaledObjectReconciler).reconcileScaledObject
	/workspace/controllers/keda/scaledobject_controller.go:271
github.com/kedacore/keda/v2/controllers/keda.(*ScaledObjectReconciler).Reconcile
	/workspace/controllers/keda/scaledobject_controller.go:182
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
	/workspace/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:119
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
	/workspace/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:316
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
	/workspace/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
	/workspace/vendor/sigs.k8s.io/controller-runtime/pkg/internal/controller/controller.go:227

pkg/scalers/azure_pipelines_scaler.go

JorTurFer · 2024-01-03T11:53:43Z

In theory, the managed identity is admin of the project (it's memeber of Project Collection Administrators)

tests/scalers/azure/azure_pipelines_aad_wi/azure_pipelines_aad_wi_test.go

JorTurFer

Accept the suggestions please, they update the info to use new resources

tests/scalers/azure/azure_pipelines_aad_wi/azure_pipelines_aad_wi_test.go

JorTurFer · 2024-01-03T12:14:57Z

/run-e2e azure_pipelines_aad_wi
Update: You can check the progress here

pkg/scalers/azure_pipelines_scaler.go

toniiiik · 2024-01-09T22:49:18Z

/run-e2e azure_pipelines_aad_wi Update: You can check the progress here

it looks like tests are failing.

I faced same issue when managed identity had no permission to the pool on organisation scope. In fact that requests to obtain ID from name is

 https://dev.azure.com/{organization}/_apis/distributedtask/pools?poolName={poolName}

and there is no project name included in url. When I compared agent pool permissions on organisation level and project level the permissions were different. After configuring permissions for managed identity on organisation level e2e tests worked without error.
I am not sure if this is same case. If there is something I should update in tests let me know..... I still need to fix DCO

JorTurFer · 2024-01-11T17:52:25Z

I've explicitly set the group where the MSI is as pool admin, lets see if it works 🤞

JorTurFer · 2024-01-11T17:52:45Z

/run-e2e azure_pipelines_aad_wi

Update: You can check the progress here

JorTurFer · 2024-01-11T20:06:51Z

/run-e2e azure_pipelines_aad_wi
Update: You can check the progress here

JorTurFer · 2024-01-11T21:54:39Z

What permissions does the msi need? Could you guide me to assign it?

toniiiik · 2024-01-12T08:53:37Z

What permissions does the msi need? Could you guide me to assign it?

hmm it looks good I've assign same admin permission for agentpool. I've send you invitation to my ADO org you can check config here https://dev.azure.com/wedocloudsolutions/_settings/agentpools?poolId=12&view=security. There is also tf for AKS deployment https://dev.azure.com/wedocloudsolutions/_git/Keda

JorTurFer · 2024-01-12T09:26:17Z

I'v not received any invitation :(
nvm, we can talk about this by Slack (probably it'll be faster). I'm available Kubernetes and CNCF Slack as Jorge Turrado, are you there?

JorTurFer · 2024-01-12T12:49:39Z

/run-e2e azure_pipelines_aad_wi
Update: You can check the progress here

JorTurFer · 2024-01-12T13:23:16Z

It has passed! 🥳
Could you fix DCO?

Signed-off-by: anton.lysina <[email protected]>

zroubalik · 2024-01-15T17:00:58Z

/run-e2e azure_pipelines_aad_wi
Update: You can check the progress here

CHANGELOG.md

pkg/scalers/azure_pipelines_scaler.go

Co-authored-by: Zbynek Roubalik <[email protected]> Signed-off-by: toniiiik <[email protected]>

Signed-off-by: anton.lysina <[email protected]>

JorTurFer · 2024-01-15T20:15:42Z

/run-e2e azure_pipelines_aad_wi
Update: You can check the progress here

JorTurFer

Have we lost the token refreshing process? Checking the PR it seems that we don't cache the token anymore and it was a nice feature because otherwise we will request 4-6 tokens per minute

pkg/scalers/azure_pipelines_scaler.go

CHANGELOG.md

Co-authored-by: Zbynek Roubalik <[email protected]> Signed-off-by: toniiiik <[email protected]>

Signed-off-by: anton.lysina <[email protected]>

toniiiik · 2024-01-15T22:52:23Z

Have we lost the token refreshing process? Checking the PR it seems that we don't cache the token anymore and it was a nice feature because otherwise we will request 4-6 tokens per minute

token cache added. Last time I implemented cache for credentials but not for token (at this moment we lost "token refreshing"). Now both credentials and token are reused.

JorTurFer

LGTM!

JorTurFer · 2024-01-16T07:16:17Z

/run-e2e azure_pipelines_aad_wi
Update: You can check the progress here

semgrep-app bot reviewed Aug 8, 2023

View reviewed changes

pkg/scalers/azure_pipelines_scaler.go Outdated Show resolved Hide resolved

toniiiik changed the title ~~Support PodIdentity Provider config in azure pipeline trigger~~ ADD support for PodIdentityProvider config in azure pipeline trigger Aug 8, 2023

toniiiik force-pushed the main branch from 2040b7d to 2a7af7c Compare August 10, 2023 08:34

toniiiik mentioned this pull request Aug 10, 2023

update azure pipeline scaler doc with pod identity auth kedacore/keda-docs#1206

Merged

1 task

toniiiik marked this pull request as ready for review August 10, 2023 13:14

toniiiik requested a review from a team as a code owner August 10, 2023 13:14

JorTurFer mentioned this pull request Sep 29, 2023

azure pipelines scaler Federated Workload identities #5013

Closed

zroubalik reviewed Dec 21, 2023

View reviewed changes

JorTurFer reviewed Jan 3, 2024

View reviewed changes

pkg/scalers/azure_pipelines_scaler.go Outdated Show resolved Hide resolved

JorTurFer reviewed Jan 3, 2024

View reviewed changes

tests/scalers/azure/azure_pipelines_aad_wi/azure_pipelines_aad_wi_test.go Show resolved Hide resolved

JorTurFer reviewed Jan 3, 2024

View reviewed changes

tests/scalers/azure/azure_pipelines_aad_wi/azure_pipelines_aad_wi_test.go Outdated Show resolved Hide resolved

tests/scalers/azure/azure_pipelines_aad_wi/azure_pipelines_aad_wi_test.go Outdated Show resolved Hide resolved

JorTurFer reviewed Jan 3, 2024

View reviewed changes

pkg/scalers/azure_pipelines_scaler.go Outdated Show resolved Hide resolved

toniiiik force-pushed the main branch 3 times, most recently from 94d0607 to 97e18a8 Compare January 15, 2024 16:40

Add support for workload identity

d3b1793

Signed-off-by: anton.lysina <[email protected]>

toniiiik force-pushed the main branch from 97e18a8 to d3b1793 Compare January 15, 2024 16:51

Fix changelog

90cdb91

Signed-off-by: anton.lysina <[email protected]>

zroubalik reviewed Jan 15, 2024

View reviewed changes

CHANGELOG.md Outdated Show resolved Hide resolved

pkg/scalers/azure_pipelines_scaler.go Outdated Show resolved Hide resolved

pkg/scalers/azure_pipelines_scaler.go Outdated Show resolved Hide resolved

toniiiik and others added 2 commits January 15, 2024 18:08

Update pkg/scalers/azure_pipelines_scaler.go

c205d8c

Co-authored-by: Zbynek Roubalik <[email protected]> Signed-off-by: toniiiik <[email protected]>

cleanup commented code and update changelog

191a7b0

Signed-off-by: anton.lysina <[email protected]>

JorTurFer reviewed Jan 15, 2024

View reviewed changes

pkg/scalers/azure_pipelines_scaler.go Outdated Show resolved Hide resolved

zroubalik reviewed Jan 15, 2024

View reviewed changes

CHANGELOG.md Outdated Show resolved Hide resolved

toniiiik and others added 3 commits January 15, 2024 23:42

Update CHANGELOG.md

069364b

Co-authored-by: Zbynek Roubalik <[email protected]> Signed-off-by: toniiiik <[email protected]>

add token cache

b7c84c6

Signed-off-by: anton.lysina <[email protected]>

Merge remote-tracking branch 'upstream/main'

bba67db

Signed-off-by: anton.lysina <[email protected]>

JorTurFer approved these changes Jan 16, 2024

View reviewed changes

tomkerkhove merged commit 6d66962 into kedacore:main Jan 16, 2024
19 checks passed

JorTurFer mentioned this pull request Jan 22, 2024

Managed Identity based authentication for the azure-pipelines scaler #4072

Closed

ADD support for PodIdentityProvider config in azure pipeline trigger #4867

ADD support for PodIdentityProvider config in azure pipeline trigger #4867

Conversation

toniiiik commented Aug 8, 2023 • edited by JorTurFer Loading

Checklist

github-actions bot commented Aug 8, 2023

JorTurFer commented Aug 24, 2023

toniiiik commented Sep 1, 2023

JorTurFer commented Oct 18, 2023

luck2bhanu commented Nov 1, 2023

toniiiik commented Nov 1, 2023

JonasCordsen commented Nov 3, 2023

JorTurFer commented Nov 3, 2023

tomkerkhove commented Nov 3, 2023

norbinto commented Nov 7, 2023

JorTurFer commented Nov 21, 2023

zroubalik left a comment

Choose a reason for hiding this comment

ezYakaEagle442 commented Dec 27, 2023

tomkerkhove commented Jan 2, 2024

JorTurFer commented Jan 2, 2024

JorTurFer commented Jan 2, 2024 • edited by github-actions bot Loading

JorTurFer commented Jan 3, 2024

JorTurFer commented Jan 3, 2024

JorTurFer left a comment

Choose a reason for hiding this comment

JorTurFer commented Jan 3, 2024 • edited by github-actions bot Loading

toniiiik commented Jan 9, 2024

JorTurFer commented Jan 11, 2024

JorTurFer commented Jan 11, 2024 • edited by github-actions bot Loading

JorTurFer commented Jan 11, 2024 • edited by github-actions bot Loading

JorTurFer commented Jan 11, 2024

toniiiik commented Jan 12, 2024 • edited Loading

JorTurFer commented Jan 12, 2024

JorTurFer commented Jan 12, 2024 • edited by github-actions bot Loading

JorTurFer commented Jan 12, 2024

zroubalik commented Jan 15, 2024 • edited by github-actions bot Loading

JorTurFer commented Jan 15, 2024 • edited by github-actions bot Loading

JorTurFer left a comment

Choose a reason for hiding this comment

toniiiik commented Jan 15, 2024

JorTurFer left a comment

Choose a reason for hiding this comment

JorTurFer commented Jan 16, 2024 • edited by github-actions bot Loading

toniiiik commented Aug 8, 2023 •

edited by JorTurFer

Loading

JorTurFer commented Jan 2, 2024 •

edited by github-actions bot

Loading

JorTurFer commented Jan 3, 2024 •

edited by github-actions bot

Loading

JorTurFer commented Jan 11, 2024 •

edited by github-actions bot

Loading

JorTurFer commented Jan 11, 2024 •

edited by github-actions bot

Loading

toniiiik commented Jan 12, 2024 •

edited

Loading

JorTurFer commented Jan 12, 2024 •

edited by github-actions bot

Loading

zroubalik commented Jan 15, 2024 •

edited by github-actions bot

Loading

JorTurFer commented Jan 15, 2024 •

edited by github-actions bot

Loading

JorTurFer commented Jan 16, 2024 •

edited by github-actions bot

Loading