Skip to content

Commit 99f9bf5

Browse files
pvaneckpvaneck
authored
[Identity] Update manual testing docs (#27182)
* This updates Azure Arc manual testing instructions and also adds a document for testing on Azure Container Instances. Dockerfiles and requirements.txt were both updated accordingly. * Update VM and Cloud Shell instructions * Pod identity doc updates * Add missing await keyword in async test Signed-off-by: Paul Van Eck <[email protected]>
1 parent 081b239 commit 99f9bf5

File tree

10 files changed

+255
-70
lines changed

10 files changed

+255
-70
lines changed

‎sdk/identity/azure-identity/tests/managed-identity-live/Dockerfile‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
# internal users should provide MCR registry to build via 'docker build . --build-arg REGISTRY="mcr.microsoft.com/mirror/docker/library/"'
77
# public OSS users should simply leave this argument blank or ignore its presence entirely
88
ARG REGISTRY=""
9-
ARG PYTHON_VERSION=3.9
9+
ARG PYTHON_VERSION=3.10
1010

1111
# docker can't tell when the repo has changed and will therefore cache this layer
1212
FROM ${REGISTRY}alpine:3.14 as repo
@@ -15,10 +15,13 @@ RUN git clone https://github.com/Azure/azure-sdk-for-python --single-branch --de
1515

1616
FROM ${REGISTRY}python:${PYTHON_VERSION}-slim
1717

18+
COPY --from=repo /azure-sdk-for-python/tools /tools
1819
COPY --from=repo /azure-sdk-for-python/sdk/identity /sdk/identity
1920
COPY --from=repo /azure-sdk-for-python/sdk/core/azure-core /sdk/core/azure-core
2021
COPY --from=repo /azure-sdk-for-python/sdk/keyvault/azure-keyvault-secrets /sdk/keyvault/azure-keyvault-secrets
2122

23+
ENV AZURE_TEST_RUN_LIVE=true
24+
ENV AZURE_SKIP_LIVE_RECORDING=true
2225
WORKDIR /sdk/identity/azure-identity/tests/managed-identity-live
2326
RUN pip install --no-cache-dir -r requirements.txt
2427

‎sdk/identity/azure-identity/tests/managed-identity-live/azure_arc.md‎

Lines changed: 20 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
# Testing azure-identity in Azure Arc
1+
# Test Azure Identity in Azure Arc
22

33
## Prerequisite tools
44

55
1. A non-Azure Windows or Linux VM.
66
2. Administrator privileges on the VM.
77
3. An Azure Key Vault.
8-
4. Python 3.6+
8+
4. Python 3.7+
99

1010
### Install Azure Arc on the VM
1111

@@ -25,37 +25,43 @@ sudo setfacl -m "g:himds:r-x" /var/opt/azcmagent/tokens/
2525
sudo setfacl -m "g::r-x" /var/opt/azcmagent/tokens/
2626
```
2727
7. Arc setup should now be complete. Restart your VM to finalize your environment setup.
28-
8. After restarting, check your environment by searching for environment variables named `IDENTITY_ENDPOINT` and
29-
`IMDS_ENDPOINT`. If they are not present, or don't resemble `http://localhost:40342/metadata/identity/oauth2/token` and
28+
8. After restarting, check your environment by searching for environment variables named `IDENTITY_ENDPOINT` and
29+
`IMDS_ENDPOINT`. If they are not present, or don't resemble `http://localhost:40342/metadata/identity/oauth2/token` and
3030
`http://localhost:40342` respectively, you may need to wait a short while or try restarting the VM again.
3131

3232
## Give the Azure Arc VM access to the key vault
3333

3434
For the tests to pass, the VM will need secret management permissions in your key vault.
3535

3636
1. Go to your key vault resource in the [Azure Portal](https://portal.azure.com).
37-
2. Go to the vault's "Access policies" page, and click "Add Access Policy".
38-
3. Using the secret management template, select your Arc VM resource as the principal.
39-
4. Click "Add".
40-
5. Don't forget to click "Save" at the top of the access policies page after the policy is added.
37+
2. Go to the vault's "Access policies" page, and click "Create".
38+
3. Using the "Secret Management" template, select your Arc VM resource as the principal.
39+
4. Click "Create".
4140

4241
## Run the azure-identity Tests on the Azure Arc VM
4342

4443
> **Note:** The following steps are specific to Python.
4544
4645
In a terminal window, run:
47-
```
48-
git clone https://github.com/Azure/azure-sdk-for-python --single-branch --branch master --depth 1
46+
```sh
47+
git clone https://github.com/Azure/azure-sdk-for-python --single-branch --branch main --depth 1
4948
cd azure-sdk-for-python/sdk/identity/azure-identity/tests/managed-identity-live
5049
```
51-
Set the environment variable `AZURE_IDENTITY_TEST_VAULT_URL` to the vault URI of your key vault.
5250

5351
Install `requirements.txt`:
54-
```
52+
```sh
5553
pip install -r requirements.txt
5654
```
57-
Run the managed identity tests, using the below command with Python 3.6+:
55+
56+
Set the following environment variables, being sure to update the URL value:
5857
```
59-
pytest -k managed_identity_live
58+
AZURE_IDENTITY_TEST_VAULT_URL=<URL of your key vault>
59+
AZURE_TEST_RUN_LIVE=true
60+
AZURE_SKIP_LIVE_RECORDING=true
6061
```
62+
Run the managed identity tests, using the below command with Python 3.7+:
63+
```sh
64+
pytest -sv -k managed_identity_live
65+
```
66+
6167
Expected output for each: `passed` for all tests run.

‎sdk/identity/azure-identity/tests/managed-identity-live/cloudshell.md‎

Lines changed: 22 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
# Testing azure-identity in Azure Cloud Shell
1+
# Test Azure Identity in Azure Cloud Shell
22

33
# Open Azure Cloud Shell
44
https://shell.azure.com/
55

66
# Create an Azure Key Vault
77

8-
## set environment variables to simplify copy-pasting
8+
## Set environment variables to simplify copy-pasting
99
- RESOURCE_GROUP
1010
- name of an Azure resource group
1111
- must be unique in the Azure subscription
@@ -15,12 +15,12 @@ https://shell.azure.com/
1515
- must begin with a letter
1616
- must be globally unique
1717

18-
## create a resource group
18+
## Create a resource group
1919
```sh
2020
az group create -n $RESOURCE_GROUP --location westus2
2121
```
2222

23-
## create the Key Vault
23+
## Create the key vault
2424
```sh
2525
az keyvault create -g $RESOURCE_GROUP -n $KEY_VAULT_NAME --sku standard
2626
```
@@ -35,48 +35,50 @@ export AZURE_IDENTITY_TEST_VAULT_URL=$(az keyvault show -g $RESOURCE_GROUP -n $K
3535
## Acquire the latest code
3636
This may take several minutes:
3737
```sh
38-
git clone https://github.com/azure/azure-sdk-for-python --single-branch --branch master --depth 1
38+
git clone https://github.com/azure/azure-sdk-for-python --single-branch --branch main --depth 1
3939
```
4040

4141
## Change working directory
4242
```sh
4343
cd azure-sdk-for-python/sdk/identity/azure-identity
4444
```
4545

46-
## Create virtual environments
47-
The Azure SDK supports Python 3.6+. Python 3 should be installed in your Cloud Shell.
48-
49-
### Python 3
50-
If your shell has at least Python 3.6 available, create a virtual environment
51-
for it:
46+
## Create virtual environment
47+
The Azure SDK supports Python 3.7+. Python 3 should be installed in your Cloud Shell.
5248
```sh
53-
virtualenv -p python3 ~/venv3
49+
python -m venv ~/venv
5450
```
5551

56-
## For each virtual environment:
57-
58-
### Activate
52+
## Activate virtual environment
5953
For example:
6054
```sh
61-
source ~/venv2/bin/activate
55+
source ~/venv/bin/activate
6256
```
6357

64-
### Install packages
58+
## Install packages
6559
```sh
6660
pip install -r dev_requirements.txt .
6761
```
6862

69-
### Run tests
63+
## Set required environment variables
64+
```sh
65+
export AZURE_TEST_RUN_LIVE=true
66+
export AZURE_SKIP_LIVE_RECORDING=true
67+
```
68+
69+
## Run tests
7070
```sh
7171
pytest ./tests -vrs -m cloudshell
7272
```
7373

74-
### Deactivate
74+
# Clean up
75+
76+
## Deactivate virtual environment
7577
```sh
7678
deactivate
7779
```
7880

79-
# Delete Azure resources
81+
## Delete Azure resources
8082
After running tests, delete the resources provisioned earlier:
8183
```sh
8284
az group delete -n $RESOURCE_GROUP -y --no-wait

‎sdk/identity/azure-identity/tests/managed-identity-live/container_instances.md‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
# Test Azure Identity in Azure Container Instances
2+
3+
# Prerequisite tools
4+
- Azure CLI
5+
- https://docs.microsoft.com/cli/azure/install-azure-cli?view=azure-cli-latest
6+
- Docker CLI
7+
- https://hub.docker.com/search?q=&type=edition&offering=community
8+
9+
10+
# Azure resources
11+
This test requires instances of these Azure resources:
12+
- Azure Key Vault
13+
- Azure Managed Identity
14+
- with secrets/set and secrets/delete permission for the Key Vault
15+
- Azure Container Registry
16+
17+
The rest of this section is a walkthrough of deploying these resources.
18+
19+
## Set environment variables to simplify copy-pasting
20+
- RESOURCE_GROUP
21+
- name of an Azure resource group
22+
- must be unique in the Azure subscription
23+
- e.g. 'pod-identity-test'
24+
- ACR_NAME
25+
- name of an Azure Container Registry
26+
- 5-50 alphanumeric characters
27+
- must be globally unique
28+
- MANAGED_IDENTITY_NAME
29+
- 3-128 alphanumeric characters
30+
- must be unique in the resource group
31+
- KEY_VAULT_NAME
32+
- 3-24 alphanumeric characters
33+
- must begin with a letter
34+
- must be globally unique
35+
36+
## Create resource group
37+
```sh
38+
az group create -n $RESOURCE_GROUP --location westus2
39+
```
40+
41+
## Create a managed identity
42+
### Create the managed identity
43+
```sh
44+
az identity create -g $RESOURCE_GROUP -n $MANAGED_IDENTITY_NAME
45+
```
46+
47+
### Save its ARM URI for later
48+
```sh
49+
export MANAGED_IDENTITY_ID=$(az identity show -g $RESOURCE_GROUP -n $MANAGED_IDENTITY_NAME --query id -o tsv)
50+
```
51+
52+
## Key Vault
53+
### Create the Vault
54+
```sh
55+
az keyvault create -g $RESOURCE_GROUP -n $KEY_VAULT_NAME --sku standard
56+
```
57+
58+
### Add an access policy for the managed identity
59+
```sh
60+
az keyvault set-policy -n $KEY_VAULT_NAME \
61+
--object-id $(az identity show -g $RESOURCE_GROUP -n $MANAGED_IDENTITY_NAME --query principalId -o tsv) \
62+
--secret-permissions set delete list
63+
```
64+
65+
## Create Container Registry
66+
```sh
67+
az acr create -g $RESOURCE_GROUP -n $ACR_NAME --admin-enabled --sku basic
68+
```
69+
70+
# Build container images
71+
The test application must be packaged as a Docker image.
72+
73+
## Authenticate to ACR
74+
```sh
75+
az acr login -n $ACR_NAME
76+
```
77+
78+
## Acquire the test code
79+
```sh
80+
git clone https://github.com/Azure/azure-sdk-for-python/ --branch main --single-branch --depth 1
81+
```
82+
83+
The rest of this section assumes this working directory:
84+
```sh
85+
cd azure-sdk-for-python/sdk/identity/azure-identity/tests
86+
```
87+
88+
## Build and push images to container registry
89+
### Set environment variables
90+
```sh
91+
export REPOSITORY=$(az acr show -g $RESOURCE_GROUP -n $ACR_NAME --query loginServer -o tsv) \
92+
IMAGE_NAME=test-pod-identity \
93+
PYTHON_VERSION=3.10
94+
```
95+
96+
### Build image
97+
```sh
98+
docker build --no-cache --build-arg PYTHON_VERSION=$PYTHON_VERSION -t $REPOSITORY/$IMAGE_NAME:$PYTHON_VERSION ./managed-identity-live
99+
```
100+
101+
### Push image
102+
```sh
103+
docker push $REPOSITORY/$IMAGE_NAME:$PYTHON_VERSION
104+
```
105+
106+
Then set `PYTHON_VERSION` to the latest 3.x and run the above `docker build`
107+
and `docker push` commands again. (It's safe--and faster--to omit
108+
`--no-cache` from `docker build` the second time.)
109+
110+
# Run tests
111+
112+
Run these commands to run the tests in a container instance.
113+
114+
## Set a name for the container group
115+
```sh
116+
export CONTAINER_NAME=managed-id-container-test-python${PYTHON_VERSION::1}
117+
```
118+
119+
## Run the test
120+
```sh
121+
az container create -g $RESOURCE_GROUP -n $CONTAINER_NAME \
122+
--assign-identity $MANAGED_IDENTITY_ID \
123+
--restart-policy OnFailure \
124+
--registry-username $(az acr credential show -n $ACR_NAME --query username -o tsv) \
125+
--registry-password $(az acr credential show -n $ACR_NAME --query passwords[0].value -o tsv) \
126+
--image $REPOSITORY/$IMAGE_NAME:$PYTHON_VERSION \
127+
-e AZURE_IDENTITY_TEST_VAULT_URL=$(az keyvault show -g $RESOURCE_GROUP -n $KEY_VAULT_NAME --query properties.vaultUri -o tsv)
128+
```
129+
130+
## Inspect output
131+
```sh
132+
az container logs -g $RESOURCE_GROUP -n $CONTAINER_NAME
133+
```
134+
135+
Success looks like this:
136+
```
137+
============================= test session starts ==============================
138+
platform linux -- Python 3.10.8, pytest-7.2.0, pluggy-1.0.0 -- /usr/local/bin/python
139+
cachedir: .pytest_cache
140+
rootdir: /sdk/identity/azure-identity
141+
plugins: asyncio-0.20.1, cov-4.0.0
142+
asyncio: mode=strict
143+
collecting ... collected 4 items
144+
145+
test_cloud_shell.py::test_cloud_shell_live SKIPPED (Cloud Shell MSI ...) [ 25%]
146+
test_cloud_shell_async.py::test_cloud_shell_live SKIPPED (Cloud Shell...) [ 50%]
147+
test_managed_identity_live.py::test_managed_identity_live PASSED [ 75%]
148+
test_managed_identity_live_async.py::test_managed_identity_live PASSED [100%]
149+
150+
=========================== short test summary info ============================
151+
SKIPPED [2] conftest.py:46: Cloud Shell MSI unavailable
152+
========================= 2 passed, 2 skipped in 1.30s =========================
153+
```
154+
`test_managed_identity_live` must pass. Other test cases may be skipped. No test case may fail.
155+
156+
# Delete Azure resources
157+
Finally, delete the resources created above:
158+
```sh
159+
az group delete -n $RESOURCE_GROUP -y --no-wait
160+
```

‎sdk/identity/azure-identity/tests/managed-identity-live/requirements.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
../../../../core/azure-core
22
../..
33
../../../../keyvault/azure-keyvault-secrets
4+
../../../../../tools/azure-devtools
5+
../../../../../tools/azure-sdk-tools
46
pytest
57
pytest-asyncio
68
aiohttp>=3.0

‎sdk/identity/azure-identity/tests/managed-identity-live/service-fabric/service_fabric.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ The `arm-templates` directory contains Azure resource templates for creating the
1919

2020
From a command prompt window, run
2121
```
22-
git clone https://github.com/Azure/azure-sdk-for-python --single-branch --branch master --depth 1
22+
git clone https://github.com/Azure/azure-sdk-for-python --single-branch --branch main --depth 1
2323
cd azure-sdk-for-python/sdk/identity/azure-identity/tests/managed-identity-live/service-fabric
2424
```
2525

@@ -148,7 +148,7 @@ Your Service Fabric cluster will target each application by referencing a `.sfpk
148148

149149
### Upload the application packages to a storage account
150150

151-
If using an existing cluster, ensure your resource group has a storage account connected to your cluster. If you deployed a cluster using the template provided, two storage accounts were created but only one needs to store the `.sfpkg` files for the applications (the one with the name corresponding to `applicationDiagnosticsStorageAccountName` in the template).
151+
If using an existing cluster, ensure your resource group has a storage account connected to your cluster. If you deployed a cluster using the template provided, two storage accounts were created but only one needs to store the `.sfpkg` files for the applications (the one with the name corresponding to `applicationDiagnosticsStorageAccountName` in the template).
152152

153153
Go to your resource group in the [Azure Portal](https://portal.azure.com) and click on the storage account. Go to the "Containers" page and create a new container named "apps" -- be sure the set the public access level to Blob.
154154

‎sdk/identity/azure-identity/tests/managed-identity-live/test_cloud_shell_async.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
@pytest.mark.asyncio
1414
async def test_cloud_shell_live(cloud_shell):
1515
credential = ManagedIdentityCredential()
16-
token = credential.get_token("https://vault.azure.net")
16+
token = await credential.get_token("https://vault.azure.net")
1717

1818
# Validate the token by sending a request to the Key Vault. The request is manual because azure-keyvault-secrets
1919
# can't authenticate in Cloud Shell; the MSI endpoint there doesn't support AADv2 scopes.

0 commit comments

Comments
 (0)