kitchen-azurerm 1.14.0 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2c8f93443204a7cb375624116dbfafaa5ade3419fdd9e0538e1c701f38e60d29
-  data.tar.gz: e14d346d4cb82139aaaa49fdb9d4ef7f752059e0b535d24285e37a585c5b710b
+  metadata.gz: f429ccdaffbdba117dea3b15b9e8beff46b7e5d1e0e1b4e23f0ab2565b652685
+  data.tar.gz: cd8ac4c9961e845d121331825a74bc20c85d0317db726f58d5954aedb8b5ffe0
 SHA512:
-  metadata.gz: 2474a4e576e924afaa92e121fc315fee4cbce2ab159f946d64d8e208f1127d8dd50fd7d383aafc70beec2bb3dfb9194ddaf79d43c5e4cd1522787a4d38603efa
-  data.tar.gz: 9e498c0a069a4ee74e7db388c5983df082ba1bf251be06280868abdc802de616f75a93e331b62527a39b839cf55927fcab741265d732eef64f460e34130099e5
+  metadata.gz: 03a1ed78caa550f245b466c9cfb218dda27d45f50e2b158371e4b14b9f1d45e30d478c277a0ccf437a00855d8dd2f8b8d883d51578b66d750d51c355859d1073
+  data.tar.gz: 181aa2863481530c6d2d78d2d050918dedbc71f51723928eb166dd8ae78d7dd966090f5a112a6202b74d160fba62cf695b29e86335853038672dc342e8577628

data/lib/kitchen/driver/azure/arm_client.rb

@@ -0,0 +1,198 @@
+require "json" unless defined?(JSON)
+require "uri" unless defined?(URI)
+
+require_relative "errors"
+require_relative "http"
+
+module Kitchen
+  module Driver
+    module Azure
+      # A minimal Azure Resource Manager client covering exactly the operations
+      # this driver performs.
+      #
+      # Replaces +azure_mgmt_resources2+, +azure_mgmt_network2+, +ms_rest2+ and
+      # +ms_rest_azure2+, which are forks of Microsoft's retired Azure SDK for
+      # Ruby. Responses are returned as parsed JSON, so callers see ARM's own
+      # camelCase property names rather than the SDK's generated model objects.
+      class ArmClient
+        # ARM API version used for resource group and deployment requests.
+        #
+        # @return [String]
+        RESOURCES_API_VERSION = "2025-04-01".freeze
+
+        # ARM API version used for network resource requests.
+        #
+        # @return [String]
+        NETWORK_API_VERSION = "2025-07-01".freeze
+
+        # @param subscription_id [String]
+        # @param environment [Environments::Environment]
+        # @param token_provider [TokenProvider]
+        def initialize(subscription_id:, environment:, token_provider:)
+          @subscription_id = subscription_id
+          @environment = environment
+          @token_provider = token_provider
+        end
+
+        # @return [String]
+        attr_reader :subscription_id
+
+        # @return [Environments::Environment]
+        attr_reader :environment
+
+        # @return [TokenProvider]
+        attr_reader :token_provider
+
+        # Whether a resource group exists.
+        #
+        # @param name [String] resource group name, case-insensitive.
+        # @return [Boolean]
+        def resource_group_exists?(name)
+          response = call(:head, resource_group_path(name), api_version: RESOURCES_API_VERSION, allow: [404])
+          response.status != 404
+        end
+
+        # Creates or updates a resource group.
+        #
+        # @param name [String] resource group name.
+        # @param location [String] Azure region.
+        # @param tags [Hash] resource tags.
+        # @return [Hash] the resource group as ARM returned it.
+        def create_or_update_resource_group(name, location:, tags: {})
+          call(:put, resource_group_path(name),
+            api_version: RESOURCES_API_VERSION,
+            body: { "location" => location, "tags" => tags || {} }).json
+        end
+
+        # Requests deletion of a resource group, returning as soon as ARM
+        # accepts the request rather than waiting for it to finish.
+        #
+        # @param name [String] resource group name.
+        # @return [void]
+        def delete_resource_group(name)
+          call(:delete, resource_group_path(name), api_version: RESOURCES_API_VERSION)
+          nil
+        end
+
+        # Submits a deployment, returning once ARM accepts it.
+        #
+        # @param resource_group [String]
+        # @param name [String] deployment name.
+        # @param deployment [Hash] the deployment body, as built by the driver.
+        # @return [Hash] the deployment as ARM returned it.
+        def create_deployment(resource_group, name, deployment)
+          call(:put, deployment_path(resource_group, name),
+            api_version: RESOURCES_API_VERSION,
+            body: deployment).json
+        end
+
+        # Reads a deployment.
+        #
+        # @param resource_group [String]
+        # @param name [String] deployment name.
+        # @return [Hash]
+        def deployment(resource_group, name)
+          call(:get, deployment_path(resource_group, name), api_version: RESOURCES_API_VERSION).json
+        end
+
+        # Lists every operation belonging to a deployment.
+        #
+        # @param resource_group [String]
+        # @param name [String] deployment name.
+        # @return [Array<Hash>]
+        def deployment_operations(resource_group, name)
+          payload = call(:get, "#{deployment_path(resource_group, name)}/operations",
+            api_version: RESOURCES_API_VERSION).json
+
+          payload.is_a?(Hash) ? Array(payload["value"]) : []
+        end
+
+        # Reads a public IP address resource.
+        #
+        # @param resource_group [String]
+        # @param name [String] public IP resource name.
+        # @return [Hash]
+        def public_ip(resource_group, name)
+          call(:get, network_path(resource_group, "publicIPAddresses", name),
+            api_version: NETWORK_API_VERSION).json
+        end
+
+        # Reads a network interface resource.
+        #
+        # @param resource_group [String]
+        # @param name [String] network interface name.
+        # @return [Hash]
+        def network_interface(resource_group, name)
+          call(:get, network_path(resource_group, "networkInterfaces", name),
+            api_version: NETWORK_API_VERSION).json
+        end
+
+        private
+
+        # @param name [String]
+        # @return [String]
+        def resource_group_path(name)
+          "/subscriptions/#{subscription_id}/resourcegroups/#{escape(name)}"
+        end
+
+        # @param resource_group [String]
+        # @param name [String]
+        # @return [String]
+        def deployment_path(resource_group, name)
+          "#{resource_group_path(resource_group)}/providers/Microsoft.Resources/deployments/#{escape(name)}"
+        end
+
+        # @param resource_group [String]
+        # @param type [String] e.g. +"publicIPAddresses"+.
+        # @param name [String]
+        # @return [String]
+        def network_path(resource_group, type, name)
+          "#{resource_group_path(resource_group)}/providers/Microsoft.Network/#{type}/#{escape(name)}"
+        end
+
+        # @param value [String]
+        # @return [String] path-escaped
+        def escape(value)
+          URI::DEFAULT_PARSER.escape(value.to_s)
+        end
+
+        # Performs an authenticated ARM request.
+        #
+        # @param method [Symbol]
+        # @param path [String] path below the resource manager URL.
+        # @param api_version [String]
+        # @param body [Hash, nil] request body, serialized as JSON.
+        # @param allow [Array<Integer>] non-2xx statuses to treat as success.
+        # @return [Http::Response]
+        # @raise [OperationError] when ARM returns an unexpected status.
+        def call(method, path, api_version:, body: nil, allow: [])
+          url = "#{environment.resource_manager_url.chomp("/")}#{path}?api-version=#{api_version}"
+          headers = {
+            "Authorization" => token_provider.authorization_header,
+            "Accept" => "application/json",
+            "User-Agent" => "kitchen-azurerm/#{Kitchen::Driver::AZURERM_VERSION}",
+          }
+          headers["Content-Type"] = "application/json" if body
+
+          response = Http.request(method:, url:, headers:, body: body && JSON.generate(body))
+          return response if response.success? || allow.include?(response.status)
+
+          raise OperationError.new(
+            "Azure returned HTTP #{response.status} for #{method.to_s.upcase} #{path}",
+            status: response.status,
+            body: error_body(response)
+          )
+        end
+
+        # @param response [Http::Response]
+        # @return [Hash] the parsed error body, or a synthesized one.
+        def error_body(response)
+          parsed = response.json
+          return parsed if parsed.is_a?(Hash) && parsed.key?("error")
+
+          { "error" => { "code" => "Unknown", "message" => response.body.to_s } }
+        end
+      end
+    end
+  end
+end

data/lib/kitchen/driver/azure/environments.rb

@@ -0,0 +1,105 @@
+module Kitchen
+  module Driver
+    module Azure
+      # Endpoints for each Azure cloud the driver can target.
+      #
+      # These used to come from +MsRestAzure2::AzureEnvironments+ and
+      # +MsRestAzure2::ActiveDirectoryServiceSettings+. They are stable,
+      # published values, so carrying the table ourselves costs a few lines and
+      # removes a dependency on a retired SDK.
+      module Environments
+        # One Azure cloud's endpoints.
+        #
+        # @!attribute [r] name
+        #   @return [String] canonical cloud name, e.g. +"AzureUSGovernment"+.
+        # @!attribute [r] resource_manager_url
+        #   @return [String] base URL for Azure Resource Manager requests.
+        # @!attribute [r] authentication_endpoint
+        #   @return [String] Entra ID (Azure AD) token endpoint.
+        # @!attribute [r] token_audience
+        #   @return [String] audience/resource the access token is requested for.
+        Environment = Struct.new(:name, :resource_manager_url, :authentication_endpoint, :token_audience) do
+          # The OAuth2 v1.0 token URL for a tenant in this cloud.
+          #
+          # @param tenant_id [String]
+          # @return [String]
+          def token_url(tenant_id)
+            "#{authentication_endpoint.chomp("/")}/#{tenant_id}/oauth2/token"
+          end
+
+          # The OAuth2 v2.0 token URL for a tenant in this cloud.
+          #
+          # Federated (assertion-based) client credentials are documented
+          # against v2.0, which takes a +scope+ rather than a +resource+.
+          #
+          # @param tenant_id [String]
+          # @return [String]
+          def token_url_v2(tenant_id)
+            "#{authentication_endpoint.chomp("/")}/#{tenant_id}/oauth2/v2.0/token"
+          end
+
+          # The v2.0 scope covering every permission this driver needs.
+          #
+          # @return [String] e.g. +"https://management.azure.com/.default"+
+          def default_scope
+            "#{resource_manager_url.chomp("/")}/.default"
+          end
+
+          # A copy of this cloud pointed at a different Entra ID authority.
+          #
+          # Platforms that issue federated tokens - AKS in particular - set
+          # +AZURE_AUTHORITY_HOST+ to say where those tokens should be
+          # exchanged.
+          #
+          # @param authority [String, nil] the authority URL, or nil to keep this one.
+          # @return [Environment]
+          def with_authority(authority)
+            return self if authority.to_s.empty?
+
+            self.class.new(name, resource_manager_url, authority, token_audience).freeze
+          end
+        end
+
+        # Every supported cloud, keyed by its downcased name so that lookups are
+        # case-insensitive.
+        #
+        # @return [Hash{String => Environment}]
+        ALL = [
+          Environment.new("Azure",
+            "https://management.azure.com/",
+            "https://login.microsoftonline.com/",
+            "https://management.core.windows.net/"),
+          Environment.new("AzureUSGovernment",
+            "https://management.usgovcloudapi.net",
+            "https://login.microsoftonline.us/",
+            "https://management.core.usgovcloudapi.net/"),
+          Environment.new("AzureChina",
+            "https://management.chinacloudapi.cn",
+            "https://login.chinacloudapi.cn/",
+            "https://management.core.chinacloudapi.cn/"),
+          Environment.new("AzureGermanCloud",
+            "https://management.microsoftazure.de",
+            "https://login.microsoftonline.de/",
+            "https://management.core.cloudapi.de/"),
+        ].each(&:freeze).to_h { |environment| [environment.name.downcase, environment] }.freeze
+
+        # Looks a cloud up by name.
+        #
+        # @param name [String] cloud name, case-insensitive.
+        # @return [Environment]
+        # @raise [Kitchen::UserError] if the name is not a known Azure cloud.
+        def self.fetch(name)
+          ALL.fetch(name.to_s.downcase) do
+            raise Kitchen::UserError,
+              "Unknown azure_environment '#{name}'. Valid values are: #{names.join(", ")} (case-insensitive)."
+          end
+        end
+
+        # @return [Array<String>] the canonical name of every supported cloud.
+        def self.names
+          ALL.values.map(&:name)
+        end
+      end
+    end
+  end
+end

data/lib/kitchen/driver/azure/errors.rb

@@ -0,0 +1,50 @@
+module Kitchen
+  module Driver
+    # Direct Azure Resource Manager access: endpoints, authentication, and the
+    # handful of REST calls this driver makes.
+    #
+    # This replaces the +azure_mgmt_*+ and +ms_rest*+ gems, which are forks of
+    # Microsoft's retired Azure SDK for Ruby.
+    module Azure
+      # Raised when Azure Resource Manager returns an error response.
+      #
+      # Replaces +MsRestAzure2::AzureOperationError+, keeping the +body+
+      # accessor the driver's rescue blocks already rely on.
+      #
+      # Note the explicit +::StandardError+: Test Kitchen defines
+      # +Kitchen::StandardError+, and this class lives inside +module Kitchen+,
+      # so a bare +StandardError+ here would resolve to that instead.
+      class OperationError < ::StandardError
+        # The parsed error body, as returned by ARM.
+        #
+        # @return [Hash] typically +{"error" => {"code" => ..., "message" => ...}}+.
+        attr_reader :body
+
+        # The HTTP status code of the failing response.
+        #
+        # @return [Integer]
+        attr_reader :status
+
+        # @param message [String] human-readable summary.
+        # @param status [Integer] HTTP status code.
+        # @param body [Hash] parsed ARM error body.
+        def initialize(message, status: nil, body: {})
+          super(message)
+          @status = status
+          @body = body
+        end
+
+        # The Azure error code, when ARM supplied one.
+        #
+        # @return [String, nil] e.g. +"DeploymentActive"+.
+        def code
+          body.is_a?(Hash) ? body.dig("error", "code") : nil
+        end
+      end
+
+      # Raised when a request could not be completed and is worth retrying:
+      # timeouts, resets, DNS failures and the like.
+      class TransientError < ::StandardError; end
+    end
+  end
+end

data/lib/kitchen/driver/azure/http.rb

@@ -0,0 +1,120 @@
+require "json" unless defined?(JSON)
+require "net/http" unless defined?(Net::HTTP)
+require "openssl" unless defined?(OpenSSL)
+require "uri" unless defined?(URI)
+
+require_relative "errors"
+
+module Kitchen
+  module Driver
+    module Azure
+      # A very small JSON-over-HTTP helper built on the standard library.
+      #
+      # The driver makes a handful of straightforward requests, so this replaces
+      # Faraday and its middleware chain rather than depending on them.
+      module Http
+        # Network-level failures worth retrying rather than surfacing.
+        #
+        # @return [Array<Class>]
+        TRANSIENT_ERRORS = [
+          Net::OpenTimeout,
+          Net::ReadTimeout,
+          Errno::ECONNREFUSED,
+          Errno::ECONNRESET,
+          Errno::EHOSTUNREACH,
+          Errno::ENETUNREACH,
+          Errno::EPIPE,
+          EOFError,
+          SocketError,
+          OpenSSL::SSL::SSLError,
+        ].freeze
+
+        # Seconds to wait for a connection and for a response.
+        #
+        # @return [Integer]
+        OPEN_TIMEOUT = 30
+        # @return [Integer]
+        READ_TIMEOUT = 120
+
+        # One HTTP response.
+        #
+        # @!attribute [r] status
+        #   @return [Integer]
+        # @!attribute [r] body
+        #   @return [String]
+        Response = Struct.new(:status, :body) do
+          # @return [Boolean] whether the status is in the 2xx range.
+          def success?
+            status.between?(200, 299)
+          end
+
+          # The response body parsed as JSON.
+          #
+          # @return [Hash, Array, nil] nil when the body is empty or not JSON.
+          def json
+            return nil if body.nil? || body.empty?
+
+            JSON.parse(body)
+          rescue JSON::ParserError
+            nil
+          end
+        end
+
+        # Performs a request.
+        #
+        # @param method [Symbol] +:get+, +:head+, +:put+, +:post+ or +:delete+.
+        # @param url [String] absolute URL.
+        # @param headers [Hash{String => String}] request headers.
+        # @param body [String, nil] request body, already encoded.
+        # @return [Response]
+        # @raise [TransientError] on a network failure worth retrying.
+        def self.request(method:, url:, headers: {}, body: nil)
+          uri = URI.parse(url)
+          request = request_class(method).new(uri)
+          headers.each { |name, value| request[name] = value }
+          request.body = body if body
+
+          response = perform(uri, request)
+          Response.new(response.code.to_i, response.body.to_s)
+        rescue *TRANSIENT_ERRORS => e
+          raise TransientError, "#{e.class}: #{e.message}"
+        end
+
+        # Sends a request, honouring the proxy environment variables.
+        #
+        # @param uri [URI]
+        # @param request [Net::HTTPRequest]
+        # @return [Net::HTTPResponse]
+        # @api private
+        def self.perform(uri, request)
+          proxy = uri.find_proxy
+          http = if proxy
+                   Net::HTTP.new(uri.host, uri.port, proxy.host, proxy.port, proxy.user, proxy.password)
+                 else
+                   Net::HTTP.new(uri.host, uri.port)
+                 end
+
+          http.use_ssl = uri.scheme == "https"
+          http.open_timeout = OPEN_TIMEOUT
+          http.read_timeout = READ_TIMEOUT
+          http.start { |connection| connection.request(request) }
+        end
+
+        # @param method [Symbol]
+        # @return [Class] the matching +Net::HTTP+ request class.
+        # @raise [ArgumentError] for an unsupported method.
+        # @api private
+        def self.request_class(method)
+          case method
+          when :get then Net::HTTP::Get
+          when :head then Net::HTTP::Head
+          when :put then Net::HTTP::Put
+          when :post then Net::HTTP::Post
+          when :delete then Net::HTTP::Delete
+          else raise ArgumentError, "Unsupported HTTP method: #{method}"
+          end
+        end
+      end
+    end
+  end
+end