kitchen-azurerm 2.1.0 → 2.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f429ccdaffbdba117dea3b15b9e8beff46b7e5d1e0e1b4e23f0ab2565b652685
-  data.tar.gz: cd8ac4c9961e845d121331825a74bc20c85d0317db726f58d5954aedb8b5ffe0
+  metadata.gz: 7d34cb889a331fa1622ad6e3729fe3ee619c06b5ab830ccc067ca6e17441be01
+  data.tar.gz: a507483fd57dd9ac42ca96e2379d926bd6ad7aa924960374e6bd86298c196f3d
 SHA512:
-  metadata.gz: 03a1ed78caa550f245b466c9cfb218dda27d45f50e2b158371e4b14b9f1d45e30d478c277a0ccf437a00855d8dd2f8b8d883d51578b66d750d51c355859d1073
-  data.tar.gz: 181aa2863481530c6d2d78d2d050918dedbc71f51723928eb166dd8ae78d7dd966090f5a112a6202b74d160fba62cf695b29e86335853038672dc342e8577628
+  metadata.gz: 995c517ffd324584166c51a7463b2bc9588754828c231351224474713b34bc19d0d9ca0714c93fb5c3cdb7d9409911034a7af5a2200ab90fdb89ec3d4f019c74
+  data.tar.gz: 4d79344aba476cc4caf04ca35f785a47eeba4de4758d883f26bf0e7bc912c846cc91def32cbdd1fb5325d3bbfe6b9fe6a4adb1bd0c717054283dd6e580f5ed36

data/lib/kitchen/driver/azure/http.rb

@@ -1,3 +1,4 @@
+require "ipaddr" unless defined?(IPAddr)
 require "json" unless defined?(JSON)
 require "net/http" unless defined?(Net::HTTP)
 require "openssl" unless defined?(OpenSSL)
@@ -29,6 +30,11 @@ module Kitchen
           OpenSSL::SSL::SSLError,
         ].freeze
 
+        # The link-local range, which holds Azure's instance metadata service.
+        #
+        # @return [IPAddr]
+        LINK_LOCAL = IPAddr.new("169.254.0.0/16").freeze
+
         # Seconds to wait for a connection and for a response.
         #
         # @return [Integer]
@@ -87,11 +93,14 @@ module Kitchen
         # @return [Net::HTTPResponse]
         # @api private
         def self.perform(uri, request)
-          proxy = uri.find_proxy
+          proxy = proxy_for(uri)
           http = if proxy
                    Net::HTTP.new(uri.host, uri.port, proxy.host, proxy.port, proxy.user, proxy.password)
                  else
-                   Net::HTTP.new(uri.host, uri.port)
+                   # Explicitly nil rather than Net::HTTP's default of :ENV,
+                   # which would send it back to the environment to pick a
+                   # proxy we have just decided against.
+                   Net::HTTP.new(uri.host, uri.port, nil)
                  end
 
           http.use_ssl = uri.scheme == "https"
@@ -100,6 +109,34 @@ module Kitchen
           http.start { |connection| connection.request(request) }
         end
 
+        # The proxy to reach a URL through, if any.
+        #
+        # Azure's instance metadata service answers on a link-local address,
+        # which exists only on the local link and which no proxy can route to.
+        # Sending it through one breaks managed identity authentication
+        # outright: the connection hangs until the open timeout, surfaces as a
+        # {TransientError}, and is then retried. Every Azure SDK carves the
+        # same exception out.
+        #
+        # @param uri [URI]
+        # @return [URI, nil]
+        # @api private
+        def self.proxy_for(uri)
+          return nil if link_local?(uri.host)
+
+          uri.find_proxy
+        end
+
+        # @param host [String]
+        # @return [Boolean] whether the host is a link-local address.
+        # @api private
+        def self.link_local?(host)
+          LINK_LOCAL.include?(IPAddr.new(host.to_s))
+        rescue IPAddr::Error
+          # Not an IP address at all, so not the metadata service.
+          false
+        end
+
         # @param method [Symbol]
         # @return [Class] the matching +Net::HTTP+ request class.
         # @raise [ArgumentError] for an unsupported method.

data/lib/kitchen/driver/azure_credentials.rb

@@ -112,23 +112,70 @@ module Kitchen
 
       # @return [Azure::TokenProvider]
       def build_token_provider
-        if federated_token_file && client_id && tenant_id!
+        if federated_token_file && client_id && tenant_id
           debug "Authenticating with workload identity federation (#{federated_token_file})."
           Azure::WorkloadIdentityToken.new(environment: azure_environment, tenant_id:, client_id:,
             token_file: federated_token_file)
-        elsif client_id && client_secret && tenant_id!
+        elsif client_id && client_secret && tenant_id
+          debug "Authenticating as a service principal."
           Azure::ServicePrincipalToken.new(environment: azure_environment, tenant_id:, client_id:, client_secret:)
         elsif use_managed_identity?
+          debug "Authenticating as a managed identity."
           Azure::ManagedIdentityToken.new(environment: azure_environment, client_id:)
-        elsif tenant_id!
+        elsif tenant_id
           # A tenant with no client credentials means a system-assigned identity.
+          debug "Authenticating as a system-assigned managed identity."
           Azure::ManagedIdentityToken.new(environment: azure_environment)
         else
-          warn("Using tenant id set through `az login`.")
+          warn_about_unusable_credentials
+          debug "No Azure credentials were configured; using the token cached by `az login`."
           Azure::AzureCliToken.new(environment: azure_environment)
         end
       end
 
+      # Warns when credentials were supplied but cannot be used.
+      #
+      # Reaching the Azure CLI with nothing configured is a supported way to
+      # run the driver, so it passes without comment - warning about it on
+      # every create and destroy only taught users to ignore the warnings that
+      # matter. Reaching it having half-configured a service principal is a
+      # mistake worth interrupting for, because the run is about to
+      # authenticate as somebody else entirely.
+      #
+      # @return [void]
+      def warn_about_unusable_credentials
+        if partial_credentials?
+          warn("Incomplete Azure credentials: no #{missing_credentials.join(" or ")} was found in the " \
+               "environment or #{config_path}. Falling back to the credentials from `az login`.")
+        elsif credentials_file_without_subscription?
+          warn("#{config_path} has no [#{subscription_id}] section. " \
+               "Falling back to the credentials from `az login`.")
+        end
+      end
+
+      # Whether some, but not enough, client credentials were supplied.
+      #
+      # @return [Boolean]
+      def partial_credentials?
+        !(client_id.nil? && client_secret.nil? && federated_token_file.nil?)
+      end
+
+      # The credential values needed to use what was supplied.
+      #
+      # @return [Array<String>]
+      def missing_credentials
+        { "tenant_id" => tenant_id, "client_id" => client_id }.select { |_key, value| value.nil? }.keys
+      end
+
+      # Whether a credentials file exists but says nothing about the
+      # subscription under test. An empty section is deliberate - it is how a
+      # user opts one subscription in to the CLI - so it does not count.
+      #
+      # @return [Boolean]
+      def credentials_file_without_subscription?
+        File.file?(config_path) && !credentials.has_section?(subscription_id)
+      end
+
       # Whether to authenticate as a managed identity.
       #
       # A +client_id+ with no accompanying secret means a user-assigned managed
@@ -170,25 +217,18 @@ module Kitchen
       # Reads a property from the section of the credentials file matching
       # {#subscription_id}.
       #
+      # Reads through +to_h+ rather than +IniFile#[]+, which auto-vivifies:
+      # asking an +IniFile+ for a section it does not have *adds* that section.
+      # Looking up the credentials of an unconfigured subscription therefore
+      # used to leave the parsed file claiming to contain it.
+      #
       # @param property [String] the INI key to read.
       # @return [String, nil]
       def credentials_property(property)
-        value = credentials[subscription_id]&.[](property)
+        value = credentials.to_h[subscription_id]&.[](property)
         value unless value.to_s.empty?
       end
 
-      # Tenant ID, warning the user once when one cannot be resolved.
-      #
-      # @return [String, nil]
-      def tenant_id!
-        return tenant_id if tenant_id
-        return nil if @warned_about_tenant_id
-
-        @warned_about_tenant_id = true
-        warn("(#{config_path}) does not contain tenant_id neither is the AZURE_TENANT_ID environment variable set.")
-        nil
-      end
-
       # @return [String, nil] tenant ID from the environment or credentials file.
       def tenant_id
         env_or_credentials("AZURE_TENANT_ID", "tenant_id")

data/lib/kitchen/driver/azurerm.rb

@@ -280,14 +280,8 @@ module Kitchen
 
           run_deployment(state, "post-deploy", post_deployment(config[:post_deployment_template], config[:post_deployment_parameters])) if File.file?(config[:post_deployment_template])
         rescue Azure::OperationError => operation_error
-          rest_error = operation_error.body["error"]
-          if operation_error.code == "DeploymentActive"
-            info "Deployment for resource group #{state[:azure_resource_group_name]} is ongoing."
-            info "If you need to change the deployment template you'll need to rerun `kitchen create` for this instance."
-          else
-            info rest_error
-            raise operation_error
-          end
+          info operation_error.body["error"]
+          raise operation_error
         end
 
         state[:hostname] = resolve_hostname(state, deployment_parameters["nicName"])
@@ -369,7 +363,18 @@ module Kitchen
       def run_deployment(state, prefix, deployment)
         name = "#{prefix}-#{state[:uuid]}"
         info "Creating deployment: #{name}"
-        create_deployment_async(state[:azure_resource_group_name], name, deployment)
+        begin
+          create_deployment_async(state[:azure_resource_group_name], name, deployment)
+        rescue Azure::OperationError => operation_error
+          raise unless operation_error.code == "DeploymentActive"
+
+          # An interrupted `kitchen create` leaves its deployment running in
+          # Azure. Wait for that one instead of abandoning the rest of create:
+          # the deployment already in flight is the one we wanted, and the
+          # steps after this still have to run for the instance to be usable.
+          info "Deployment #{name} is already running; waiting for it rather than submitting it again."
+          info "To deploy a changed template, run `kitchen destroy` for this instance first."
+        end
         follow_deployment_until_end_state(state[:azure_resource_group_name], name)
       end
 
@@ -458,31 +463,50 @@ module Kitchen
       # The VM name to use, either the configured one or one generated from
       # +vm_prefix+ plus part of the instance uuid.
       #
-      # The generated name is truncated to {MAX_VM_NAME_LENGTH} so that a
-      # +vm_prefix+ longer than the documented three characters still yields a
-      # name Azure will accept.
+      # The prefix is capped one character short of {MAX_VM_NAME_LENGTH} so
+      # that a +vm_prefix+ longer than the documented three characters still
+      # yields a name Azure will accept. Leaving room for at least one uuid
+      # character does two things: it keeps some entropy in every generated
+      # name, and it guarantees the name ends with one, because a prefix that
+      # filled the whole budget could end on the separator it was written
+      # with. Azure rejects that outright - both for the VM and for the
+      # network interface named after it, which must end with a word
+      # character.
       #
       # @param state [Hash] instance state, must already have a +:uuid+.
       # @return [String]
       def generated_vm_name(state)
         return config[:vm_name] if config[:vm_name]
 
-        prefix = config[:vm_prefix].to_s
-        remaining = MAX_VM_NAME_LENGTH - prefix.length
-        return prefix[0, MAX_VM_NAME_LENGTH] if remaining <= 0
-
-        "#{prefix}#{state[:uuid][0, remaining]}"
+        prefix = config[:vm_prefix].to_s[0, MAX_VM_NAME_LENGTH - 1]
+        "#{prefix}#{state[:uuid][0, MAX_VM_NAME_LENGTH - prefix.length]}"
       end
 
+      # Maximum length of an Azure resource group name.
+      #
+      # @return [Integer]
+      MAX_RESOURCE_GROUP_NAME_LENGTH = 90
+
       # Name of the resource group this instance deploys into.
       #
+      # The instance name is the suite and platform joined together, so a
+      # descriptive suite on a long platform overruns Azure's limit and
+      # +kitchen create+ fails on its very first call - over a name the user
+      # never chose. Only that part is shortened: the prefix and suffix were
+      # asked for explicitly, and the timestamp is what keeps the name unique.
+      #
       # @return [String] +explicit_resource_group_name+ when set, otherwise
       #   prefix + instance name + UTC timestamp + suffix.
       def azure_resource_group_name
         return config[:explicit_resource_group_name] if config[:explicit_resource_group_name]
 
         formatted_time = Time.now.utc.strftime "%Y%m%dT%H%M%S"
-        "#{config[:azure_resource_group_prefix]}#{config[:azure_resource_group_name]}-#{formatted_time}#{config[:azure_resource_group_suffix]}"
+        prefix = config[:azure_resource_group_prefix].to_s
+        suffix = config[:azure_resource_group_suffix].to_s
+        room = MAX_RESOURCE_GROUP_NAME_LENGTH - prefix.length - suffix.length - formatted_time.length - 1
+        name = config[:azure_resource_group_name].to_s[0, [room, 0].max]
+
+        "#{prefix}#{name}-#{formatted_time}#{suffix}"
       end
 
       # JSON fragment describing the data disks to attach to the VM.
@@ -663,11 +687,19 @@ module Kitchen
         end
 
         info "Resource Template deployment reached end state of '#{deployment_provisioning_state}'."
-        show_failed_operations(resource_group, deployment_name) if deployment_provisioning_state == "Failed"
+        return if deployment_provisioning_state == "Succeeded"
+
+        show_failed_operations(resource_group, deployment_name)
+        raise "Deployment '#{deployment_name}' in resource group '#{resource_group}' " \
+              "ended in state '#{deployment_provisioning_state}'."
       end
 
       # Raises with the status messages of every failed operation in a deployment.
       #
+      # Returns quietly when no single operation reported a failure, leaving
+      # the caller to raise: a deployment can fail without one, and its own
+      # provisioning state is the authority on whether it worked.
+      #
       # @param resource_group [String] the resource group name.
       # @param deployment_name [String] the deployment name.
       # @return [void]
@@ -838,11 +870,20 @@ module Kitchen
 
       # The full first-boot script handed to a Windows VM as custom data.
       #
+      # A Windows VM has exactly one custom data slot, and the driver needs it
+      # for the WinRM bootstrap. Any +custom_data+ the user configured has to
+      # travel in the same slot, so it is appended here rather than assigned
+      # over the top - which is what used to happen, silently discarding it.
+      #
+      # It runs after WinRM is listening and the data disks are formatted, and
+      # before the logoff that ends the first-logon session.
+      #
       # @return [String]
       def custom_data_script_windows
         <<-EOH
   #{enable_winrm_powershell_script}
   #{format_data_disks_powershell_script}
+  #{custom_data_content}
   logoff
         EOH
       end
@@ -921,13 +962,30 @@ module Kitchen
           info "Using custom vnet: #{config[:vnet_id]}"
           virtual_machine_deployment_template_file("internal.erb", data.merge(
             vnet_id: config[:vnet_id],
-            subnet_id: config[:subnet_id],
+            subnet_ref: subnet_reference,
             public_ip: config[:public_ip],
             public_ip_sku: config[:public_ip_sku]
           ))
         end
       end
 
+      # Resource id of the subnet the network interface attaches to.
+      #
+      # +subnet_id+ has always held the subnet's *name*, resolved against
+      # +vnet_id+. The setting is named like a resource id and sits directly
+      # beside +vnet_id+, which really is one, so supplying a full subnet
+      # resource id is an easy mistake to make - and it used to be appended to
+      # the vnet id, leaving ARM to reject a path that appears nowhere in the
+      # user's kitchen.yml. Both spellings are accepted.
+      #
+      # @return [String]
+      def subnet_reference
+        subnet = config[:subnet_id].to_s
+        return subnet if subnet.start_with?("/subscriptions/")
+
+        "#{config[:vnet_id]}/subnets/#{subnet}"
+      end
+
       # Warns about settings that Azure retirements have made inoperable.
       #
       # @return [void]
@@ -975,9 +1033,33 @@ module Kitchen
 
       # The port(s) the configured transport connects on.
       #
-      # @return [Array<Integer>] 5985 and 5986 for WinRM, otherwise 22.
+      # The transport already knows which port it will dial, so a +port+ set on
+      # it is authoritative: assuming the default instead produced an instance
+      # nothing could reach, and left the user repeating the port in
+      # +open_ports+ to get in.
+      #
+      # WinRM keeps both standard ports regardless, because
+      # {#enable_winrm_powershell_script} creates both listeners whatever the
+      # transport was pointed at.
+      #
+      # @return [Array<Integer>]
       def transport_ports
-        instance.transport.name.to_s.casecmp("winrm") == 0 ? [5985, 5986] : [22]
+        configured = instance.transport[:port].to_i
+
+        if winrm_transport?
+          ([5985, 5986] + [configured]).reject(&:zero?).uniq
+        elsif configured == 0
+          [22]
+        else
+          [configured]
+        end
+      end
+
+      # Whether the instance is driven over WinRM.
+      #
+      # @return [Boolean]
+      def winrm_transport?
+        instance.transport.name.to_s.casecmp("winrm") == 0
       end
 
       # ARM security rules for the generated network security group.
@@ -1034,18 +1116,25 @@ module Kitchen
 
       # Base64-encoded custom data for the VM.
       #
-      # +custom_data+ may be either the literal content or a path to a file
-      # holding it.
-      #
       # @return [String, nil] nil when no +custom_data+ is configured.
       def prepared_custom_data
         return nil if config[:custom_data].nil?
 
-        @prepared_custom_data ||= if readable_file?(config[:custom_data])
-                                    Base64.strict_encode64(File.read(config[:custom_data]))
-                                  else
-                                    Base64.strict_encode64(config[:custom_data])
-                                  end
+        @prepared_custom_data ||= Base64.strict_encode64(custom_data_content)
+      end
+
+      # The configured custom data, as content.
+      #
+      # +custom_data+ may be either the literal content or a path to a file
+      # holding it, so this resolves whichever was given.
+      #
+      # @return [String] empty when no +custom_data+ is configured.
+      def custom_data_content
+        @custom_data_content ||= if readable_file?(config[:custom_data])
+                                   File.read(config[:custom_data])
+                                 else
+                                   config[:custom_data].to_s
+                                 end
       end
 
       private

data/lib/kitchen/driver/azurerm_version.rb

@@ -6,6 +6,6 @@ module Kitchen
     # driver and, with it, the whole Azure SDK.
     #
     # @return [String]
-    AZURERM_VERSION = "2.1.0".freeze
+    AZURERM_VERSION = "2.1.2".freeze
   end
 end

data/templates/internal.erb

@@ -176,13 +176,12 @@
         "location": "[parameters('location')]",
         "nicName": "[parameters('nicName')]",
         "nsgName": "[concat(parameters('nicName'), '-nsg')]",
-        "subnetName": "<%= subnet_id %>",
         "publicIPAddressName": "publicip",
         "vmName": "[parameters('vmName')]",
         "vmSize": "[parameters('vmSize')]",
         "vmIdentityType": "[if(parameters('systemAssignedIdentity'), if(empty(parameters('userAssignedIdentities')), 'SystemAssigned', 'SystemAssigned, UserAssigned'), if(empty(parameters('userAssignedIdentities')), 'None', 'UserAssigned'))]",
         "vnetID": "<%= vnet_id %>",
-        "subnetRef": "[concat(variables('vnetID'),'/subnets/',variables('subnetName'))]"
+        "subnetRef": "<%= subnet_ref %>"
     },
     "resources": [
         {

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kitchen-azurerm
 version: !ruby/object:Gem::Version
-  version: 2.1.0
+  version: 2.1.2
 platform: ruby
 authors:
 - Stuart Preston