7

What is the easiest way to get key rotation to work for azure storage accounts from a AzureDevOps relase task? The current plan is to re-generate the old key after release to invalidate it, and have a fresh key that can be used on next deployment. But to get that to work it seems like I at least need to store the name of the key to use in a release variable.

I had a look at he logging tasks (https://github.com/Microsoft/azure-pipelines-tasks/blob/master/docs/authoring/commands.md), but that only changes the value in the current release and does not modify the release definition.

Oddleif
  • 721
  • 3
  • 9
  • 32
  • 1
    Works, but only takes effect when all the stages in the release pipeline are completed. The predeployment script in the pipeline picks up the old value of the definition variables. – Chito Jan 21 '19 at 05:58

2 Answers2

24

You can use the REST API (Definitions - Update) to update the value of the release definition variable from a release task.

  1. Go to the Agent Phase and select Allow Scripts to Access OAuth Token. See Use the OAuth token to access the REST API
  2. Grant Project Collection Build Service (xxx) account the edit release pipeline permission. (Select the release pipeline --> ... --> Security --> Edit release definition set to Allow)
  3. Add a PowerShell task in your release pipeline

  4. Run inline script: (Update the value of variable v1030 in below sample)

    $url = "$($env:SYSTEM_TEAMFOUNDATIONSERVERURI)$env:SYSTEM_TEAMPROJECTID/_apis/Release/definitions/$($env:RELEASE_DEFINITIONID)?api-version=5.0-preview.3"
Write-Host "URL: $url"
$pipeline = Invoke-RestMethod -Uri $url -Headers @{
    Authorization = "Bearer $env:SYSTEM_ACCESSTOKEN"
}
Write-Host "Pipeline = $($pipeline | ConvertTo-Json -Depth 100)"

# Update an existing variable named v1030 to its new value 1035
$pipeline.variables.v1030.value = "1035"

####****************** update the modified object **************************
$json = @($pipeline) | ConvertTo-Json -Depth 99


$updatedef = Invoke-RestMethod -Uri $url -Method Put -Body $json -ContentType "application/json" -Headers @{Authorization = "Bearer $env:SYSTEM_ACCESSTOKEN"}

write-host "==========================================================" 
Write-host "The value of Varialbe 'v1030' is updated to" $updatedef.variables.v1030.value
write-host "=========================================================="

enter image description here

Andy Li-MSFT
  • 26,486
  • 2
  • 29
  • 47
  • It worked great for all my test releases, but the production release keeps throw 400 bad request when doing the PUT request to update the release definition. Any suggestions on what might be wrong here or how to figure out what is wrong? Even posting the original response without modifying it fails for this release definition... – Oddleif Oct 31 '18 at 09:55
  • @Andy Li-MSFT, above solution effects when all the tasks are completed in the stage. Do we have any alternative way to pass the values from one agent to another agent in same stage? – sree1611 Jan 10 '20 at 09:05
  • 1
    I am getting the error "##[error]The property 'value' cannot be found on this object. Verify that the property exists and can be set.", when i tried this approach. I hope we can set predefined variables using this script. I used the same variable 'v1030' in the script above. Not sure what i am missing...! – Sreekanth Mohan Apr 29 '20 at 18:04
1

Here is a much cleaner and better solution that also allows for multiple builds being triggered simultaneously. https://tsuyoshiushio.medium.com/how-to-pass-variables-with-pipeline-trigger-in-azure-pipeline-5771c5f18f91

Essentially your triggering build produces artifacts that your triggered build reads and turns into variables.

Still not at all great, but better than nothing and better than REST calls setting static global variable groups.

James Esh
  • 2,072
  • 1
  • 25
  • 40
  • I believe the OP is asking about release rather than build pipelines, which doesn't seem to offer this support – wolfyuk Mar 22 '22 at 08:53