azure-pipelines.yml

pool:
  vmImage: 'ubuntu-latest'

variables:
  terraformVersion: '1.6.6'
  azureSubscription: 'sp-proj-cs'
  tfStateRG: 'tfstate'
  tfStateStorage: 'chaosstatestorage'
  tfStateContainer: 'cstfstate'
  tfStateKey: 'terraform.tfstate'

stages:
- stage: Init
  displayName: 'Terraform Init'
  jobs:
    - job: InitJob
      displayName: 'Init Job'
      steps:
        - checkout: self
          persistCredentials: true

        - script: |
            echo "Installing Terraform $(terraformVersion)..."
            wget https://releases.hashicorp.com/terraform/$(terraformVersion)/terraform_$(terraformVersion)_linux_amd64.zip
            unzip terraform_$(terraformVersion)_linux_amd64.zip
            sudo mv terraform /usr/local/bin/
            terraform --version
          displayName: 'Install Terraform'

        - script: |
            echo "Removing old Azure CLI..."
            sudo apt-get remove -y azure-cli

            echo "Installing dependencies..."
            sudo apt-get update
            sudo apt-get install -y ca-certificates curl apt-transport-https lsb-release gnupg

            echo "Adding Microsoft package signing key to keyring..."
            sudo mkdir -p /etc/apt/keyrings
            curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | sudo tee /etc/apt/keyrings/microsoft.gpg > /dev/null

            echo "Adding Azure CLI repository..."
            AZ_REPO=$(lsb_release -cs)
            echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/microsoft.gpg] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" | sudo tee /etc/apt/sources.list.d/azure-cli.list

            echo "Installing latest Azure CLI..."
            sudo apt-get update
            sudo apt-get install -y azure-cli

            echo "Azure CLI version after upgrade:"
            az --version
          displayName: 'Install Latest Azure CLI'

        - task: AzureCLI@2
          displayName: 'Temporarily Open Storage Account for Init'
          inputs:
            azureSubscription: $(azureSubscription)
            scriptType: bash
            scriptLocation: inlineScript
            inlineScript: |
              echo "Setting public access temporarily..."
              az storage account update \
                --name ${{ variables.tfStateStorage }} \
                --resource-group ${{ variables.tfStateRG }} \
                --default-action Allow

              echo "Waiting for firewall rule propagation..."
              sleep 30

        - script: |
            echo "Terraform Init"

            export ARM_CLIENT_ID=$(servicePrincipalId)
            export ARM_CLIENT_SECRET=$(servicePrincipalKey)
            export ARM_TENANT_ID=$(tenantId)
            export ARM_SUBSCRIPTION_ID=$(subscriptionId)
            export AZURE_STORAGE_AUTH_MODE=login

            terraform init \
              -backend-config="resource_group_name=$(tfStateRG)" \
              -backend-config="storage_account_name=$(tfStateStorage)" \
              -backend-config="container_name=$(tfStateContainer)" \
              -backend-config="key=$(tfStateKey)"
          displayName: 'Terraform Init'

- stage: Plan
  displayName: 'Terraform Plan'
  dependsOn: Init
  jobs:
    - job: PlanJob
      displayName: 'Plan Job'
      steps:
        - checkout: self
          persistCredentials: true

        - script: |
            echo "Installing Terraform $(terraformVersion)..."
            wget https://releases.hashicorp.com/terraform/$(terraformVersion)/terraform_$(terraformVersion)_linux_amd64.zip
            unzip terraform_$(terraformVersion)_linux_amd64.zip
            sudo mv terraform /usr/local/bin/
            terraform --version
          displayName: 'Install Terraform'

        - script: |
            echo "Getting Azure DevOps agent IP..."
            agent_ip=$(curl -s https://api.ipify.org)
            echo "##vso[task.setvariable variable=agent_ip]$agent_ip"
          displayName: 'Get Agent Public IP'

        - script: |
            echo "Terraform Plan"
            export ARM_CLIENT_ID=$(servicePrincipalId)
            export ARM_CLIENT_SECRET=$(servicePrincipalKey)
            export ARM_SUBSCRIPTION_ID=$(subscriptionId)
            export ARM_TENANT_ID=$(tenantId)
            export AZURE_STORAGE_AUTH_MODE=login

            terraform init \
              -backend-config="resource_group_name=$(tfStateRG)" \
              -backend-config="storage_account_name=$(tfStateStorage)" \
              -backend-config="container_name=$(tfStateContainer)" \
              -backend-config="key=$(tfStateKey)"

            terraform plan \
              -var="subscription_id=$(subscriptionId)" \
              -var="agent_ip=$(agent_ip)" \
              -var-file="env.tfvars" \
              -out=tfplan
          displayName: 'Terraform Plan'

        - script: |
            echo "Extracting predicted Key Vault name from Terraform plan..."
            terraform show -json tfplan > tfplan.json

            kv_name=$(jq -r '
              .planned_values.root_module.resources[]
              | select(.type == "azurerm_key_vault")
              | .values.name' tfplan.json)

            echo "Predicted Key Vault name: $kv_name"
            echo "##vso[task.setvariable variable=tfKeyVault]$kv_name"
          displayName: 'Extract Key Vault Name from Plan'

        - publish: tfplan
          artifact: terraformPlan
        
        - task: AzureCLI@2
          displayName: 'Lock Storage Account Again'
          condition: always()
          inputs:
            azureSubscription: $(azureSubscription)
            scriptType: bash
            scriptLocation: inlineScript
            inlineScript: |
              echo "Locking down Storage Account again..."
              az storage account update \
                --name ${{ variables.tfStateStorage }} \
                --resource-group ${{ variables.tfStateRG }} \
                --default-action Deny

- stage: Apply
  displayName: 'Terraform Apply'
  dependsOn: Plan
  jobs:
    - job: ApplyJob
      displayName: 'Apply Job'
      steps:
        - checkout: self
          persistCredentials: true
        - task: AzureCLI@2
          displayName: 'Temporarily Open Storage Account for Apply'
          inputs:
            azureSubscription: $(azureSubscription)
            scriptType: bash
            scriptLocation: inlineScript
            inlineScript: |
              echo "Temporarily allowing public access for Storage Account..."
              az storage account update \
                --name ${{ variables.tfStateStorage }} \
                --resource-group ${{ variables.tfStateRG }} \
                --default-action Allow
              echo "Temporarily allowing public access for Key Vault..."
              az keyvault update \
                --name $(tfKeyVault) \
                --resource-group ${{ variables.tfStateRG }} \
                --public-network-access Enabled
              echo "Waiting 30 seconds for Firewall and Key Vault rule propagation..."
              sleep 30

        - script: |
            echo "Installing Terraform $(terraformVersion)..."
            wget https://releases.hashicorp.com/terraform/$(terraformVersion)/terraform_$(terraformVersion)_linux_amd64.zip
            unzip terraform_$(terraformVersion)_linux_amd64.zip
            sudo mv terraform /usr/local/bin/
            terraform --version
          displayName: 'Install Terraform'

        - task: DownloadPipelineArtifact@2
          displayName: 'Download Terraform Plan Artifact'
          inputs:
            buildType: 'current'
            artifactName: 'terraformPlan'
            targetPath: '$(Pipeline.Workspace)/terraformPlan'
          
        - script: |
            echo "Getting Azure DevOps agent IP..."
            agent_ip=$(curl -s https://api.ipify.org)
            echo "##vso[task.setvariable variable=agent_ip]$agent_ip"
          displayName: 'Get Agent Public IP'  

        - task: AzureCLI@2
          displayName: 'Ensure Microsoft.Chaos Provider is Registered'
          inputs:
            azureSubscription: $(azureSubscription)
            scriptType: bash
            scriptLocation: inlineScript
            inlineScript: |
              echo "Checking Chaos provider registration..."
              state=$(az provider show --namespace Microsoft.Chaos --query "registrationState" -o tsv)
              if [ "$state" != "Registered" ]; then
              echo "Chaos provider not registered. Registering now..."
              az provider register --namespace Microsoft.Chaos
              echo "Waiting for Chaos provider to register..."
              for i in {1..10}; do
              sleep 10
              state=$(az provider show --namespace Microsoft.Chaos --query "registrationState" -o tsv)
              echo "Current state: $state"
              if [ "$state" == "Registered" ]; then
                echo "Chaos provider successfully registered."
              break
              fi
              done
              else
                echo "Chaos provider is already registered."
              fi

        - script: |
            echo "Terraform Apply"
            export ARM_CLIENT_ID=$(servicePrincipalId)
            export ARM_CLIENT_SECRET=$(servicePrincipalKey)
            export ARM_SUBSCRIPTION_ID=$(subscriptionId)
            export ARM_TENANT_ID=$(tenantId)
            export AZURE_STORAGE_AUTH_MODE=login

            terraform init \
              -backend-config="resource_group_name=$(tfStateRG)" \
              -backend-config="storage_account_name=$(tfStateStorage)" \
              -backend-config="container_name=$(tfStateContainer)" \
              -backend-config="key=$(tfStateKey)"

            terraform apply \
              "$(Pipeline.Workspace)/terraformPlan/tfplan"
          displayName: 'Terraform Apply'

        - script: |
            echo "Waiting 30 seconds before locking down storage..."
            sleep 30
          displayName: 'Delay Before Lockdown'

        - task: AzureCLI@2
          displayName: 'Lock Storage Account Again After Apply'
          condition: always()
          inputs:
            azureSubscription: $(azureSubscription)
            scriptType: bash
            scriptLocation: inlineScript
            inlineScript: |
              echo "Locking down Storage Account after Apply..."
              az storage account update \
                --name ${{ variables.tfStateStorage }} \
                --resource-group ${{ variables.tfStateRG }} \
                --default-action Deny

        - task: AzureCLI@2
          displayName: 'Lock Key Vault After Apply'
          condition: always()
          inputs:
            azureSubscription: $(azureSubscription)
            scriptType: bash
            scriptLocation: inlineScript
            inlineScript: |
              echo "Locking Key Vault after Apply..."
              az keyvault update \
                --name $(tfKeyVault) \
                --resource-group ${{ variables.tfStateRG }} \
                --public-network-access Disabled