Author : HASSAN MD TAREQ | Updated : 2021/10/22

Prepare Pulumi Backend and Pulumi Project

In this article, for Pulumi backend

The whole process of preparing backend and creating project is described here: /pulumi/using-azure-blog-storage-as-backend.
(Make sure that you test once from your local machine before setting up Azure DevOps pipeline)

Check Service Principal Role

If service principal is created and roles are assigned according to the previous section (“Prepare Pulumi Backend and Pulumi Project”) of this article, then skip this section. Otherwise make sure that required roles are assigned to the service principal mentioned that the service principal credential will be used for:

Contributor role of service principal at susbcription scope

Key Vault Administrator role of service principal at KeyVault scope

Notes:

Prepare DevOps Project and Repository

git remote add origin git@ssh.dev.azure.com:v3/<org-name>/<project-name>/<repository-name>
git push -u origin --all

Create Service Connection

See:

pool:
  vmImage: 'ubuntu-latest'

variables:
- group: "pulumi-demo-vg" # linking variable group at root level so that all stages can use it

# ... ... ...

Create Pipeline

PipelineTemplates/pulumi-task.yml

parameters:
- name: command
  type: string
- name: stack
  type: string
  default: dev

steps:
- task: Pulumi@1
  inputs:
    azureSubscription: 'xxx-sc' # sc -> service connection
    command: $
    loginArgs: 'azblob://pulumi-backend-container'
    args: '--yes'
    stack: $
  env:
    AZURE_STORAGE_ACCOUNT: $(AZURE-STORAGE-ACCOUNT)
    AZURE_STORAGE_KEY: $(AZURE-STORAGE-KEY)
    AZURE_CLIENT_ID: $(AZURE-CLIENT-ID)
    AZURE_CLIENT_SECRET: $(AZURE-CLIENT-SECRET)
    AZURE_TENANT_ID: $(AZURE-TENANT-ID)

azure-pipelines.yml

# trigger:
# - master

#
# Agent pool
#
pool:
  vmImage: 'ubuntu-latest'

#
# Import KeyVault secrets by linking Variable Group
#
variables:
- group: "demo-vg"
- name: TestVar
  value: This is test variable at root level

stages:
#
# Deploy Stack -----------------------------------------------------------------------------------------------------------
#
- stage: PulumiUpStage
  displayName: Stack Deployment Stage
  dependsOn: []
  jobs:
  - job: PulumiUpJob
    displayName: Stack Deployment Job
    continueOnError: false
    steps:
    - task: UseDotNet@2
      displayName: 'Use .NET 6.0 sdk'
      inputs:
        packageType: 'sdk'
        version: '6.0.x'
        includePreviewVersions: true
    - template: PipelineTemplates/pulumi-task.yml
      parameters: 
        command: up
#
# Destroy Stack ---------------------------------------------------------------------------------------------------------------------------------
#
- stage: PulumiDestroyStage
  displayName: Pulumi Destroy Stage
  dependsOn: []
  jobs:
  - job: PulumiDestroyJob
    displayName: Pulumi Destroy Job
    steps:
    - template: PipelineTemplates/pulumi-task.yml
      parameters: 
        command: destroy

Allow Pipeline to Use Service Connection

Allow pipeline to use service connection

Test Pipeline