Skip to main content

Make steps conditional in multi-stage YAML pipelines

To make the switch from the graphical release pipelines in Azure DevOps I am missing two features. The first one is to be able to defer a deploy and the second one is to exclude certain deployment steps without the need for editing the YAML file. 

The defer option is something Microsoft has to solve in their Azure DevOps proposition. It's a feature which you have in the graphical release pipeline but what they have not implemented yet in their YAML pipeline replacement. Approvals and certain gate conditions are implemented on the environment but the defer option is still missing

Pipeline

The conditional deployment option can be implemented with the help of runtime parameters and expressions. In the parameter section you define boolean parameters which will control the deploy behavior. With the expressions you can control which stage/job/task should be executed when the pipeline runs.

In the below YAML sample I experimented with conditions in the azure-pipelines.yml file directly for the CI phase and for the CD phase I used the templated solution I posted earlier about. In that case I have to passthrough the collected deployment instructions collected in the UI (or use the default values). To keep the templates generic I construct an object to passthrough the information to the correct job template which know how to use the deployment sequence logic.

# Build numbering format
name: $(BuildDefinitionName).$(Year:yy)$(DayOfYear)$(rev:.r)

parameters:

- name: deployArtifact1
  displayName: 'Deploy: Artifact 1'
  type: boolean
  default: true

- name: deployArtifact2
  displayName: 'Deploy: Artifact 2'
  type: boolean
  default: false

- name: deployArtifact3
  displayName: 'Deploy: Artifact 3'
  type: boolean
  default: true

# Pipeline trigger
trigger: none # Opt out of CI triggers

stages:

# CI phase
- stage: ci
  displayName: Build
  jobs:
  - job: validateAndPackage
    displayName: 'Conditional building'
    steps:
    - checkout: none # Suppress check out source code

    # Build sequence
    - ${{ if eq(parameters.deployArtifact1, true) }}:
      - task: CmdLine@2
        displayName: 'Build 1'
        inputs:
          script: echo pipeline level - building 1 - ${{ parameters.deployArtifact1 }}

    - ${{ if eq(parameters.deployArtifact2, true) }}:
      - task: CmdLine@2
        displayName: 'Build 2'
        inputs:
          script: echo pipeline level - building 2 - ${{ parameters.deployArtifact2 }}

    - ${{ if eq(parameters.deployArtifact3, true) }}:
      - task: CmdLine@2
        displayName: 'Build 3'
        inputs:
          script: echo pipeline level - building 3 - ${{ parameters.deployArtifact3 }}

# CD phase
- template: cd-stage.yml
  parameters:
    artifactObject:
      artifact1: ${{ parameters.deployArtifact1 }}
      artifact2: ${{ parameters.deployArtifact2 }}
      artifact3: ${{ parameters.deployArtifact3 }}

Stage template

As described in the pipeline section the stage receives an object with the collected information and it is only passing through the object to the job template.

# cd-stages.yml

parameters:

# Indicates which artifacts to deploy
- name: artifactObject
  type: object

stages:

  # CD phase - deploy only feature branches
  - stage: cd
    displayName: Deploy
    jobs:
    - template: cd-job.yml
      parameters:
        artifactObject: ${{ parameters.artifactObject }}

Job template

This simplified job template receives the instructions for the deployment sequence via the artifactObject parameter. In the condition expressions for each task we check if the task has to be executed.

# cd-job.yml

parameters:

# Indicates which artifacts to deploy
- name: artifactObject
  type: object

jobs:
- deployment: deploy
  displayName: 'Conditional deployment'
  pool:
    name: Default
  environment: Sandbox
  strategy:
    runOnce:
      deploy:
        steps:
          - checkout: none # Suppress check out source code

          # Deploy sequence
          - ${{ if eq(parameters.artifactObject.artifact1, true) }}:
            - task: CmdLine@2
              displayName: 'Deploy 1'
              inputs:
                script: echo job level - deploying 1 - ${{ parameters.artifactObject.artifact1 }}

          - ${{ if eq(parameters.artifactObject.artifact2, true) }}:
            - task: CmdLine@2
              displayName: 'Deploy 2'
              inputs:
                script: echo job level - deploying 2 - ${{ parameters.artifactObject.artifact2 }}

          - ${{ if eq(parameters.artifactObject.artifact3, true) }}:
            - task: CmdLine@2
              displayName: 'Deploy 3'
              inputs:
                script: echo job level - deploying 3 - ${{ parameters.artifactObject.artifact3 }}

Comments

Popular posts from this blog

Permantly delete an AD object

At the moment I am busy with PowerShell DSC scripts that also create objects within the Active Directory. Because it's work in progress you have to delete those objects regularly. Witin this sandbox environment the recycle bin feature is enabled so the objects are kept 30 days.  To permantly delete such objects (so you have a clean testing situation) you can use the following PowerShell command. Get-ADObject -filter {sAMAccountName -eq "<name of object>$"} -includeDeletedObjects -property * | Remove-ADObject

Solving Azure DevOps Workload Identity Federation service connection 50 minute time-out error

 When connecting to external resources like Azure Resource Manager you will need a service connection in Azure DevOps. Normally I utilize a service principal for this purpose. The certificate issued by Microsoft Entra ID was normally valid for two years but Microsoft changed this to three months in the release of January 18th and is promoting the usage of Workload identity federation  (WIF). When testing this WIF based service connection I noticed that the OIDC token is only valid for about 50 minutes. This time is to short for the PowerShell script I use to monitor the Azure Image Builder image builds. These image build processes can take up to four hours but fail now with an error message like the one below. A configuration issue is preventing authentication - check the error message from the server for details. You can modify the configuration in the application registration portal. See https://aka.ms/msal-net-invalid-client for details.  Original exception: AADSTS700...