Cosmos: Update key-based live tests to fixed self-owned accounts.

eng/pipelines/templates/jobs/live.tests.yml

@@ -28,6 +28,16 @@ parameters:
   type: boolean
 - name: PersistOidcToken
   type: boolean
+# When true, skips build-test-resource-config.yml/deploy-test-resources.yml (and thus any
+# per-run ARM deployment / Azure tenant auth) and runs PreTestRunSteps in their place. Used
+# by legs that test against fixed, self-owned accounts instead of resources deployed fresh
+# each run (see sdk/cosmos/pipeline/README.md for the motivating example).
+- name: DisableAzureResourceCreation
+  type: boolean
+  default: false
+- name: PreTestRunSteps
+  type: object
+  default: []
 
 jobs:
 - job:
@@ -70,29 +80,34 @@ jobs:
 
   - ${{ parameters.PreSteps }}
 
-  - template: /eng/common/TestResources/build-test-resource-config.yml
-    parameters:
-      SubscriptionConfiguration: ${{ parameters.CloudConfig.SubscriptionConfiguration }}
-      SubscriptionConfigurations: ${{ parameters.CloudConfig.SubscriptionConfigurations }}
-      SubscriptionConfigurationFilePaths: ${{ parameters.CloudConfig.SubscriptionConfigurationFilePaths }}
-      EnvVars:
-        Pool: $(Pool)
-        ${{insert}}: ${{ parameters.EnvVars }}
-
-  - template: /eng/common/TestResources/deploy-test-resources.yml
-    parameters:
-      ${{ if or(parameters.Location, parameters.CloudConfig.Location) }}:
-        Location: ${{ coalesce(parameters.Location, parameters.CloudConfig.Location) }}
-      ServiceDirectory: ${{ parameters.ServiceDirectory }}
-      SubscriptionConfiguration: $(SubscriptionConfiguration)
-      ArmTemplateParameters: $(ArmTemplateParameters)
-      UseFederatedAuth: ${{ parameters.UseFederatedAuth }}
-      ServiceConnection: ${{ parameters.CloudConfig.ServiceConnection }}
-      SubscriptionConfigurationFilePaths: ${{ parameters.CloudConfig.SubscriptionConfigurationFilePaths}}
-      PersistOidcToken: ${{ parameters.PersistOidcToken }}
-      EnvVars:
-        Pool: $(Pool)
-        ${{insert}}: ${{ parameters.EnvVars }}
+  - ${{ if not(parameters.DisableAzureResourceCreation) }}:
+    - template: /eng/common/TestResources/build-test-resource-config.yml
+      parameters:
+        SubscriptionConfiguration: ${{ parameters.CloudConfig.SubscriptionConfiguration }}
+        SubscriptionConfigurations: ${{ parameters.CloudConfig.SubscriptionConfigurations }}
+        SubscriptionConfigurationFilePaths: ${{ parameters.CloudConfig.SubscriptionConfigurationFilePaths }}
+        EnvVars:
+          Pool: $(Pool)
+          ${{insert}}: ${{ parameters.EnvVars }}
+
+    - template: /eng/common/TestResources/deploy-test-resources.yml
+      parameters:
+        ${{ if or(parameters.Location, parameters.CloudConfig.Location) }}:
+          Location: ${{ coalesce(parameters.Location, parameters.CloudConfig.Location) }}
+        ServiceDirectory: ${{ parameters.ServiceDirectory }}
+        SubscriptionConfiguration: $(SubscriptionConfiguration)
+        ArmTemplateParameters: $(ArmTemplateParameters)
+        UseFederatedAuth: ${{ parameters.UseFederatedAuth }}
+        ServiceConnection: ${{ parameters.CloudConfig.ServiceConnection }}
+        SubscriptionConfigurationFilePaths: ${{ parameters.CloudConfig.SubscriptionConfigurationFilePaths}}
+        PersistOidcToken: ${{ parameters.PersistOidcToken }}
+        EnvVars:
+          Pool: $(Pool)
+          ${{insert}}: ${{ parameters.EnvVars }}
+  - ${{ else }}:
+    # No ARM deployment and no Azure tenant auth for this leg - resolve a fixed,
+    # self-owned account instead (see sdk/cosmos/pipeline/README.md).
+    - ${{ parameters.PreTestRunSteps }}
 
   # To allow tests to run in parallel to Pack, we don't reuse the PackageInfo directory
   # from the Pack job. We just let each test leg create its own PackageInfo directory.
@@ -109,7 +124,7 @@ jobs:
   - ${{ if parameters.UseFederatedAuth }}:
     - task: AzurePowerShell@5
       displayName: "Test Packages - Federated Auth"
-      condition: and(succeeded(), eq(variables['CI_HAS_DEPLOYED_RESOURCES'], 'true'))
+      condition: and(succeeded(), or(eq(variables['CI_HAS_DEPLOYED_RESOURCES'], 'true'), eq(${{ parameters.DisableAzureResourceCreation }}, true)))
       timeoutInMinutes: ${{ parameters.TimeoutInMinutes }}
       env:
         CIBW_BUILD_VERBOSITY: 3
@@ -137,7 +152,7 @@ jobs:
   - ${{ else }}:
     - task: Powershell@2
       displayName: "Test Packages"
-      condition: and(succeeded(), eq(variables['CI_HAS_DEPLOYED_RESOURCES'], 'true'))
+      condition: and(succeeded(), or(eq(variables['CI_HAS_DEPLOYED_RESOURCES'], 'true'), eq(${{ parameters.DisableAzureResourceCreation }}, true)))
       timeoutInMinutes: ${{ parameters.TimeoutInMinutes }}
       env:
         CIBW_BUILD_VERBOSITY: 3
@@ -152,14 +167,14 @@ jobs:
 
   - task: Powershell@2
     displayName: Convert Test Results to JUnit XML
-    condition: and(succeededOrFailed(), eq(variables['CI_HAS_DEPLOYED_RESOURCES'], 'true'))
+    condition: and(succeededOrFailed(), or(eq(variables['CI_HAS_DEPLOYED_RESOURCES'], 'true'), eq(${{ parameters.DisableAzureResourceCreation }}, true)))
     inputs:
       pwsh: true
       filePath: $(Build.SourcesDirectory)/eng/scripts/Convert-TestResultsToJUnit.ps1
 
   - task: PublishTestResults@2
     displayName: Publish Test Results
-    condition: and(succeededOrFailed(), eq(variables['CI_HAS_DEPLOYED_RESOURCES'], 'true'), eq(variables['HasJUnitTestResults'], 'true'))
+    condition: and(succeededOrFailed(), or(eq(variables['CI_HAS_DEPLOYED_RESOURCES'], 'true'), eq(${{ parameters.DisableAzureResourceCreation }}, true)), eq(variables['HasJUnitTestResults'], 'true'))
     inputs:
       testResultsFormat: JUnit
       testResultsFiles: '**/test-results/junit/*.xml'

eng/pipelines/templates/stages/archetype-sdk-client.yml

@@ -52,6 +52,21 @@ parameters:
     Selection: sparse
     NonSparseParameters: RustToolchainName
     GenerateVMJobs: true
+# A second, independent set of live-test matrix configs for legs that test against fixed,
+# self-owned resources instead of resources deployed fresh each run. Unlike
+# LiveTestMatrixConfigs, jobs generated from these configs skip ARM deployment entirely
+# (DisableAzureResourceCreation: true) and run PreTestRunSteps in its place, with
+# UseFederatedAuth forced off since no Azure tenant auth is needed. See
+# sdk/cosmos/pipeline/README.md for the motivating example.
+- name: FixedAccountMatrixConfigs
+  type: object
+  default: []
+# Steps to run instead of ARM deployment for jobs generated from FixedAccountMatrixConfigs
+# (e.g. resolving a fixed account's endpoint/key from a secret). Ignored if
+# FixedAccountMatrixConfigs is empty.
+- name: PreTestRunSteps
+  type: object
+  default: []
 - name: AdditionalMatrixConfigs
   type: object
   default: []
@@ -171,6 +186,39 @@ extends:
                     SubscriptionConfigurations: ${{ cloud.value.SubscriptionConfigurations }}
                     SubscriptionConfigurationFilePaths: ${{ cloud.value.SubscriptionConfigurationFilePaths }}
 
+              - ${{ if ne(length(parameters.FixedAccountMatrixConfigs), 0) }}:
+                - template: /eng/common/pipelines/templates/jobs/generate-job-matrix.yml
+                  parameters:
+                    GenerateJobName: generate_job_matrix_fixed_account
+                    JobTemplatePath: /eng/pipelines/templates/jobs/live.tests.yml
+                    AdditionalParameters:
+                      ServiceDirectory: ${{ parameters.ServiceDirectory }}
+                      TimeoutInMinutes: ${{ parameters.TestTimeoutInMinutes }}
+                      EnvVars: ${{ parameters.EnvVars }}
+                      PreSteps: ${{ parameters.PreSteps }}
+                      PostSteps: ${{ parameters.PostSteps }}
+                      Location: ${{ parameters.Location }}
+                      # Fixed, self-owned accounts need no Azure tenant auth at all.
+                      UseFederatedAuth: false
+                      PersistOidcToken: false
+                      DisableAzureResourceCreation: true
+                      PreTestRunSteps: ${{ parameters.PreTestRunSteps }}
+                    MatrixConfigs:
+                    - ${{ parameters.FixedAccountMatrixConfigs }}
+                    MatrixFilters:
+                    - ${{ cloud.value.MatrixFilters }}
+                    - ${{ parameters.MatrixFilters }}
+                    MatrixReplace:
+                    - ${{ cloud.value.MatrixReplace }}
+                    - ${{ parameters.MatrixReplace }}
+                    CloudConfig:
+                      Cloud: ${{ cloud.key }}
+                      Location: ${{ coalesce(cloud.value.Location, parameters.Location) }}
+                      ServiceConnection: ${{ coalesce(cloud.value.ServiceConnection, lower(format('azure-sdk-tests-{0}', cloud.key))) }}
+                      SubscriptionConfiguration: ${{ cloud.value.SubscriptionConfiguration }}
+                      SubscriptionConfigurations: ${{ cloud.value.SubscriptionConfigurations }}
+                      SubscriptionConfigurationFilePaths: ${{ cloud.value.SubscriptionConfigurationFilePaths }}
+
     # The Prerelease and Release stages are conditioned on:
     # 1. Internal trigger, not Pull Request trigger
     # 2. Not weekly build

sdk/cosmos/ci.yml

@@ -76,11 +76,31 @@ extends:
         Path: sdk/cosmos/inmemory-emulator-matrix.json
         Selection: all
         GenerateVMJobs: true
-    LiveTestMatrixConfigs:
+    # Cosmos_live_test runs against fixed, self-owned accounts (see
+    # sdk/cosmos/pipeline/README.md) instead of resources deployed fresh each run,
+    # so it lives in FixedAccountMatrixConfigs rather than LiveTestMatrixConfigs.
+    # PreTestRunSteps resolves the account selected by each matrix leg's
+    # AccountSelector from the rust-ci secret, in place of
+    # ARM deployment (DisableAzureResourceCreation: true is set automatically for
+    # this leg by archetype-sdk-client.yml).
+    FixedAccountMatrixConfigs:
       - Name: Cosmos_live_test
         Path: sdk/cosmos/live-platform-matrix.json
         Selection: sparse
         GenerateVMJobs: true
+    PreTestRunSteps:
+      - template: /sdk/cosmos/pipeline/resolve-test-account-steps.yml
+        parameters:
+          AccountSelector: $(AccountSelector)
+    LiveTestMatrixConfigs:
+      # Thin-client (GatewayV2) legs still use ARM-deployed per-run Cosmos
+      # accounts (they run against $(thinclient-test-endpoint)/$(thinclient-test-key)
+      # for the thin-client itself, but their primary client still needs an
+      # ARM-provisioned account). Left on the legacy per-run path intentionally.
+      - Name: Cosmos_live_thinclient
+        Path: sdk/cosmos/live-thinclient-matrix.json
+        Selection: all
+        GenerateVMJobs: true
       # Dedicated live leg that runs the full integration suite with the primary
       # (data-plane) client authenticated via Entra ID (AAD) instead of the
       # account key. `AZURE_COSMOS_AUTH_MODE=aad` surfaces as a job env var and

sdk/cosmos/live-platform-matrix.json

@@ -18,42 +18,29 @@
     "RustToolchainName": ["stable"],
     "Account Settings": {
       "Eventual SingleWrite": {
-        "ArmTemplateParameters": "@{ defaultConsistencyLevel = 'Eventual'; enableAutomaticFailover = $false; enableContinuousBackup = $true }"
+        "ArmTemplateParameters": "@{ defaultConsistencyLevel = 'Eventual'; enableAutomaticFailover = $false; enableContinuousBackup = $true }",
+        "AccountSelector": "eventual-singlewrite"
       },
       "Session SingleWrite": {
-        "ArmTemplateParameters": "@{ defaultConsistencyLevel = 'Session'; enableAutomaticFailover = $false; enableContinuousBackup = $true }"
+        "ArmTemplateParameters": "@{ defaultConsistencyLevel = 'Session'; enableAutomaticFailover = $false; enableContinuousBackup = $true }",
+        "AccountSelector": "session-singlewrite"
       },
       "Strong SingleWrite": {
-        "ArmTemplateParameters": "@{ defaultConsistencyLevel = 'Strong'; enableAutomaticFailover = $false; enableContinuousBackup = $true }"
+        "ArmTemplateParameters": "@{ defaultConsistencyLevel = 'Strong'; enableAutomaticFailover = $false; enableContinuousBackup = $true }",
+        "AccountSelector": "strong-singlewrite"
       },
       "Session MultiWrite": {
-        "ArmTemplateParameters": "@{ defaultConsistencyLevel = 'Session'; enableMultipleWriteLocations = $true; enableAutomaticFailover = $false; testCategory = 'multi_write'; enableMultipleRegions = $true }"
+        "ArmTemplateParameters": "@{ defaultConsistencyLevel = 'Session'; enableMultipleWriteLocations = $true; enableAutomaticFailover = $false; testCategory = 'multi_write'; enableMultipleRegions = $true }",
+        "AccountSelector": "session-multiwrite"
       },
       "Session Split": {
-        "ArmTemplateParameters": "@{ defaultConsistencyLevel = 'Session'; enableAutomaticFailover = $false; testCategory = 'split'; enableContinuousBackup = $true }"
+        "ArmTemplateParameters": "@{ defaultConsistencyLevel = 'Session'; enableAutomaticFailover = $false; testCategory = 'split'; enableContinuousBackup = $true }",
+        "AccountSelector": "session-split"
       },
       "Session SingleWrite MultiRegion PartitionFailover": {
-        "ArmTemplateParameters": "@{ defaultConsistencyLevel = 'Session'; enableAutomaticFailover = $true; enableMultipleRegions = $true; testCategory = 'multi_region' }"
+        "ArmTemplateParameters": "@{ defaultConsistencyLevel = 'Session'; enableAutomaticFailover = $true; enableMultipleRegions = $true; testCategory = 'multi_region' }",
+        "AccountSelector": "session-mr-failover"
       }
     }
-  },
-  "include": [
-    {
-      "Agent": {
-        "ubuntu": {
-          "OSVmImage": "env:LINUXVMIMAGE",
-          "Pool": "env:LINUXPOOL"
-        }
-      },
-      "RustToolchainName": ["stable"],
-      "Account Settings": {
-        "Session SingleRegion GatewayV2": {
-          "ArmTemplateParameters": "@{ defaultConsistencyLevel = 'Session'; testCategory = 'gateway_v2' }"
-        },
-        "Session MultiRegion GatewayV2": {
-          "ArmTemplateParameters": "@{ defaultConsistencyLevel = 'Session'; enableMultipleRegions = $true; testCategory = 'gateway_v2_multi_region' }"
-        }
-      }
-    }
-  ]
+  }
 }

sdk/cosmos/live-thinclient-matrix.json

@@ -0,0 +1,20 @@
+{
+  "displayNames": {},
+  "matrix": {
+    "Agent": {
+      "ubuntu": {
+        "OSVmImage": "env:LINUXVMIMAGE",
+        "Pool": "env:LINUXPOOL"
+      }
+    },
+    "RustToolchainName": ["stable"],
+    "Account Settings": {
+      "Session SingleRegion GatewayV2": {
+        "ArmTemplateParameters": "@{ defaultConsistencyLevel = 'Session'; testCategory = 'gateway_v2' }"
+      },
+      "Session MultiRegion GatewayV2": {
+        "ArmTemplateParameters": "@{ defaultConsistencyLevel = 'Session'; enableMultipleRegions = $true; testCategory = 'gateway_v2_multi_region' }"
+      }
+    }
+  }
+}