Skip to content

Commit 7d70753

Browse files
cormacpaynecormacpayne
authored
Merge pull request Azure#4400 from dragav/feature/updates4aug
[KeyVault] adding soft-delete support for KeyVault certificates
2 parents 4eca069 + b71b908 commit 7d70753

File tree

74 files changed

+1644
-830
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

74 files changed

+1644
-830
lines changed

‎src/ResourceManager/KeyVault/AzureRM.KeyVault.psd1‎

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -87,29 +87,39 @@ CmdletsToExport = 'Add-AzureKeyVaultCertificate',
8787
'Remove-AzureKeyVaultCertificateIssuer',
8888
'Remove-AzureKeyVaultCertificateOperation',
8989
'Set-AzureKeyVaultCertificateIssuer',
90-
'Set-AzureKeyVaultCertificatePolicy', 'Get-AzureRmKeyVault',
91-
'New-AzureRmKeyVault', 'Remove-AzureRmKeyVault',
92-
'Undo-AzureRmKeyVaultRemoval', 'Remove-AzureRmKeyVaultAccessPolicy',
93-
'Set-AzureRmKeyVaultAccessPolicy', 'Backup-AzureKeyVaultKey',
94-
'Get-AzureKeyVaultKey', 'Get-AzureKeyVaultSecret',
95-
'Undo-AzureKeyVaultKeyRemoval', 'Undo-AzureKeyVaultSecretRemoval',
96-
'Add-AzureKeyVaultKey', 'Remove-AzureKeyVaultKey',
97-
'Remove-AzureKeyVaultSecret', 'Restore-AzureKeyVaultKey',
98-
'Set-AzureKeyVaultKeyAttribute', 'Set-AzureKeyVaultSecret',
90+
'Set-AzureKeyVaultCertificatePolicy',
91+
'Get-AzureRmKeyVault',
92+
'New-AzureRmKeyVault',
93+
'Remove-AzureRmKeyVault',
94+
'Undo-AzureRmKeyVaultRemoval',
95+
'Remove-AzureRmKeyVaultAccessPolicy',
96+
'Set-AzureRmKeyVaultAccessPolicy',
97+
'Backup-AzureKeyVaultKey',
98+
'Get-AzureKeyVaultKey',
99+
'Get-AzureKeyVaultSecret',
100+
'Undo-AzureKeyVaultKeyRemoval',
101+
'Undo-AzureKeyVaultSecretRemoval',
102+
'Add-AzureKeyVaultKey',
103+
'Remove-AzureKeyVaultKey',
104+
'Remove-AzureKeyVaultSecret',
105+
'Restore-AzureKeyVaultKey',
106+
'Set-AzureKeyVaultKeyAttribute',
107+
'Set-AzureKeyVaultSecret',
99108
'Set-AzureKeyVaultSecretAttribute',
100109
'Get-AzureKeyVaultCertificatePolicy',
101110
'New-AzureKeyVaultCertificateAdministratorDetails',
102111
'New-AzureKeyVaultCertificateOrganizationDetails',
103-
'Backup-AzureKeyVaultSecret', 'Restore-AzureKeyVaultSecret',
112+
'Backup-AzureKeyVaultSecret',
113+
'Restore-AzureKeyVaultSecret',
104114
'Get-AzureKeyVaultManagedStorageAccount',
105115
'Add-AzureKeyVaultManagedStorageAccount',
106116
'Remove-AzureKeyVaultManagedStorageAccount',
107117
'Update-AzureKeyVaultManagedStorageAccount',
108118
'Update-AzureKeyVaultManagedStorageAccountKey',
109119
'Get-AzureKeyVaultManagedStorageSasDefinition',
110120
'Set-AzureKeyVaultManagedStorageSasDefinition',
111-
'Remove-AzureKeyVaultManagedStorageSasDefinition'
112-
121+
'Remove-AzureKeyVaultManagedStorageSasDefinition',
122+
'Undo-AzureKeyVaultCertificateRemoval'
113123
# Variables to export from this module
114124
# VariablesToExport = @()
115125

‎src/ResourceManager/KeyVault/ChangeLog.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,10 @@
2424
## Version 3.3.0
2525

2626
## Version 3.2.1
27+
* New/updated Cmdlets to support soft-delete for KeyVault certificates
28+
* Get-AzureKeyVaultCertificate
29+
* Remove-AzureKeyVaultCertificate
30+
* Undo-AzureKeyVaultCertificateRemoval
2731

2832
## Version 3.2.0
2933
* Remove email address from the directory query when -UserPrincipalName is specified to the Set-AzureRMKeyVaultAccessPolicy and Remove-AzureRMKeyVaultAccessPolicy cmdlets.

‎src/ResourceManager/KeyVault/Commands.KeyVault.Test/Commands.KeyVault.Test.csproj‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -65,12 +65,12 @@
6565
<Reference Include="Microsoft.Azure.Graph.RBAC">
6666
<HintPath>..\..\..\packages\Microsoft.Azure.Graph.RBAC.3.4.0-preview\lib\net452\Microsoft.Azure.Graph.RBAC.dll</HintPath>
6767
</Reference>
68-
<Reference Include="Microsoft.Azure.KeyVault, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
69-
<HintPath>..\..\..\packages\Microsoft.Azure.KeyVault.2.3.0-preview\lib\net452\Microsoft.Azure.KeyVault.dll</HintPath>
68+
<Reference Include="Microsoft.Azure.KeyVault">
69+
<HintPath>..\..\..\packages\Microsoft.Azure.KeyVault.2.3.2\lib\net452\Microsoft.Azure.KeyVault.dll</HintPath>
7070
<Private>True</Private>
7171
</Reference>
72-
<Reference Include="Microsoft.Azure.KeyVault.WebKey, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
73-
<HintPath>..\..\..\packages\Microsoft.Azure.KeyVault.WebKey.2.0.6\lib\net452\Microsoft.Azure.KeyVault.WebKey.dll</HintPath>
72+
<Reference Include="Microsoft.Azure.KeyVault.WebKey">
73+
<HintPath>..\..\..\packages\Microsoft.Azure.KeyVault.WebKey.2.0.7\lib\net452\Microsoft.Azure.KeyVault.WebKey.dll</HintPath>
7474
<Private>True</Private>
7575
</Reference>
7676
<Reference Include="Microsoft.Azure.Management.Authorization">
@@ -138,9 +138,9 @@
138138
<SpecificVersion>False</SpecificVersion>
139139
<HintPath>..\..\..\packages\Moq.4.2.1510.2205\lib\net40\Moq.dll</HintPath>
140140
</Reference>
141-
<Reference Include="Newtonsoft.Json, Version=6.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed, processorArchitecture=MSIL">
142-
<SpecificVersion>False</SpecificVersion>
141+
<Reference Include="Newtonsoft.Json">
143142
<HintPath>..\..\..\packages\Newtonsoft.Json.6.0.8\lib\net45\Newtonsoft.Json.dll</HintPath>
143+
<Private>True</Private>
144144
</Reference>
145145
<Reference Include="System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
146146
<SpecificVersion>False</SpecificVersion>

‎src/ResourceManager/KeyVault/Commands.KeyVault.Test/Scripts/Common.ps1‎

Lines changed: 74 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -207,7 +207,16 @@ function Cleanup-OldCertificates
207207
$certificatePattern = Get-CertificateName '*'
208208
Get-AzureKeyVaultCertificate $keyVault |
209209
Where-Object {$_.Name -like $certificatePattern} |
210-
Remove-AzureKeyVaultCertificate -Force -Confirm:$false
210+
Remove-AzureKeyVaultCertificate -Name $_.Name -VaultName $_.VaultName -Force -Confirm:$false
211+
212+
if($global:softDeleteEnabled -eq $true)
213+
{
214+
Get-AzureKeyVaultCertificate -VaultName $keyVault -InRemovedState |
215+
Where-Object {$_.Name -like $certificatePattern} | %{
216+
Remove-AzureKeyVaultCertificate -Name $_.Name -VaultName $_.VaultName -InRemovedState -Force -Confirm:$false
217+
Wait-Seconds 5;
218+
}
219+
}
211220
}
212221

213222
<#
@@ -313,50 +322,49 @@ function Cleanup-SingleKeyTest
313322

314323
function Cleanup-Key ([string]$keyName)
315324
{
316-
$oldPref = $ErrorActionPreference
317-
$ErrorActionPreference = "Stop"
318-
try
325+
$oldPref = $ErrorActionPreference
326+
$ErrorActionPreference = "Stop"
327+
try
328+
{
329+
$keyVault = Get-KeyVault
330+
Write-Debug "Removing key with name $_ in vault $keyVault"
331+
$catch = Remove-AzureKeyVaultKey $keyVault $keyName -Force -Confirm:$false
332+
if($global:softDeleteEnabled -eq $true)
319333
{
320-
$keyVault = Get-KeyVault
321-
Write-Debug "Removing key with name $_ in vault $keyVault"
322-
$catch = Remove-AzureKeyVaultKey $keyVault $keyName -Force -Confirm:$false
323-
if($global:softDeleteEnabled -eq $true)
324-
{
325-
Wait-ForDeletedKey $keyVault $keyName
326-
Remove-AzureKeyVaultKey $keyVault $keyName -Force -Confirm:$false -InRemovedState
327-
}
334+
Wait-ForDeletedKey $keyVault $keyName
335+
Remove-AzureKeyVaultKey $keyVault $keyName -Force -Confirm:$false -InRemovedState
328336
}
329-
catch {
330-
331-
}
332-
finally
333-
{
334-
$ErrorActionPreference = $oldPref
335-
}
337+
}
338+
catch {
339+
340+
}
341+
finally
342+
{
343+
$ErrorActionPreference = $oldPref
344+
}
336345
}
337346

338347
function Cleanup-Secret ([string]$secretName)
339348
{
340-
$oldPref = $ErrorActionPreference
341-
$ErrorActionPreference = "Stop"
342-
try
343-
{
344-
$keyVault = Get-KeyVault
345-
Write-Debug "Removing secret with name $_ in vault $keyVault"
346-
$catch = Remove-AzureKeyVaultSecret $keyVault $secretName -Force -Confirm:$false
347-
if($global:softDeleteEnabled -eq $true)
348-
{
349-
Wait-ForDeletedSecret $keyVault $secretName
350-
Remove-AzureKeyVaultSecret $keyVault $secretName -Force -Confirm:$false -InRemovedState
351-
}
352-
}
353-
catch {
354-
355-
}
356-
finally
349+
$oldPref = $ErrorActionPreference
350+
$ErrorActionPreference = "Stop"
351+
try
352+
{
353+
$keyVault = Get-KeyVault
354+
Write-Debug "Removing secret with name $_ in vault $keyVault"
355+
$catch = Remove-AzureKeyVaultSecret $keyVault $secretName -Force -Confirm:$false
356+
if($global:softDeleteEnabled -eq $true)
357357
{
358-
$ErrorActionPreference = $oldPref
358+
Wait-ForDeletedSecret $keyVault $secretName
359+
Remove-AzureKeyVaultSecret $keyVault $secretName -Force -Confirm:$false -InRemovedState
359360
}
361+
}
362+
catch {
363+
}
364+
finally
365+
{
366+
$ErrorActionPreference = $oldPref
367+
}
360368
}
361369

362370
<#
@@ -389,6 +397,11 @@ function Cleanup-SingleCertificateTest
389397
$keyVault = Get-KeyVault
390398
Write-Debug "Removing certificate with name $_ in vault $keyVault"
391399
$catch = Remove-AzureKeyVaultCertificate $keyVault $_ -Force -Confirm:$false
400+
if($global:softDeleteEnabled -eq $true)
401+
{
402+
Wait-ForDeletedCertificate $keyVault $_
403+
Remove-AzureKeyVaultCertificate $keyVault $_ -Force -Confirm:$false -InRemovedState
404+
}
392405
}
393406
catch
394407
{
@@ -452,6 +465,30 @@ function Wait-ForDeletedSecret ([string] $vault, [string] $secretName)
452465
return $secret
453466
}
454467

468+
<#
469+
.SYNOPSIS
470+
Waits for a deleted certificate to show up.
471+
#>
472+
function Wait-ForDeletedCertificate ([string] $vault, [string] $certName)
473+
{
474+
$cert = $null
475+
do {
476+
try
477+
{
478+
$cert = Get-AzureKeyVaultCertificate -VaultName $vault -Name $certName -InRemovedState
479+
}
480+
catch
481+
{
482+
# Certificate is not found.
483+
$cert = $null
484+
Write-Host "Sleeping for 5 seconds to wait for deleted certificate $certName"
485+
Wait-Seconds 5
486+
}
487+
} while($cert -ne $null)
488+
489+
return $cert
490+
}
491+
455492
<#
456493
.SYNOPSIS
457494
Removes all managed storage accounts.

‎src/ResourceManager/KeyVault/Commands.KeyVault.Test/Scripts/ControlPlane/KeyVaultManagementTests.ps1‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,8 @@ function Get-AllCertPermissions
6262
"listissuers",
6363
"managecontacts",
6464
"manageissuers",
65-
"setissuers"
65+
"setissuers",
66+
"recover"
6667
)
6768
}
6869

‎src/ResourceManager/KeyVault/Commands.KeyVault.Test/Scripts/RunKeyVaultTests.ps1‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,10 @@ If true, then tests that require a premium vault are skipped (optional).
2929
The object ID of the user (optional). If no object ID is provided, then
3030
the object ID is extracted from whomever is currently logged in.
3131
32+
.PARAMETER SoftDeleteEnabled
33+
If true, turns on 'soft-delete' mode for tests: vault is created as soft-delete-enabled (if not exists), soft-delete
34+
tests are executed, delete + purge sequence is used for clean-up.
35+
3236
.PARAMETER NoADCmdLetMode
3337
If true, then active directory related tests are skipped.
3438
@@ -249,16 +253,24 @@ function Run-AllDataPlaneTests
249253
Run-TestProtected { Run-KeyTest {Test_GetDeletedKeys} "Test_GetDeletedKeys" } "Test_GetDeletedKeys"
250254
Run-TestProtected { Run-KeyTest {Test_UndoRemoveKey} "Test_UndoRemoveKey" } "Test_UndoRemoveKey"
251255
Run-TestProtected { Run-KeyTest {Test_RemoveDeletedKey} "Test_RemoveDeletedKey" } "Test_RemoveDeletedKey"
252-
Run-TestProtected { Run-KeyTest {Test_RemoveNonExistKey} "Test_RemoveNonExistDeletedKey" } "Test_RemoveNonExistDeletedKey"
256+
Run-TestProtected { Run-KeyTest {Test_RemoveNonExistDeletedKey} "Test_RemoveNonExistDeletedKey" } "Test_RemoveNonExistDeletedKey"
253257
Run-TestProtected { Run-KeyTest {Test_PipelineRemoveDeletedKeys} "Test_PipelineRemoveDeletedKeys" } "Test_PipelineRemoveDeletedKeys"
254258

255259
# Secret soft delete tests
256-
Run-TestProtected { Run-KeyTest {Test_GetDeletedKey} "Test_GetDeletedSecret" } "Test_GetDeletedKey"
260+
Run-TestProtected { Run-KeyTest {Test_GetDeletedKey} "Test_GetDeletedSecret" } "Test_GetDeletedSecret"
257261
Run-TestProtected { Run-KeyTest {Test_GetDeletedKeys} "Test_GetDeletedSecrets" } "Test_GetDeletedSecrets"
258-
Run-TestProtected { Run-KeyTest {Test_UndoRemoveKey} "Test_UndoRemoveSecret" } "Test_UndoRemoveSecret"
259-
Run-TestProtected { Run-KeyTest {Test_RemoveDeletedKey} "Test_RemoveDeletedSecret" } "Test_RemoveDeletedSecret"
260-
Run-TestProtected { Run-KeyTest {Test_RemoveNonExistKey} "Test_RemoveNonExistDeletedSecret" } "Test_RemoveNonExistDeletedSecret"
261-
Run-TestProtected { Run-KeyTest {Test_PipelineRemoveDeletedKeys} "Test_PipelineRemoveDeletedSecrets" } "Test_PipelineRemoveDeletedSecrets"
262+
Run-TestProtected { Run-KeyTest {Test_UndoRemoveSecret} "Test_UndoRemoveSecret" } "Test_UndoRemoveSecret"
263+
Run-TestProtected { Run-KeyTest {Test_RemoveDeletedSecret} "Test_RemoveDeletedSecret" } "Test_RemoveDeletedSecret"
264+
Run-TestProtected { Run-KeyTest {Test_RemoveNonExistDeletedSecret} "Test_RemoveNonExistDeletedSecret" } "Test_RemoveNonExistDeletedSecret"
265+
Run-TestProtected { Run-KeyTest {Test_PipelineRemoveDeletedSecrets} "Test_PipelineRemoveDeletedSecrets" } "Test_PipelineRemoveDeletedSecrets"
266+
267+
# certificate soft delete tests
268+
Run-TestProtected { Run-KeyTest {Test_GetDeletedCertificate} "Test_GetDeletedCertificate" } "Test_GetDeletedCertificate"
269+
Run-TestProtected { Run-KeyTest {Test_GetDeletedCertificates} "Test_GetDeletedCertificates" } "Test_GetDeletedCertificates"
270+
Run-TestProtected { Run-KeyTest {Test_UndoRemoveCertificate} "Test_UndoRemoveCertificate" } "Test_UndoRemoveCertificate"
271+
Run-TestProtected { Run-KeyTest {Test_RemoveDeletedCertificate} "Test_RemoveDeletedCertificate" } "Test_RemoveDeletedCertificate"
272+
Run-TestProtected { Run-KeyTest {Test_RemoveNonExistDeletedCertificate} "Test_RemoveNonExistDeletedCertificate" } "Test_RemoveNonExistDeletedCertificate"
273+
Run-TestProtected { Run-KeyTest {Test_PipelineRemoveDeletedCertificates} "Test_PipelineRemoveDeletedCertificate" } "Test_PipelineRemoveDeletedCertificates"
262274
}
263275

264276
# Add-AzureKeyVaultKey tests.

0 commit comments

Comments
 (0)