Adding linting, validation and what-if to Bicep templates in Azure DevOps

We are picking up from my last post where I walked through automating Bicep template deployments through Azure DevOps so if you haven't caught up here is a link

The pipeline we set up in the previous post ran a single job that deployed our Azure resource using Bicep. However, in a production scenario we want to run some validation checks to ensure our new code won't breaking anything. Stages in Azure DevOps pipelines comprise of jobs and tasks e.g. running a script and you can think of them as containers for grouping different jobs.

Let's look at the new stages that we will be adding to our pipeline.

Let's understand each of the stages:

Lint: Use the Bicep linter to verify that the Bicep file is well formed and doesn't contain any obvious errors.
Validate: Use the Azure Resource Manager preflight validation process to check for problems that might occur when you deploy.
Preview: Use the what-if command to validate the list of changes that will be applied against your Azure environment. This allows people to review and approve the changes before deployment.
Deploy: Submit your deployment to Resource Manager and wait for it to finish pending the approval gate.

Converting our pipeline to a multistage pipeline

Since we want to run multiple stages we need to add some additional code to our YAML template. This is going to look something like this:



stages:

- stage: Lint
  jobs:
  - job: LintCode

- stage: Validate
  dependsOn: Lint
  jobs: 
  - job: ValidateBicepTemplate

- stage: Preview
  dependsOn: Validate
  jobs: 
  - job: Preview

- stage: Deploy
  dependsOn: Preview
  jobs: 
  - job: Deploy

By default stages run in parallel if you have enough agents however, we want to run these stages sequentially so I have added a dependsOn: to achieve this meaning that each stage can only run once the previous stage completes successfully.

This is the basic structure and in the next few sections we will build up each stage of the pipeline.

Adding Linting

Linting validation will check for things like unused parameters, unused variables, interpolation, secure parameters and more. The first thing we need to do is add the lint stage to our pipeline:



trigger:
- master

name: Deploy Bicep files


variables:
  vmImageName: 'ubuntu-latest'

  azureServiceConnection: 'devops-poc3-deploy-spi'
  location: 'australiaeast'
  templateFile: 'bicep/azure_resource_group/template.bicep'
  templateParameterFile: 'bicep/azure_resource_group/parameters.json'

pool:
  vmImage: $(vmImageName)

stages:  

- stage: Lint
  jobs:
  - job: LintCode
    displayName: Lint code
    steps:
      - script: |
          az bicep build --file $(Build.SourcesDirectory)/$(templateFile)
        name: LintBicepCode
        displayName: Run Bicep linter

Azure pipeline doesn't treat lint warnings as problems, so we need to add a configuration file to the repository where our bicep file is located. Copy and paste the below and name the file bicepconfig.json:



{
  "analyzers": {
    "core": {
      "enabled": true,
      "verbose": true,
      "rules": {
        "adminusername-should-not-be-literal": {
          "level": "error"
        },
        "max-outputs": {
          "level": "error"
        },
        "max-params": {
          "level": "error"
        },
        "max-resources": {
          "level": "error"
        },
        "max-variables": {
          "level": "error"
        },
        "no-hardcoded-env-urls": {
          "level": "error"
        },
        "no-unnecessary-dependson": {
          "level": "error"
        },
        "no-unused-params": {
          "level": "error"
        },
        "no-unused-vars": {
          "level": "error"
        },
        "outputs-should-not-contain-secrets": {
          "level": "error"
        },
        "prefer-interpolation": {
          "level": "error"
        },
        "secure-parameter-default": {
          "level": "error"
        },
        "simplify-interpolation": {
          "level": "error"
        },
        "protect-commandtoexecute-secrets": {
          "level": "error"
        },
        "use-stable-vm-image": {
          "level": "error"
        }
      }
    }
  }
}

Our pipeline will now fail if any of the linting flags warnings.

Adding Bicep template validation

We can use the Azure Resource Manager Deployment Task from the previous post to also run a validation against the ARM API to check for anything that may cause the deployment to fail e.g. reserved name for a storage account.

Let's get this stage added. Copy and paste the below straight after the lint stage (careful of the YAML indentation):



- stage: Validate
  dependsOn: Lint
  jobs: 
  - job: ValidateBicepTemplate
    steps:
    - task: AzureResourceManagerTemplateDeployment@3
      inputs:
        deploymentScope: 'Subscription'
        azureResourceManagerConnection: '$(azureServiceConnection)'
        location: '$(location)'
        templateLocation: 'Linked artifact'
        csmFile: '$(Build.SourcesDirectory)/$(templateFile)'
        csmParametersFile: '$(Build.SourcesDirectory)/$(templateParameterFile)'
        deploymentMode: 'Validation'

Adding What-If (Preview) analysis.

Before deploying the changes, we can run a what-if operation that will give you a preview of the template will change. This is a really cool feature and very similar to Terraform Plan where you can see exactly the number of changes the Bicep template will perform (if any).

Let's get this stage added. Copy and paste the below straight after the validation stage:



- stage: Preview
  dependsOn: Validate
  jobs: 
  - job: Preview
    steps:
    - task: AzureCLI@2
      inputs:
        azureSubscription: '$(azureServiceConnection)'
        scriptType: 'bash'
        scriptLocation: 'inlineScript'
        inlineScript: |
          az deployment sub what-if \
            --template-file $(Build.SourcesDirectory)/$(templateFile) \
            --parameters '$(Build.SourcesDirectory)/$(templateParameterFile)' \
            --location '$(location)'

Run the pipeline and select the preview stage to look at the results:

We can see that the what-if is showing that one resource will be created and in this instance it's the resource group we defined in the previous post.

Add approval gates

The final step is to add an approval gate to our deploy stage which will deploy the Bicep template with the desired infrastructure.

Paste the following code after the preview stage:



- stage: Deploy
  jobs:
    - deployment: Deploy
      environment: BicepEnvironment
      strategy:
        runOnce:
          deploy:
            steps:
            - checkout: self

            - task: AzureResourceManagerTemplateDeployment@3
              name: DeployBicepTemplate
              inputs:
                deploymentScope: 'Subscription'
                azureResourceManagerConnection: '$(azureServiceConnection)'
                action: 'Create Or Update Resource Group'
                location: '$(location)'
                templateLocation: 'Linked artifact'
                csmFile: '$(Build.SourcesDirectory)/$(templateFile)'
                csmParametersFile: '$(Build.SourcesDirectory)/$(templateParameterFile)'
                deploymentMode: 'Incremental'
                deploymentName: 'DeployPipelineTemplate'

You will notice that in order to use an environment for approvals we have added a deployment which is structured slightly differently from a regular job. An environment is simply a place where you deploy your solution and allows you to add approval gates and more.

Let's run the pipeline and see the approval in action:

Because we are using an environment, we need to allow our pipeline permissions to deploy using the environment:

Once we allow our pipeline access to the environment in Azure DevOps we can go ahead and approve the changes:

Here is our Resource Group deployed in Azure:

Here is the complete multi-stage pipeline. You can also find the code on my GitHub page here.



trigger:
- master

name: Deploy Bicep files


variables:
  vmImageName: 'ubuntu-latest'

  azureServiceConnection: 'devops-poc3-deploy-spi'
  location: 'australiaeast'
  templateFile: 'bicep/azure_resource_group/template.bicep'
  templateParameterFile: 'bicep/azure_resource_group/parameters.json'

pool:
  vmImage: $(vmImageName)

stages:  

- stage: Lint
  jobs:
  - job: LintCode
    displayName: Lint code
    steps:
      - script: |
          az bicep build --file $(Build.SourcesDirectory)/$(templateFile)
        name: LintBicepCode
        displayName: Run Bicep linter

- stage: Validate
  dependsOn: Lint
  jobs: 
  - job: ValidateBicepTemplate
    steps:
    - task: AzureResourceManagerTemplateDeployment@3
      inputs:
        deploymentScope: 'Subscription'
        azureResourceManagerConnection: '$(azureServiceConnection)'
        location: '$(location)'
        templateLocation: 'Linked artifact'
        csmFile: '$(Build.SourcesDirectory)/$(templateFile)'
        csmParametersFile: '$(Build.SourcesDirectory)/$(templateParameterFile)'
        deploymentMode: 'Validation'        

- stage: Preview
  dependsOn: Validate
  jobs: 
  - job: Preview
    steps:
    - task: AzureCLI@2
      inputs:
        azureSubscription: '$(azureServiceConnection)'
        scriptType: 'bash'
        scriptLocation: 'inlineScript'
        inlineScript: |
          az deployment sub what-if \
            --template-file $(Build.SourcesDirectory)/$(templateFile) \
            --parameters '$(Build.SourcesDirectory)/$(templateParameterFile)' \
            --location '$(location)'

- stage: Deploy
  jobs:
    - deployment: Deploy
      environment: BicepEnvironment
      strategy:
        runOnce:
          deploy:
            steps:
            - checkout: self

            - task: AzureResourceManagerTemplateDeployment@3
              name: DeployBicepTemplate
              inputs:
                deploymentScope: 'Subscription'
                azureResourceManagerConnection: '$(azureServiceConnection)'
                action: 'Create Or Update Resource Group'
                location: '$(location)'
                templateLocation: 'Linked artifact'
                csmFile: '$(Build.SourcesDirectory)/$(templateFile)'
                csmParametersFile: '$(Build.SourcesDirectory)/$(templateParameterFile)'
                deploymentMode: 'Incremental'
                deploymentName: 'DeployPipelineTemplate'

In a production environment you would also want to add some smoke testing or pester testing which can be easily achieved with PowerShell.

Hope you enjoyed the read.

Blog

Adding linting, validation and what-if to Bicep templates in Azure DevOps

Martin

Converting our pipeline to a multistage pipeline

Adding Linting

Adding Bicep template validation

Adding What-If (Preview) analysis.

Add approval gates

Join Our Newsletter. No Spam, Only the good stuff.

Related