Improve token handling and cleanup in docker.md for Linux/Bash script#14365
Improve token handling and cleanup in docker.md for Linux/Bash script#14365ianwallen wants to merge 2 commits into
Conversation
|
@microsoft-github-policy-service agree |
|
@ianwallen : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
|
Can you review the proposed changes? IMPORTANT: When the changes are ready for publication, adding a #label:"aq-pr-triaged" |
There was a problem hiding this comment.
Pull request overview
Refactors the Azure Pipelines agent Docker start.sh example in docker.md to improve token handling, especially for service-principal-based tokens that can expire between agent startup and cleanup.
Changes:
- Introduces
load_azp_token()to centralize token acquisition and token-file writing. - Updates
cleanup()to refresh the token before removing agent configuration when using service principal credentials. - Changes the default
AZP_TOKEN_FILElocation to be relative to the script and expandsVSO_AGENT_IGNORE.
Refactor token loading and cleanup functions in docker for Linux/Bash script.
Fixes issue with this error during cleanup
WRITE ERROR: VS30063: You are not authorized to access https://dev.azure.com.
Also fixed issue with hard code AZP_TOKEN_FILE location being a hard coded path /azp/.token which may not exists. Changed it to use the same location as the script location.
|
Can you review this old PR and determine whether it needs to be closed or merged? @MicrosoftDocs/public-repo-pr-review-team |
|
@ianwallen : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
Refactor token loading and cleanup functions in docker Linux/Bash script to fix some bugs.
Fixes issue with this error during cleanup
WRITE ERROR: VS30063: You are not authorized to access https://dev.azure.com.This error happens because at agent start time, it will fetch a token using the client id/secret which works during startup. However the agent may wait for several hours/days before getting triggered and due to this long duration, the token that was fetched at startup is no longer valid during the cleanup therefore a new token should be fetched during cleanup.
Also fixed issue with hard code AZP_TOKEN_FILE location being a hard coded path
/azp/.tokenwhich may not exists. Changed it to use the same location as the script location.