Support protected files and some input cleanup #39

kuthiala · 2025-07-18T21:13:51Z

This change adds support for the protected files
feature supported by NGINXaaS. Users can give a new optional
input called protected-files that contains a comma
separated list of all the files that need to be marked
as protected. For more information, visit:
https://docs.nginx.com/nginxaas/azure/getting-started/nginx-configuration/nginx-configuration-portal/#add-an-nginx-configuration

Testing done:

Used a service principal with Contributor role only over the NGINXaaS deployment.
Updated an NGINXaaS deployment config with and without protected files.
Updated an NGINXaaS deployment config with and without certificates.
Tested this version of the action with the above combinations from an independent repo to test real world invocations.

amudukutore

@kuthiala - given that these are both substantial changes (splitting up Actions and Azure pipeline, replace ARM templates with Azure CLI), I'd recommend creating separate MRs for these so we can discuss each one on it's merits (unless you feel there is a strong coupling in which case, I'd still prefer them to be separate but maybe sequenced in the right order). Also, when removing support for Azure pipelines, are you considering moving that to a separate repository or just removing it entirely? I'm not sure if we have customers actively using this (can we tell?) but I'd prefer we move this rather than removing it.

README.md

src/deploy-config.sh

action.yml

src/deploy-config.sh

amudukutore

@kuthiala - these changes look good to me. I'll defer to @puneetsarna for final approval. What testing did you run on these changes? Can you please describe that in the PR description?

src/deploy-config.sh

This change also adds support for the protected files feature supported by NGINXaaS. Users can give a new optional input called protected-files that contains a comma separated list of all the files that need to be marked as protected. For more information, visit: https://docs.nginx.com/nginxaas/azure/getting-started/nginx-configuration/nginx-configuration-portal/#add-an-nginx-configuration

This brings deploy-certificate.sh up to parity with the input validation changes made in deploy-config.sh. Adds some more input validation for certificate parameters.

kuthiala force-pushed the main branch 2 times, most recently from 7abd52e to f9dbec3 Compare July 18, 2025 21:26

kuthiala changed the title ~~Draft: Support protected files and remove need for rg permissions for service principal~~ Draft: Remove Azure pipeline task. Support protected files and remove need for rg permissions for service principal Jul 18, 2025

amudukutore reviewed Jul 22, 2025

View reviewed changes