Run PR pipeline on Wilson pool so integration/E2E tests can access lab KeyVault - #3913
Merged
Merged
Conversation
Revert the PR_build pool from the Microsoft-hosted windows-2022 image back to the MwWilson1EsHostedPool. The integration and E2E tests configure their host app to load the LabAuth client certificate from the msidlabs KeyVault (SourceType: KeyVault), which Microsoft.Identity.Web resolves via DefaultAzureCredential. The ephemeral hosted agents have no managed identity, so IMDS returns "Identity not found" and cert load fails with IDW10109. The Wilson pool agents carry a managed identity with access to the lab KeyVaults (as the OneBranch Tests job relies on), so DefaultAzureCredential succeeds there. Keep the explicit build step and visualstudio demand so the integration/E2E test assemblies are built fresh and VSTest can run. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Gladwin Johnson (gladjohn)
approved these changes
Jul 2, 2026
Gladwin Johnson (gladjohn)
left a comment
Gladwin Johnson (gladjohn)
left a comment
Contributor
There was a problem hiding this comment.
let's keep this for now. And see how to move to a new VM. ETA - next week.
Member
|
Avery-Dunn - is this ok to do ? I think those Wilson VMs are very overloaded, and if we start to run Id.Web builds it'll be tough |
This was referenced Jul 2, 2026
Iarek Kovtunenko (iarekk)
added a commit
that referenced
this pull request
Jul 3, 2026
This reverts commit 2ca21d8.
Iarek Kovtunenko (iarekk)
added a commit
that referenced
this pull request
Jul 3, 2026
This reverts commit 2ca21d8.
Iarek Kovtunenko (iarekk)
added a commit
that referenced
this pull request
Jul 3, 2026
* Revert "Run PR pipeline on Wilson pool for lab KeyVault access (#3913)" This reverts commit 2ca21d8. * Load LabAuth cert from store for integration tests on hosted agents The integration-test host (IntegrationTestService) loads its LabAuth client certificate from the msidlabs KeyVault, which Microsoft.Identity.Web resolves via DefaultAzureCredential. Microsoft-hosted agents have no managed identity with access to that KeyVault, so restore/run fails with IDW10109. Add an opt-in switch (env var UseLabAuthCertFromStore) that overrides the client-certificate source for both schemes to load the LabAuth cert from LocalMachine/My (CN=LabAuth.MSIDLab.com), which the pipeline already installs. Default (unset) keeps the KeyVault source, so the official OneBranch/Wilson pipeline and local dev are unchanged. The switch is enabled only in the hosted GitHub PR pipeline (azure-pipelines.yml). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This was referenced Jul 3, 2026
Closed
This was referenced Jul 28, 2026
Closed
Closed
Closed
Closed
Merged
Merged
Open
Open
This was referenced Aug 7, 2026
This was referenced Aug 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
After moving the PR pipeline to the Microsoft-hosted
windows-2022pool, unit tests pass but integration tests fail with:The integration/E2E test host (
tests/E2E Tests/IntegrationTestService/appsettings.json) loads its client certificate from themsidlabsKeyVault (SourceType: KeyVault,KeyVaultCertificateName: LabAuth). Microsoft.Identity.Web resolves that viaDefaultAzureCredential, which on the ephemeral hosted agent finds no managed identity (IMDS returns Identity not found) and no other credential, so the cert can't be downloaded.Why the Wilson pool fixes it
The OneBranch
Testsjob runs onMwWilson1EsHostedPool, whose agent VMs are provisioned with a managed identity that has access to the lab KeyVaults. There is no credential setup in YAML —DefaultAzureCredentialtransparently uses that managed identity. The hosted pool has no equivalent identity.Change
PR_buildpool fromvmImage: windows-2022back toname: MwWilson1EsHostedPool.template-build.yamlstep and thevisualstudiodemand so the integration/E2E assemblies are built fresh andVSTest@2can run (mirrors the OneBranch WilsonTestsjob, which demands bothmsbuildandvisualstudio).Notes
The alternative (staying on hosted agents) would require injecting an Azure credential into the agent (e.g.
AzureCLI@2withaddSpnToEnvironmentexportingAZURE_CLIENT_ID/TENANT_ID/secret) soDefaultAzureCredential'sEnvironmentCredentialcan reachmsidlabs. Going back to the Wilson pool restores the previously-working setup without that complexity.Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com