Hop til hovedindhold
Document status35 Reviewed

Self Hosted Agent VM

This document describes the configuration and authentication setup for the Self Hosted Agent VM used in Azure DevOps pipelines.

Overview​

The Self Hosted Agent VM provides dedicated build and deployment agents running within the EnergyConnect infrastructure.

These agents enable secure access to resources within the private network and offer more control over the build environment compared to Microsoft-hosted agents.

Agent Authentication with Service Principal​

The Self Hosted Agent uses a Service Principal (SP) with a client secret to authenticate against Azure DevOps.

App Registration Setup​

All Self Hosted Agents share the same App Registration, which acts as a service account in Azure DevOps. This centralized approach simplifies management and ensures consistent permissions across all agents.

ConfigurationDetails
Azure TenantFellowmind DK Azure Tenant
Tenant IDc905c127-525f-47a9-83f1-bec014f6d613
Client ID8719c1fe-be0a-4800-9555-99079907f529
ReasonThe Azure DevOps organization resides in the Fellowmind DK tenant
Azure DevOps AccessThe App Registration is invited as a user in Azure DevOps
PermissionsAdministrator rights over the Agent Pools

Note: The App Registration must be created in the Fellowmind DK Azure Tenant because our Azure DevOps organization is linked to this tenant. The App Registration is then invited as a guest user into Azure DevOps, where it is granted Administrator permissions on the Agent Pools to allow agent registration and management.

Key Characteristics​

  • One-time Authentication: The authentication with Azure DevOps only needs to happen once during the initial agent configuration. After the agent is registered, it maintains its connection without requiring re-authentication.
  • No Secret Rotation Required: Since the authentication is a one-time operation during setup, the client secret does not need to be rotated. Once the agent is registered with Azure DevOps, it uses a PAT-independent connection.
  • Shared App Registration: All agents authenticate using the same App Registration, acting as a centralized service account for agent management.
  • Service Principal Scope: The Service Principal requires Administrator permissions on the Agent Pools to register and manage agents.

Configuration Script​

The agent configuration is performed automatically as part of the Agent VM setup during Bicep deployment. The setup script handles the Service Principal authentication and agent registration without manual intervention.

Automatic Registration​

When the Agent VM is deployed via Bicep, the configuration script runs automatically and:

  1. Authenticates with Azure DevOps using the Service Principal credentials
  2. Installs software prerequisites (e.g. AZ CLI, .NET SDK, PowerShell, PostgreSQL Client and others) for the agent to run database configuration and database migration tasks
  3. Registers the agent with the designated Agent Pool
  4. Starts the agent service

This ensures that newly deployed Agent VMs are immediately available in Azure DevOps without requiring manual configuration steps.

Prerequisites​

  • The environment's keyvault must have a keyvault secret sp-agent-client-secret with a valid client secret value from the service principal (this must be handled manually)

Authentication Flow​

Configuration Process​

  1. Service Principal Authentication: The script authenticates using the Service Principal's Client ID and Client Secret against Entra ID
  2. Agent Registration: Using the obtained access token, the script registers the agent with the specified Azure DevOps organization and agent pool
  3. Persistent Connection: Once registered, the agent establishes a persistent connection to Azure DevOps that does not require the original credentials