NSG outbound rule for VSTS Deployment Group

0
votes

I have an Azure VM that has an NSG which needs to restrict outbound Internet access to only necessary services and applications (start with most restrictive then add rules). The Team Services agent extension also will get installed with an ARM template (which fails to download with the Deny all outbound Internet rule).

Does the weekly change of IP addresses used by VSTS apply for Deployment Groups? There is a similar question for IPs of Hosted Build.

I'm creating the VMs in a VSTS release definition. In the link above, I found an answer posted that you can call the REST API to get the IP address which would be easiest, but when I try this in a browser it looks like this is deprecated. ("Sorry! Our services aren't available right now.") Any other ideas on how I can apply the IPs for the NSG whenever I run the release to create the VMs?

"You can get the IP address of current build agent dynamically and create a security group dynamically (by using AWS SDK for .NET)

Open build definition > Select Options tab> Check Allow Scripts to Access OAuth Token Add PowerShell step/task (Arguments: -RestAddress https://starain.vsdtl.visualstudio.com/DefaultCollection/_apis/vslabs/ipaddress -Token $(System.AccessToken))."

2
azureazure-devops

2 Answers

0
votes

If I read this right, you want to create a VM using VSTS pipeline and this new VM should host a VSTS Agent that calls back VSTS any time later.

I think there are no solutions. While it would be easy to get a valid IP for a VSTS instance at creation time, you have no guarantee that this IP will be valid for long time. You may be lucky in being able to setup the agent but the link to VSTS may stop any minute.

The question is interesting in itself and can be solved using the Azure PowerShell task. The script will:

  1. resolve the name to the IP address using the Resolve-DnsName cmdlet
  2. add or update the NSG rule using Set-AzureRmNetworkSecurityGroup etc.
0
votes

That API is unavailable now, you can try to get the IP and update NSG through PowerShell task directly (e.g. $ip = Invoke-RestMethod http://ipinfo.io/json | Select -exp ip) PowerShell One Liner: Get External/Public IP Address.

On the other hand, you use a private agent: Deploy an agent on Windows