How to automate integration testing for Azure Resource Protected by Private End Points?

Siegfried Heintze 1,881

My bicep file deploys and creates a service bus queue (protected by a firewall) and a function app (and associated storage account) protected by private end points. The Function app reads the queue and creates log statements.

For manual testing, we deploy a custom web app (also inside the VNet and protected with a private end point) with a simple GUI that writes test data to the service bus queue.

To perform the manual test, we access a VM (also inside the VNET and protected by private end point) via Bastion and repeatedly click the "Send Test Data" button on the Web App and watch the function app logs with "az webapp log tail". If we see the test data in the logs (using regular expressions) the test passes.

I was reviewing this solution: https://www.c-sharpcorner.com/article/creating-unit-tests-for-azure-functions/ I think it uses a database. We don't have a database in our implementation.

(1) How might we automate this test?

(2) Could we trigger the run of such an automated test when we "git push" to master? Could a failure of the test cause a git "pull request" to be rejected automatically?

(3) Are there any testing frameworks out there that could help us out?

Thanks

Siegfried

Accepted answer

Pinaki Ghatak 4,285 Reputation points Microsoft Employee

2024-07-17T10:06:17.95+00:00
Hello @Siegfried Heintze

To automate integration testing for Azure Resource Protected by Private End Points, you can use Azure DevOps pipelines. You can create a pipeline that deploys your Bicep file and runs automated tests against the deployed resources. Here are the steps you can follow to create an automated test pipeline:

Create an Azure DevOps project and repository.

Create a pipeline that deploys your Bicep file to your Azure subscription.

Add a task to the pipeline that runs your automated tests against the deployed resources. You can use tools like Selenium or Appium to automate the testing of your web app.

Configure the pipeline to trigger on a git push to master.

If the tests fail, you can configure the pipeline to fail the build and prevent a pull request from being merged.

There are several testing frameworks available for Azure Functions, including the one you mentioned in your question. You can also use tools like Postman or Newman to test your API endpoints.

I hope this helps
Please sign in to rate this answer.
Siegfried Heintze 1,881 Reputation points

2024-07-17T15:20:26.8833333+00:00

This make sense for unprotected Http Triggered functions. Please help me understand

How do I accommodate service bus queue triggered functions? I need to inject data into the service bus and then detect if the function acted appropriately. How do I automate this?

How do I accommodate service bus queue triggered functions protected with private endpoints? See my explanation above of using a VM for the manual tests.

Since we have some corporate security constraints, installing tools (e.g.: testing tools, Azure SDK, azure cli) in the VM to inject test data into the service bus or to look at the function app logs is difficult and I don't know how to automate this. As I explained above, we have mitigated this problem for manual testing with a custom webapp GUI that is inside the VNet that can inject the test data into the queue but this is not automated either.

Siegfried Heintze 1,881 Reputation points

2024-07-24T17:12:00.5666667+00:00

I would love to see a response to my previous comment!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

1 additional answer

Ryan Hill 28,106 Reputation points Microsoft Employee

2024-07-25T22:03:58.2666667+00:00

Hi @Siegfried Heintze

I took a look at the link you shared. If you're wanting to do integration in your pipeline, I think you can leverage a continuous webjob for this. I came across https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-nodejs-how-to-use-queues?tabs=passwordless and you can leverage this JavaScript code with tweaks to fit your environment.

While this doc is for deploying the webjob using VS, the main thing is that the code is deployed to appropriate folder. But this Stackoverflow post illustrates using a pipeline flow. Just remember that your app service needs to be set to Always On.
Please sign in to rate this answer.
Siegfried Heintze (ARTECH CONSULTING LLC) 0 Reputation points Microsoft Vendor

2024-07-29T15:25:43.3633333+00:00

Thanks Ryan! All those links look good and I've already implemented the scripts to send and receive messages to/from the service bus queue.

The part I need help with is accommodating the private endpoints. The way I do it manually is described here: https://learn.microsoft.com/en-us/azure/private-link/create-private-endpoint-cli?toc=%2Fazure%2Fvirtual-network%2Ftoc.json&tabs=dynamic-ip

I create a web app and confirm I can see it with a browser from my development machine. Then I create the private end points and observe that I can no longer see the web app with my browser: then I know the private end points are working for the web app and I assume they are also working for my azure function.

How can I confirm that the private end points are working for the service bus triggered azure function?

Then I create a VM, log into the VM and use the edge browser inside the VM to see if I can use the browser to see the webapp. If so, I assume that I can see the azure function. However, checking to see if I can see the function app is difficult partly because it is not an http trigger function app.

What I need to next is install the azure SDK and azure cli in the VM but the security constraints of my development environment make this difficult. If I could install these in the VM, I would run "az webapp log tail" (there is no az functionapp log tail command) on the function app and observe that it is still working correctly while I run the script from inside the VM (the script you mentioned in your links) to insert test data into the service bus queue.

Since I have this web app from the above tutorial that will never be in production I created a little UI to insert test data into the service bus. This solves the problem of having to install the azure sdk and the azure cli inside the VM.

However, I still don't know how to automate all of this. I assume that running code inside the VM is mandatory for automating a test. If so, this code (a powershell script perhaps?) would have to record the test results somewhere, perhaps in a local file inside the VM... How would I automate fetching these test results from inside the VM before I shut down the VM and loose it?

I guess I could create a database (cosmos DB or Azure SQL) outside the VM and write the test results there.

Oh my goodness this is a lot of work!

I was hoping there was a testing framework that could help me with this!

Surely I'm not the first to need this!

If there is no existing testing framework to create the VM and run some script to perform the tests and retrieve the test data so I can see it after the VM shuts down, how do I do it?

I've never created a VM start up script before. Hmm...

Thanks

siegfried

Siegfried Heintze (ARTECH CONSULTING LLC) 0 Reputation points Microsoft Vendor

2024-07-29T15:48:13.3166667+00:00

This is a test message so please ignore it. I just spent 40 minutes writing a response and clicked "add comment" and now I don't see my most recent post. Sometimes adding yet another comment like this makes it appear.

Oh hurray! after waiting 30 min and creating a 3rd comment this morning now I see the first post I made this morning.

Siegfried Heintze (ARTECH CONSULTING LLC) 0 Reputation points Microsoft Vendor

2024-07-29T15:53:28.7533333+00:00

Oh shucks. I just spent 40 minutes posting a reply to Ryan's posting and pressed "Add comment" and now it is gone.

Ryan: please see https://learn.microsoft.com/en-us/azure/private-link/create-private-endpoint-cli?toc=%2Fazure%2Fvirtual-network%2Ftoc.json&tabs=dynamic-ip#create-a-private-endpoint (the part about creating a VM and using it to browse the webapp to prove that the private and points and the web app are working).

Please help me understand how to automate creating this VM that will run some tests that inject test data into the service bus queue and inspect the logs from my service bus triggered functionapp and make the test results available after the VM has shut down.

Thanks

Siegfried

Ryan Hill 28,106 Reputation points Microsoft Employee

2024-07-30T14:08:46.5266667+00:00

That's a lot to unpack @Siegfried Heintze (ARTECH CONSULTING LLC) 🙂

If I were in your position, I would still use a webjob that can be started by either CLI/PowerShell script or your deployment pipeline. You could always use scripting like the following to send a message

az servicebus message send --resource-group myResourceGroup --namespace-name myNamespace --queue-name myQueue --message "Hello, Service Bus!"

$message = "Hello, Service Bus!" Send-AzServiceBusMessage -ResourceGroupName myResourceGroup -NamespaceName myNamespace -QueueName myQueue -MessageBody $message

but by having a webjob, I just feel there's more flexibility in message production and logging. I've come to know your ultimate goal is to have bicep scripts that will create complete environments, so I think either route is acceptable. If you intend to create the VM each time you run a deployment, there should be some available extensions that places the CLI/SDK/PowerShell modules on the VM during procurement, but I would still use a webjob though.

Siegfried Heintze (ARTECH CONSULTING LLC) 0 Reputation points Microsoft Vendor

2024-07-30T23:25:12.34+00:00

Thanks Ryan. Web jobs sound much better than VMs. How do I mark your comment as the answer?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to automate integration testing for Azure Resource Protected by Private End Points?

1 additional answer

Your answer