At Auth0 we host things on different cloud providers. Our test environments we use for the appliance run on AWS and Azure. Now when we want to do some manual testing we might want to restore a specific version of the appliance. In Azure we currently use a few PowerShell scripts to do so. But not everyone has a Windows machine, or access to our test subscription etc...
Now since we are big fans of Slack and with "ChatOps" being cool and all it was time to integrate this with Slack. Basically what we want is to do something like: /runbook Restore-Appliance 4975 to restore one of our labs to a specific version. And also /runbook Backup-Appliance 4975 to take a back of the current state of a lab.
So what I wanted was:
- A Slash command to do stuff in Azure
- Something that could report the progress (the Slash command response URL only gives you up to 30 minutes to report back)
- Something that could run our existing PowerShell scripts
Introducing azure-runslash
The azure-runslash project does exactly that:
It's a very simple Node.js application that will respond to a Slash command, run an Azure Automation Runbook (which makes it possible to run PowerShell scripts that manage your Azure account) and then have a Web Job report back to Slack whenever something changes. All of this is packaged in a Resource Manager template so you basically just have to push the Deploy To Azure button and you're all set.
So how does this work?
Well the Slash command will just forward the request to a Web App. This Web App will call the Resource Manager API to execute the Runbook and then also post a message to a queue (containing the Job ID).
A Web Job will then empty the queue and post a message to Slack each time the status of the job changes.
Configuration
Azure Automation
This integration will execute Runbooks in your Azure Automation account. So this is a first pre-requisites. If you're new to Azure Automation you can start with the documentation and a sample runbook is available here.
Important: the Slash command will send 1 parameter to the Runbook,
$context. This will contain an array of all the values you specify when invoking the command. Eg:/runbook Sample-Runbook a b cwill end up being["a", "b", "c"]. In your runbook you would specify the parameter like this:param ([Parameter(Mandatory=$false)][object]$context).
Now write down the Resource Group and Automation Account Name because this will be something you'll need when deploying the integration.
Azure AD Authentication
The code running when your Slash command executes will need to authenticate to the Resource Manager API. There are different tutorials available that explain how you can create an application in Azure AD that will be able to access your subscription.
There's also a blog post on my blog that shows how to do this with the azure-cli.
Now write down the Tenant ID, Subscription ID, Client ID and Client Secret because this will be something you'll need when deploying the integration.
Slack Configuration
In Slack you'll need to configure a Slash command. Thing's you'll want to set here:
Command: This is what will trigger the integration.URL: This is the url on which you'll host the integration. Make sure you add/executeafter it.Customize Name/Icon: Make it look nice!
Now write down the Token because this will be something you'll need when deploying the integration.
And in order for the integration to report back you'll also need to create an Incoming Web Hook. Here you'll configure:
Post to Channel: This is the channel to which you'll want the updates to be posted.Customize Name/Icon: Make it look nice!
Now write down the Channel Name and Webhook URL because this will be something you'll need when deploying the integration.
Deployment
If you click the following button this will start the deployment of a Resource Manager template:
This template will do all of the configuration for you and just ask you for your settings:
Important: Enter the name of the App Service Plan and Storage Account you want to use. If these don't exist they will be created automatically. If they do exist, make sure you enter the existing settings in SKU/Plan Size/Worker Size/Account Type.
And ow just accept the terms and press Create!
Give it between 15 and 30 minutes. The last step in the deployment can take some time because it needs to install the NPM dependencies.
FAQ
Why should I still run all of this myself? Why not create a Slack App.
Well yes maybe that's a next step. The thing to worry about in that case is how to keep your credentials secure. In the current setup you own everything. A third party does not have access to your Azure subscription.
Why would I want to use this?
Maybe to make manual tasks easier. I'm not saying you have to do all of your production stuff with Slack. But for us it makes sense to automate tasks regarding our test environment. Start a SharePoint cluster, stop it, restore a backup, ... If we can automate all of this using a Runbook and expose it over a Slash command it will be much more accessible to everyone (even for people without access to the Azure subscription).
The first time I call the Slash command it tells me there was a timeout
Slack expects a quick reply from the service it calls. Sometimes an Azure Web app can take a few seconds to start. Now even if you get a timeout, the Runbook will still execute and the status will still be posted to Slack.
Closing
The Azure Resource Management API brings consistency in how we can automate things and makes it really easy to build integrations like these.
Do you have any other ChatOps ideas?