TechPrufer
Get started
Microsoft
Microsoft logoMicrosoft · Feature trail

Pipeline Shared Infrastructure Security

3 posts · Sep 2017 – Nov 2024

What this trail covers

Azure Pipelines continues to evolve its CI/CD capabilities with Managed DevOps Pools (MDP), a fully managed service that combines the flexibility of Scale Set agents with the ease of maintenance of Microsoft Hosted agents. MDP allows teams to quickly spin up custom DevOps pools tailored to their workload's unique needs, including regional deployment, custom software installation, optimized scaling with standby agent modes, and private network connectivity. New features include support for new Azure SKUs, stateful agents, and the ability to pick any SKU, additional storage, and geographic co-location. The host-on-behalf model reduces management overhead and improves reliability.

All Microsoft trails
  1. Announcing the General Availability of Managed DevOps Pools (MDP) for Azure DevOpsThis post announces the general availability of Managed DevOps Pools (MDP) for Azure DevOps. It highlights MDP's ability to provide custom, fully managed CI/CD agent pools that combine the flexibility of Scale Set agents with the ease of maintenance of Microsoft Hosted agents. Key new features introduced include support for new Azure regions, improved discoverability within Azure DevOps, proxy support for network traffic, visibility of agent IP addresses in pipeline logs, the ability to move pools across resource groups or subscriptions, Ubuntu 24.04 support, and integration with Azure Key Vault for secrets. The post also outlines upcoming features such as container-based agents, SPOT VMs support, managed data disk support, trusted root certificate addition, faster pipeline starts, and Log Analytics integration. The core technical contribution is the operationalization of a managed service for dynamic, customizable CI/CD agent infrastructure, addressing the trade-offs between flexibility, cost, and maintenance overhead.
  2. Announcing Public Preview of Managed DevOps Pools (MDP) for Azure DevOpsAnnounces the public preview of Managed DevOps Pools (MDP) for Azure DevOps. MDP is a fully managed service where Microsoft manages the VMs powering the agents in Microsoft-owned Azure subscriptions, reducing management overhead and improving reliability compared to self-hosted or VM Scale Set agents. Key benefits include reduced management time, creation of specific pools for workloads, optimized DevOps billing (up to 50% reduction observed), and enhanced scalability to thousands of agents. Notable features include quick-starter images, standby agents for faster pipeline starts, private networking capabilities, bring-your-own-image support, stateful agents for performance gains, choice of any Azure SKU, additional storage options, and geographic co-location for performance and compliance.
  3. Let's Hack a Pipeline: Shared InfrastructureThis post details the security risks associated with sharing pipeline agent infrastructure across multiple projects. It explains how compromising a single pipeline on a shared agent can lead to broader system compromise, including code theft, backdoor installation, and compiler poisoning. The post emphasizes that agent folders provide convenience, not secure isolation, and that persistent agents pose a risk. Mitigation strategies discussed include preferring one-time use agents (Microsoft-hosted or scale set agents), running self-hosted agents with minimal privileges, and treating agents as potentially malicious. It concludes that sharing pools across projects is tempting for cost and complexity but puts all pipelines at risk.
  4. Let's Hack a Pipeline: Stealing Another RepoThis post details a security vulnerability where a malicious user can steal source code from other repositories within the same Azure DevOps organization by editing a CI pipeline. The attack exploits the default broad access of the build service identity, which has collection scope. The post demonstrates how to modify a pipeline's YAML to clone and push code from unauthorized repositories. It also explains the historical context of build service identity scoping and the power of pipeline editing. Mitigation strategies are presented, including enabling 'Limit job authorization scope' at the organization level and requiring explicit authorization for accessing new repositories via the 'resources' section.
  5. Remembering How We Should Manage Open SourceThis post discusses the Equifax attack as a case study for open source vulnerabilities, highlighting the use of Apache Struts CVE-2017-5638. It presents data on the growth of vulnerabilities and the prevalence of known fixes. The post advocates for shifting security left and continuously scanning for vulnerabilities, specifically recommending WhiteSource Bolt, a VSTS extension, for scanning builds in release pipelines to identify open source vulnerabilities and notify users of new discoveries.