Summary of the new feature / enhancement
The DSC resources cannot express three things that the underlying cmdlets support and that are needed in real deployments:
- Credentials.
Register-PSResourceRepository -CredentialInfo and Install-PSResource -Credential are not modelled, so a private feed (Azure Artifacts, GitHub Packages, an internal NuGet server) cannot be used from a configuration.
acceptLicense. Install-PSResource -AcceptLicense is not passed, so a module that requires license acceptance fails during set with exit code 4.
- PSGallery registration.
Register-PSResourceRepository -PSGallery is a separate parameter set. Declaring { name: PSGallery } in a Repository instance on a machine where it was unregistered fails, because the script always calls Register-PSResourceRepository -Name -Uri.
Example of what this could look like:
resources:
- name: Internal feed
type: Microsoft.PowerShell.PSResourceGet/Repository
properties:
name: Internal
uri: https://pkgs.dev.azure.com/contoso/_packaging/internal/nuget/v3/index.json
trusted: true
credentialInfo:
vaultName: ContosoVault
secretName: InternalFeedPat
- name: Modules
type: Microsoft.PowerShell.PSResourceGet/PSResourceList
properties:
repositoryName: Internal
acceptLicense: true
resources:
- name: Contoso.Tools
Proposed technical implementation details (optional)
Repository: add an optional credentialInfo object (vaultName, secretName) mapped to -CredentialInfo on register and set, and handle name: PSGallery without uri by calling Register-PSResourceRepository -PSGallery.
PSResourceList: add an optional acceptLicense boolean passed to Install-PSResource -AcceptLicense, and allow credential via SecretManagement rather than plain text in the configuration.
- Never emit secrets in
get, test or export output; return only the vault and secret names.
Summary of the new feature / enhancement
The DSC resources cannot express three things that the underlying cmdlets support and that are needed in real deployments:
Register-PSResourceRepository -CredentialInfoandInstall-PSResource -Credentialare not modelled, so a private feed (Azure Artifacts, GitHub Packages, an internal NuGet server) cannot be used from a configuration.acceptLicense.Install-PSResource -AcceptLicenseis not passed, so a module that requires license acceptance fails duringsetwith exit code 4.Register-PSResourceRepository -PSGalleryis a separate parameter set. Declaring{ name: PSGallery }in aRepositoryinstance on a machine where it was unregistered fails, because the script always callsRegister-PSResourceRepository -Name -Uri.Example of what this could look like:
Proposed technical implementation details (optional)
Repository: add an optionalcredentialInfoobject (vaultName,secretName) mapped to-CredentialInfoon register and set, and handlename: PSGallerywithouturiby callingRegister-PSResourceRepository -PSGallery.PSResourceList: add an optionalacceptLicenseboolean passed toInstall-PSResource -AcceptLicense, and allowcredentialviaSecretManagementrather than plain text in the configuration.get,testorexportoutput; return only the vault and secret names.