thierry/sql-scripts
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

transformed to a function

Browse Source
This commit is contained in:
Thierry Schork
2025-03-19 16:16:12 +01:00
parent 03dfeb47e1
commit f478d2adea
1 changed files with 167 additions and 130 deletions
Download Patch File Download Diff File Expand all files Collapse all files

295
HCI - BAG symmetricDS/hci_bag_backup.ps1
View File

@@ -1,107 +1,133 @@
# Variables
$tenantId = "7844775a-a9cc-4c33-a5ae-36dcf6660f45" #Galenica
$clientId = "d28076dd-2108-4718-802e-cd3c35fd5505" #pcpl-BAGSpezListePrd-DBBackup
$supersetToCopy="product_superset"
$supersetToCopy="Artikel_History_Superset"
$skipBackup = "auto" #auto = check age and skip if backup is less than 1 day old, $true to force skip backup, $false to force backup
<# <#
backup product_superset__0 : 00:13:00 .SYNOPSIS
restore product_superset : 00:05:40 Push a superset from prodDB to the BAG Azure managed sql instance
.DESCRIPTION
This function will do those operations:
- Check if the superset given is a snapshot or a database
if it's a snapshot, the source database behind the snapshot is backed up
- Authenticate to Azur using a service principal (with a certificate authentication)
- Create a SAS tocken from Azure Blob Storage
- Refresh credentials on prodDB to access the storage account
- Check if a blob of the superset we want to push is more than 1 day old
- if no blob exists, force a backup
- if a blob exists but is aged of less than 1 full day, skip the backup
- if a blob exists but is older than 1 full day, force a new backup
- Refresh the credential with the SAS token on the BAG managed sql instance
- Drop the target database if it exists (we cannot restore over an existing db in managed instances)
- Restore the backup in the cloud db
- Create logins on the restored db for the login [sql-au_bag_apv]
- Give db_datareader and EXECUTE permission on the restored db to [sql-au_bag_apv]
.PARAMETERS
[string] $supersetToCopy
The name of the superset to transfert. for exemple: product_superset
.EXAMPLES
push-superset -supersetToCopy Artikel_History_Superset
#> #>
function push-superset([string] $supersetToCopy){
$mod = Get-Module -Name Az.Accounts # Variables
if($null -eq $mod){ $tenantId = "7844775a-a9cc-4c33-a5ae-36dcf6660f45" #Galenica
Install-Module -Name Az.KeyVault -Scope CurrentUser $clientId = "d28076dd-2108-4718-802e-cd3c35fd5505" #pcpl-BAGSpezListePrd-DBBackup
} $skipBackup = "auto" #auto = check age and skip if backup is less than 1 day old, $true to force skip backup, $false to force backup
$mod = Get-Module -Name Az.Storage write-info "Starting push of $supersetToCopy to the cloud"
if($null -eq $mod){
Install-Module -Name Az.Storage -Scope CurrentUser
}
$mod = Get-Module -Name sqlserver ##do not alter below
if($null -eq $mod){ $serverInstance = "SWMDATASQLPRD01.centralinfra.net"
Install-Module -Name sqlserver -Scope CurrentUser -AllowClobber $databaseName = $null
} $storageAccountName = "stbagspezlisteprdsql"
$containerName = "sqlbakfiles"
$resourceGroupName="rg-BAGSpezListePrd-SQL"
$vaultName="kv-BAGSpezListePrd-bkp"
$secretName="superuser"
$blobPermissions="rwd"
$expiryTime = (Get-Date).AddHours(1) # SAS token valid for 1 hour
$backupFileName = "$supersetToCopy.bak"
$mod = Get-Module -Name Az.Accounts
##do not alter below if($null -eq $mod){
$serverInstance = "SWMDATASQLPRD01.centralinfra.net" Install-Module -Name Az.KeyVault -Scope CurrentUser
$databaseName = $null
$storageAccountName = "stbagspezlisteprdsql"
$containerName = "sqlbakfiles"
$resourceGroupName="rg-BAGSpezListePrd-SQL"
$vaultName="kv-BAGSpezListePrd-bkp"
$secretName="superuser"
$blobPermissions="rwd"
$expiryTime = (Get-Date).AddHours(1) # SAS token valid for 1 hour
$backupFileName = "$supersetToCopy.bak"
#Managed instance related
$MILogin='superuser'
$MIPwd=$null #fetched from key vault later
$MIInstance="sqlmi-bagspezlisteprd-sqlinstance.75ff9425ac13.database.windows.net"
#check for the origin of product_superset
$query="
SELECT s.name AS superset, d.name AS srcDb
FROM sys.databases s
JOIN sys.databases d ON d.[database_id] = s.[source_database_id]
WHERE s.name='$supersetToCopy'
"
$res = Invoke-Sqlcmd -ServerInstance $serverInstance -Query $query
$databaseName = $res.srcDb
if($null -eq $databaseName){
#superset is not a db snapshot...
$databaseName = $supersetToCopy
}
# Log in to Azure
$null = Connect-AzAccount -ServicePrincipal -ApplicationId $clientId -Tenant $tenantId -Subscription BAGSpezListePrd -CertificateThumbprint 7bd45f67999015c7742db25efc86bae97590c57d
# Get the storage account context
$storageAccount = Get-AzStorageAccount -ResourceGroupName $resourceGroupName -Name $storageAccountName
$context = $storageAccount.Context
# Get the blob properties
$backupFile = "https://$storageAccountName.blob.core.windows.net/$containerName/$backupFileName"
if($skipBackup -eq "auto")
{
try{
$blob = Get-AzStorageBlob -Container $containerName -Blob $backupFileName -Context $context
}
catch{
$blob = $null
} }
if($null -eq $blob){ $mod = Get-Module -Name Az.Storage
$skipBackup=$false if($null -eq $mod){
Write-Output "Blob does not exists, forcing backup" Install-Module -Name Az.Storage -Scope CurrentUser
} }
else{
# Calculate the age of the blob
$currentDate = Get-Date
$blobLastModified = $blob | Select-Object -ExpandProperty LastModified
$blobLastModifiedDateTime = [DateTime]::Parse($blobLastModified.ToString())
$blobAge = $currentDate - $blobLastModifiedDateTime
if($blobAge.Days -eq 0){ $mod = Get-Module -Name sqlserver
$skipBackup=$true if($null -eq $mod){
Write-Output "Blob exists and is less than a day old, skipping backup" Install-Module -Name sqlserver -Scope CurrentUser -AllowClobber
}
#Managed instance related
$MILogin='superuser'
$MIPwd=$null #fetched from key vault later
$MIInstance="sqlmi-bagspezlisteprd-sqlinstance.75ff9425ac13.database.windows.net"
#check for the origin of product_superset
$query="
SELECT s.name AS superset, d.name AS srcDb
FROM sys.databases s
JOIN sys.databases d ON d.[database_id] = s.[source_database_id]
WHERE s.name='$supersetToCopy'
"
$res = Invoke-Sqlcmd -ServerInstance $serverInstance -Query $query
$databaseName = $res.srcDb
if($null -eq $databaseName){
#superset is not a db snapshot...
$databaseName = $supersetToCopy
}
# Log in to Azure
$null = Connect-AzAccount -ServicePrincipal -ApplicationId $clientId -Tenant $tenantId -Subscription BAGSpezListePrd -CertificateThumbprint 7bd45f67999015c7742db25efc86bae97590c57d
# Get the storage account context
$storageAccount = Get-AzStorageAccount -ResourceGroupName $resourceGroupName -Name $storageAccountName
$context = $storageAccount.Context
# Get the blob properties
$backupFile = "https://$storageAccountName.blob.core.windows.net/$containerName/$backupFileName"
if($skipBackup -eq "auto")
{
try{
$blob = Get-AzStorageBlob -Container $containerName -Blob $backupFileName -Context $context
}
catch{
$blob = $null
}
if($null -eq $blob){
$skipBackup=$false
Write-Output "Blob does not exists, forcing backup"
} }
else{ else{
$skipBackup=$false # Calculate the age of the blob
Write-Output "Blob exists and is older than a day, forcing backup" $currentDate = Get-Date
$blobLastModified = $blob | Select-Object -ExpandProperty LastModified
$blobLastModifiedDateTime = [DateTime]::Parse($blobLastModified.ToString())
$blobAge = $currentDate - $blobLastModifiedDateTime
if($blobAge.Days -eq 0){
$skipBackup=$true
Write-Output "Blob exists and is less than a day old, skipping backup"
}
else{
$skipBackup=$false
Write-Output "Blob exists and is older than a day, forcing backup"
}
} }
} }
}
# Generate the SAS token # Generate the SAS token
$sasToken = New-AzStorageBlobSASToken -Context $context -Container $containerName -Blob $backupFileName -Permission $blobPermissions -ExpiryTime $expiryTime $sasToken = New-AzStorageBlobSASToken -Context $context -Container $containerName -Blob $backupFileName -Permission $blobPermissions -ExpiryTime $expiryTime
# Save token in db # Save token in db
$sqlQuery = " $sqlQuery = "
IF NOT EXISTS (SELECT * FROM sys.credentials WHERE name = 'https://$storageAccountName.blob.core.windows.net/$containerName') IF NOT EXISTS (SELECT * FROM sys.credentials WHERE name = 'https://$storageAccountName.blob.core.windows.net/$containerName')
BEGIN BEGIN
CREATE CREDENTIAL [https://$storageAccountName.blob.core.windows.net/$containerName] CREATE CREDENTIAL [https://$storageAccountName.blob.core.windows.net/$containerName]
@@ -112,34 +138,34 @@ BEGIN
ALTER CREDENTIAL [https://$storageAccountName.blob.core.windows.net/$containerName] ALTER CREDENTIAL [https://$storageAccountName.blob.core.windows.net/$containerName]
WITH IDENTITY = 'SHARED ACCESS SIGNATURE', SECRET = '$sasToken'; WITH IDENTITY = 'SHARED ACCESS SIGNATURE', SECRET = '$sasToken';
END END
" "
Invoke-Sqlcmd -ServerInstance $serverInstance -Query $sqlQuery Invoke-Sqlcmd -ServerInstance $serverInstance -Query $sqlQuery
Write-Output "Credential refreshed on $serverInstance" Write-Output "Credential refreshed on $serverInstance"
#Back Up Database #Back Up Database
$url=$backupFile $url=$backupFile
$sqlQuery = " $sqlQuery = "
BACKUP DATABASE [$databaseName] BACKUP DATABASE [$databaseName]
TO URL = N'$url' TO URL = N'$url'
WITH FORMAT, MEDIANAME = 'SQLServerBackups', NAME = 'Full Backup of $databaseName'; WITH FORMAT, MEDIANAME = 'SQLServerBackups', NAME = 'Full Backup of $databaseName';
" "
if($false -eq $skipBackup){ if($false -eq $skipBackup){
Invoke-Sqlcmd -ServerInstance $serverInstance -Query $sqlQuery Invoke-Sqlcmd -ServerInstance $serverInstance -Query $sqlQuery
Write-Output "backup done" Write-Output "backup done"
} }
else{ else{
write-output "Backup skipped." write-output "Backup skipped."
} }
#fetch the Managed Instance password #fetch the Managed Instance password
$MIPwd = Get-AzKeyVaultSecret -VaultName $vaultName -Name $secretName -AsPlainText $MIPwd = Get-AzKeyVaultSecret -VaultName $vaultName -Name $secretName -AsPlainText
#craft credential for MI connection #craft credential for MI connection
$securePassword = ConvertTo-SecureString $MIPwd -AsPlainText -Force $securePassword = ConvertTo-SecureString $MIPwd -AsPlainText -Force
$credentialMI = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $MILogin, $securePassword $credentialMI = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $MILogin, $securePassword
#add sas token #add sas token
$sqlCred=" $sqlCred="
IF NOT EXISTS (SELECT * FROM sys.credentials WHERE name = 'https://$storageAccountName.blob.core.windows.net/$containerName') IF NOT EXISTS (SELECT * FROM sys.credentials WHERE name = 'https://$storageAccountName.blob.core.windows.net/$containerName')
BEGIN BEGIN
CREATE CREDENTIAL [https://$storageAccountName.blob.core.windows.net/$containerName] CREATE CREDENTIAL [https://$storageAccountName.blob.core.windows.net/$containerName]
@@ -150,12 +176,12 @@ BEGIN
ALTER CREDENTIAL [https://$storageAccountName.blob.core.windows.net/$containerName] ALTER CREDENTIAL [https://$storageAccountName.blob.core.windows.net/$containerName]
WITH IDENTITY = 'SHARED ACCESS SIGNATURE', SECRET = '$sasToken'; WITH IDENTITY = 'SHARED ACCESS SIGNATURE', SECRET = '$sasToken';
END END
" "
Invoke-Sqlcmd -ServerInstance $MIInstance -Query $sqlCred -Credential $credentialMI Invoke-Sqlcmd -ServerInstance $MIInstance -Query $sqlCred -Credential $credentialMI
Write-Output "Credential refreshed on $MIInstance" Write-Output "Credential refreshed on $MIInstance"
#drop existing db #drop existing db
$sqlDrop=" $sqlDrop="
IF EXISTS( IF EXISTS(
SELECT 1 SELECT 1
@@ -165,20 +191,20 @@ IF EXISTS(
BEGIN BEGIN
DROP DATABASE $supersetToCopy; DROP DATABASE $supersetToCopy;
END END
" "
Invoke-Sqlcmd -ServerInstance $MIInstance -Query $sqlDrop -Credential $credentialMI Invoke-Sqlcmd -ServerInstance $MIInstance -Query $sqlDrop -Credential $credentialMI
Write-Output "Dropped existing $supersetToCopy db (if needed)" Write-Output "Dropped existing $supersetToCopy db (if needed)"
#restore superset #restore superset
$url=$backupFile $url=$backupFile
$sqlRestore=" $sqlRestore="
RESTORE DATABASE [$supersetToCopy] FROM URL = N'$url' RESTORE DATABASE [$supersetToCopy] FROM URL = N'$url'
" "
Invoke-Sqlcmd -ServerInstance $MIInstance -Query $sqlRestore -Credential $credentialMI Invoke-Sqlcmd -ServerInstance $MIInstance -Query $sqlRestore -Credential $credentialMI
write-output "Restored $supersetToCopy" write-output "Restored $supersetToCopy"
#create user for sql-au_bag_apv #create user for sql-au_bag_apv
$sqlUser=" $sqlUser="
IF NOT EXISTS ( IF NOT EXISTS (
SELECT * SELECT *
@@ -189,16 +215,27 @@ BEGIN
CREATE USER [sql-au_bag_apv] FOR LOGIN [sql-au_bag_apv]; CREATE USER [sql-au_bag_apv] FOR LOGIN [sql-au_bag_apv];
END END
" "
Invoke-Sqlcmd -ServerInstance $MIInstance -Query $sqlUser -Credential $credentialMI -Database $supersetToCopy Invoke-Sqlcmd -ServerInstance $MIInstance -Query $sqlUser -Credential $credentialMI -Database $supersetToCopy
write-output "Created user for login [sql-au_bag_apv] in $supersetToCopy" write-output "Created user for login [sql-au_bag_apv] in $supersetToCopy"
#give db_datareader #give db_datareader
$sqlPerms=" $sqlPerms="
ALTER ROLE [db_datareader] ADD MEMBER [sql-au_bag_apv]; ALTER ROLE [db_datareader] ADD MEMBER [sql-au_bag_apv];
GRANT EXECUTE TO [sql-au_bag_apv]; GRANT EXECUTE TO [sql-au_bag_apv];
" "
Invoke-Sqlcmd -ServerInstance $MIInstance -Query $sqlPerms -Credential $credentialMI -Database $supersetToCopy Invoke-Sqlcmd -ServerInstance $MIInstance -Query $sqlPerms -Credential $credentialMI -Database $supersetToCopy
write-output "Added user [sql-au_bag_apv] with read and execute permissions to $supersetToCopy" write-output "Added user [sql-au_bag_apv] with read and execute permissions to $supersetToCopy"
}
<#
backup product_superset__0 : 00:13:00
restore product_superset : 00:05:40
#>
#push-superset -supersetToCopy sl2007_superset
push-superset -supersetToCopy Artikel_History_Superset
#push-superset -supersetToCopy product_superset