Skip to content

Commit 70952d3

Browse files
abatallasabatallas
committed
Create utility script and associated bicep for BYO MIs and storage acct
Rename variables and files plus fix help message
1 parent 53eeb87 commit 70952d3

6 files changed

Lines changed: 149 additions & 2 deletions

‎bicep/storage-new.bicep‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
targetScope = 'resourceGroup'
2+
import {tags_t} from './types.bicep'
3+
4+
var storageAccountName = 'ccwstorage${uniqueString(az.resourceGroup().id)}'
5+
param location string
6+
param tags tags_t = {}
7+
8+
resource storageAccount 'Microsoft.Storage/storageAccounts@2024-01-01' = {
9+
name: storageAccountName
10+
location: location
11+
tags: tags
12+
sku: {
13+
name: 'Standard_LRS'
14+
}
15+
kind: 'StorageV2'
16+
properties:{
17+
accessTier: 'Hot'
18+
minimumTlsVersion: 'TLS1_2'
19+
allowSharedKeyAccess: false
20+
publicNetworkAccess: 'Disabled'
21+
allowBlobPublicAccess: false
22+
networkAcls: {
23+
defaultAction: 'Deny'
24+
}
25+
}
26+
}
27+
28+
output storageAccountName string = storageAccount.name

‎bicep/vmManagedIdentity.bicep‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
targetScope = 'resourceGroup'
2+
import {tags_t} from './types.bicep'
3+
4+
param name string
5+
param location string
6+
param applyRoleAssignments bool = true
7+
param tags tags_t = {}
8+
9+
//create managed identity for CycleCloud VM
10+
resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
11+
name: name
12+
location: location
13+
tags: tags
14+
}
15+
16+
module ccwCycleCloudVirtualMachineRoleAssignments './vmManagedIdentityRoleAssignments.bicep' = if (applyRoleAssignments) {
17+
name: 'ccwRoleForCycleCloudVirtualMachine-${location}'
18+
scope: subscription()
19+
params: {
20+
roles: [
21+
'Contributor'
22+
'Storage Account Contributor'
23+
'Storage Blob Data Contributor'
24+
]
25+
principalId: managedIdentity.properties.principalId
26+
}
27+
}

bicep/vmRoleAssignments.bicep renamed to bicep/vmManagedIdentityRoleAssignments.bicep

File renamed without changes.

bicep/mi.bicep renamed to bicep/vmssManagedIdentity.bicep

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@ import {tags_t} from './types.bicep'
44
param name string
55
param location string
66
param storageAccountName string
7-
param tags tags_t
7+
param applyRoleAssignments bool = true
8+
param tags tags_t = {}
89

910
//create managed identity for VMSSs
1011
resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
@@ -13,7 +14,7 @@ resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-
1314
tags: tags
1415
}
1516

16-
module ccwMIRoleAssignments './miRoleAssignments.bicep' = {
17+
module ccwLockerManagedIdentityRoleAssignments './vmssManagedIdentityRoleAssignments.bicep' = if (applyRoleAssignments) {
1718
name: 'ccwRoleForLockerManagedIdentity'
1819
params: {
1920
principalId: managedIdentity.properties.principalId

bicep/miRoleAssignments.bicep renamed to bicep/vmssManagedIdentityRoleAssignments.bicep

File renamed without changes.

‎util/ccw_prerequisites.sh‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
#!/bin/bash
2+
set -e
3+
4+
cd "$(dirname "$0")/.."
5+
6+
# Initialize variables
7+
RESOURCE_GROUP=""
8+
LOCATION=""
9+
APPLY_ROLE_ASSIGNMENTS=true
10+
11+
# Parse arguments
12+
while [ "$#" -gt 0 ]; do
13+
case "$1" in
14+
-rg|--resource-group)
15+
RESOURCE_GROUP="$2"
16+
shift 2
17+
;;
18+
-l|--location)
19+
LOCATION="$2"
20+
shift 2
21+
;;
22+
--no-role-assignments)
23+
APPLY_ROLE_ASSIGNMENTS=false
24+
shift
25+
;;
26+
-h|--help)
27+
# TODO AGB: Clean up
28+
echo "Usage: $0 --resource-group <resource group name> --location <Azure region> [--no-role-assignments]"
29+
echo " or: $0 -rg <resource group name> -l <Azure region> [--no-role-assignments]"
30+
echo " --no-role-assignments: Do not apply role assignments to the managed identities."
31+
exit 0
32+
;;
33+
*)
34+
echo "Unknown parameter: $1"
35+
echo "Use --help for usage information."
36+
exit 1
37+
;;
38+
esac
39+
done
40+
41+
# Check if the resource group exists and create it if it doesn't
42+
echo Checking if resource group "${RESOURCE_GROUP}" exists...
43+
RG_EXISTS=$(az group exists -n "$RESOURCE_GROUP" | tr -d '\r\n')
44+
if [ "$RG_EXISTS" = "false" ]; then
45+
echo "Resource group '$RESOURCE_GROUP' does not exist. Creating it in location '$LOCATION'."
46+
az group create -n "$RESOURCE_GROUP" -l "$LOCATION"
47+
48+
while RG_CREATED=$(az group exists -n "$RESOURCE_GROUP" | tr -d '\r\n'); [ "$RG_CREATED" = "false" ]; do
49+
echo "Waiting for resource group '$RESOURCE_GROUP' to be created..."
50+
sleep 1
51+
done
52+
fi
53+
54+
echo Deploying storage account to resource group "${RESOURCE_GROUP}" in location "${LOCATION}"...
55+
STORAGE_DEPLOYMENT_NAME="ccw-storage-deployment-${RESOURCE_GROUP}-${LOCATION}"
56+
az deployment group create \
57+
--resource-group "$RESOURCE_GROUP" \
58+
--template-file $(pwd)/bicep/storage-new.bicep \
59+
--parameters location="$LOCATION" \
60+
--name "$STORAGE_DEPLOYMENT_NAME"
61+
62+
STORAGE_ACCOUNT_NAME=$(az deployment group show -g "$RESOURCE_GROUP" -n "$STORAGE_DEPLOYMENT_NAME" --query "properties.outputs.storageAccountName.value" -o tsv | tr -d '\r\n')
63+
64+
echo Creating managed identity for virtual machine scale sets in resource group "${RESOURCE_GROUP}" in location "${LOCATION}"...
65+
if [ "$APPLY_ROLE_ASSIGNMENTS" = true ]; then
66+
echo "Role assignments will be applied after the managed identity is created."
67+
else
68+
echo "Role assignments will NOT be applied as requested."
69+
fi
70+
az deployment group create \
71+
--resource-group "$RESOURCE_GROUP" \
72+
--template-file $(pwd)/bicep/vmssManagedIdentity.bicep \
73+
--parameters name="ccwLockerManagedIdentity" \
74+
--parameters location="$LOCATION" \
75+
--parameters storageAccountName="$STORAGE_ACCOUNT_NAME" \
76+
--parameters applyRoleAssignments="$APPLY_ROLE_ASSIGNMENTS" \
77+
--name "ccw-vmss-mi-deployment-${RESOURCE_GROUP}-${LOCATION}"
78+
79+
echo Creating managed identity for the CycleCloud virtual machine in resource group "${RESOURCE_GROUP}" in location "${LOCATION}"...
80+
if [ "$APPLY_ROLE_ASSIGNMENTS" = true ]; then
81+
echo "Role assignments will be applied after the managed identity is created."
82+
else
83+
echo "Role assignments will NOT be applied as requested."
84+
fi
85+
az deployment group create \
86+
--resource-group "$RESOURCE_GROUP" \
87+
--template-file $(pwd)/bicep/vmManagedIdentity.bicep \
88+
--parameters name="ccwCycleCloudVirtualMachineManagedIdentity" \
89+
--parameters location="$LOCATION" \
90+
--parameters applyRoleAssignments="$APPLY_ROLE_ASSIGNMENTS" \
91+
--name "ccw-vm-mi-deployment-${RESOURCE_GROUP}-${LOCATION}"

0 commit comments

Comments
 (0)