Skip to content

Commit 9bbc558

Browse files
abatallasabatallas
committed
Create utility script and associated bicep for BYO MIs and storage acct
1 parent 53eeb87 commit 9bbc558

4 files changed

Lines changed: 150 additions & 2 deletions

File tree

‎bicep/mi-vm.bicep‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
targetScope = 'resourceGroup'
2+
import {tags_t} from './types.bicep'
3+
4+
param name string
5+
param location string
6+
param performRoleAssignments bool = true
7+
param tags tags_t = {}
8+
9+
//create managed identity for CycleCloud VM
10+
resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
11+
name: name
12+
location: location
13+
tags: tags
14+
}
15+
16+
module ccwCycleCloudVirtualMachineRoleAssignments './vmRoleAssignments.bicep' = if (performRoleAssignments) {
17+
name: 'ccwRoleForCycleCloudVirtualMachine-${location}'
18+
scope: subscription()
19+
params: {
20+
roles: [
21+
'Contributor'
22+
'Storage Account Contributor'
23+
'Storage Blob Data Contributor'
24+
]
25+
principalId: managedIdentity.properties.principalId
26+
}
27+
}

‎bicep/mi.bicep‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@ import {tags_t} from './types.bicep'
44
param name string
55
param location string
66
param storageAccountName string
7-
param tags tags_t
7+
param performRoleAssignments bool = true
8+
param tags tags_t = {}
89

910
//create managed identity for VMSSs
1011
resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
@@ -13,7 +14,7 @@ resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-
1314
tags: tags
1415
}
1516

16-
module ccwMIRoleAssignments './miRoleAssignments.bicep' = {
17+
module ccwLockerManagedIdentityRoleAssignments './miRoleAssignments.bicep' = if (performRoleAssignments) {
1718
name: 'ccwRoleForLockerManagedIdentity'
1819
params: {
1920
principalId: managedIdentity.properties.principalId

‎bicep/storage-new.bicep‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
targetScope = 'resourceGroup'
2+
import {tags_t} from './types.bicep'
3+
4+
var storageAccountName = 'ccwstorage${uniqueString(az.resourceGroup().id)}'
5+
param location string
6+
param tags tags_t = {}
7+
8+
resource storageAccount 'Microsoft.Storage/storageAccounts@2024-01-01' = {
9+
name: storageAccountName
10+
location: location
11+
tags: tags
12+
sku: {
13+
name: 'Standard_LRS'
14+
}
15+
kind: 'StorageV2'
16+
properties:{
17+
accessTier: 'Hot'
18+
minimumTlsVersion: 'TLS1_2'
19+
allowSharedKeyAccess: false
20+
publicNetworkAccess: 'Disabled'
21+
allowBlobPublicAccess: false
22+
networkAcls: {
23+
defaultAction: 'Deny'
24+
}
25+
}
26+
}
27+
28+
output storageAccountName string = storageAccount.name

‎util/ccw_prerequisites.sh‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
#!/bin/bash
2+
set -e
3+
4+
cd "$(dirname "$0")/.."
5+
6+
# Initialize variables
7+
RESOURCE_GROUP=""
8+
LOCATION=""
9+
EXECUTE_ROLE_ASSIGNMENTS=true
10+
11+
# Parse arguments
12+
while [ "$#" -gt 0 ]; do
13+
case "$1" in
14+
-rg|--resource-group)
15+
RESOURCE_GROUP="$2"
16+
shift 2
17+
;;
18+
-l|--location)
19+
LOCATION="$2"
20+
shift 2
21+
;;
22+
--no-role-assignments)
23+
EXECUTE_ROLE_ASSIGNMENTS=false
24+
shift
25+
;;
26+
-h|--help)
27+
# TODO AGB: Clean up
28+
echo "Usage: $0 --resource-group <resource group name> --location <Azure region> [--what-if] [--force]"
29+
echo " or: $0 -rg <resource group name> -l <Azure region> [--what-if] [--force]"
30+
echo " --what-if: Perform a what-if deployment without making changes."
31+
echo " --force: Force the creation of resources even if they already exist."
32+
exit 0
33+
;;
34+
*)
35+
echo "Unknown parameter: $1"
36+
echo "Use --help for usage information."
37+
exit 1
38+
;;
39+
esac
40+
done
41+
42+
# Check if the resource group exists and create it if it doesn't
43+
echo Checking if resource group "${RESOURCE_GROUP}" exists...
44+
RG_EXISTS=$(az group exists -n "$RESOURCE_GROUP" | tr -d '\r\n')
45+
if [ "$RG_EXISTS" = "false" ]; then
46+
echo "Resource group '$RESOURCE_GROUP' does not exist. Creating it in location '$LOCATION'."
47+
az group create -n "$RESOURCE_GROUP" -l "$LOCATION"
48+
49+
while RG_CREATED=$(az group exists -n "$RESOURCE_GROUP" | tr -d '\r\n'); [ "$RG_CREATED" = "false" ]; do
50+
echo "Waiting for resource group '$RESOURCE_GROUP' to be created..."
51+
sleep 1
52+
done
53+
fi
54+
55+
echo Deploying storage account to resource group "${RESOURCE_GROUP}" in location "${LOCATION}"...
56+
STORAGE_DEPLOYMENT_NAME="ccw-storage-deployment-${RESOURCE_GROUP}-${LOCATION}"
57+
az deployment group create \
58+
--resource-group "$RESOURCE_GROUP" \
59+
--template-file $(pwd)/bicep/storage-new.bicep \
60+
--parameters location="$LOCATION" \
61+
--name "$STORAGE_DEPLOYMENT_NAME"
62+
63+
STORAGE_ACCOUNT_NAME=$(az deployment group show -g "$RESOURCE_GROUP" -n "$STORAGE_DEPLOYMENT_NAME" --query "properties.outputs.storageAccountName.value" -o tsv | tr -d '\r\n')
64+
65+
echo Creating managed identity for virtual machine scale sets in resource group "${RESOURCE_GROUP}" in location "${LOCATION}"...
66+
if [ "$EXECUTE_ROLE_ASSIGNMENTS" = true ]; then
67+
echo "Role assignments will be applied after the managed identity is created."
68+
else
69+
echo "Role assignments will NOT be applied as requested."
70+
fi
71+
az deployment group create \
72+
--resource-group "$RESOURCE_GROUP" \
73+
--template-file $(pwd)/bicep/mi.bicep \
74+
--parameters name="ccwLockerManagedIdentity" \
75+
--parameters location="$LOCATION" \
76+
--parameters storageAccountName="$STORAGE_ACCOUNT_NAME" \
77+
--parameters performRoleAssignments="$EXECUTE_ROLE_ASSIGNMENTS" \
78+
--name "ccw-vmss-mi-deployment-${RESOURCE_GROUP}-${LOCATION}"
79+
80+
echo Creating managed identity for the CycleCloud virtual machine in resource group "${RESOURCE_GROUP}" in location "${LOCATION}"...
81+
if [ "$EXECUTE_ROLE_ASSIGNMENTS" = true ]; then
82+
echo "Role assignments will be applied after the managed identity is created."
83+
else
84+
echo "Role assignments will NOT be applied as requested."
85+
fi
86+
az deployment group create \
87+
--resource-group "$RESOURCE_GROUP" \
88+
--template-file $(pwd)/bicep/mi-vm.bicep \
89+
--parameters name="ccwCycleCloudVirtualMachineManagedIdentity" \
90+
--parameters location="$LOCATION" \
91+
--parameters performRoleAssignments="$EXECUTE_ROLE_ASSIGNMENTS" \
92+
--name "ccw-vm-mi-deployment-${RESOURCE_GROUP}-${LOCATION}"

0 commit comments

Comments
 (0)