Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Spike]: API for role assignments #6636

Draft
wants to merge 11 commits into
base: main
Choose a base branch
from
Draft

[Spike]: API for role assignments #6636

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
0ccfd21
Spike of API
davidfowl Nov 8, 2024
b81fe65
Next step
davidfowl Nov 8, 2024
3649a93
Next phase
davidfowl Nov 8, 2024
48d3cb0
Least privilege
davidfowl Nov 8, 2024
88005a0
More tweaks
davidfowl Nov 8, 2024
39df7aa
Cleaned up some APIs
davidfowl Nov 9, 2024
27a3d6f
Fixed tests and clean up processing
davidfowl Nov 10, 2024
6d5109a
Name the identity after the compute resource to avoid conflicts
davidfowl Nov 10, 2024
c005f6e
Added RoleDefinition
davidfowl Nov 10, 2024
6d734e2
Fix tests
davidfowl Nov 10, 2024
43a2b78
Changed the order
davidfowl Nov 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions playground/AzureContainerApps/AzureContainerApps.AppHost/AzureContainerApps.AppHost.sln
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@

Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio Version 17
VisualStudioVersion = 17.5.002.0
MinimumVisualStudioVersion = 10.0.40219.1
Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "AzureContainerApps.AppHost", "AzureContainerApps.AppHost.csproj", "{55003C7C-F6C0-469F-BA6A-C5EC13AB0763}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{55003C7C-F6C0-469F-BA6A-C5EC13AB0763}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{55003C7C-F6C0-469F-BA6A-C5EC13AB0763}.Debug|Any CPU.Build.0 = Debug|Any CPU
{55003C7C-F6C0-469F-BA6A-C5EC13AB0763}.Release|Any CPU.ActiveCfg = Release|Any CPU
{55003C7C-F6C0-469F-BA6A-C5EC13AB0763}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {CE4F7DF9-62F5-454C-AE1B-D442D49897CA}
EndGlobalSection
EndGlobal
4 changes: 4 additions & 0 deletions playground/AzureContainerApps/AzureContainerApps.AppHost/Program.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@

#pragma warning disable ASPIREACADOMAINS001 // Type is for evaluation purposes only and is subject to change or removal in future updates. Suppress this diagnostic to proceed.

using Azure.Provisioning.Storage;

var builder = DistributedApplication.CreateBuilder(args);

var customDomain = builder.AddParameter("customDomain");
Expand All @@ -23,6 +25,7 @@

// Testing a connection string
var blobs = builder.AddAzureStorage("storage")
.RemoveDefaultRoleAssignments()
.RunAsEmulator(c => c.WithLifetime(ContainerLifetime.Persistent))
.AddBlobs("blobs");

Expand All @@ -34,6 +37,7 @@
builder.AddProject<Projects.AzureContainerApps_ApiService>("api")
.WithExternalHttpEndpoints()
.WithReference(blobs)
.WithRoleAssignments(blobs, StorageBuiltInRole.StorageBlobDataContributor)
.WithReference(redis)
.WithReference(cosmosDb)
.WithEnvironment("VALUE", param)
Expand Down
27 changes: 27 additions & 0 deletions playground/AzureContainerApps/AzureContainerApps.AppHost/api-roles.module.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
@description('The location for the resource(s) to be deployed.')
param location string = resourceGroup().location

param storage_outputs_name string

resource identity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We generate a module per container/project and that module has both the user assigned identity and role assignments for that compute resource.

name: take('identity-${uniqueString(resourceGroup().id)}', 128)
location: location
}

resource storage 'Microsoft.Storage/storageAccounts@2024-01-01' existing = {
name: storage_outputs_name
}
Comment on lines +11 to +13
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to reference the set of resources we are creating role assignments for.


resource storage_ba92f5b4_2d11_453d_a403_e96b0029c9fe 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
name: guid(storage.id, identity.id, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'))
properties: {
principalId: identity.properties.principalId
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')
principalType: 'ServicePrincipal'
}
scope: storage
}

output id string = identity.id

output clientId string = identity.properties.clientId
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These end up as outputs for the container app to use for both runtime and to associate this user assigned identity with the container app.

19 changes: 11 additions & 8 deletions playground/AzureContainerApps/AzureContainerApps.AppHost/api.module.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,10 @@
@description('The location for the resource(s) to be deployed.')
param location string = resourceGroup().location

param api_roles_outputs_id string

param api_roles_outputs_clientid string

param api_containerport string

param storage_outputs_blobendpoint string
Expand All @@ -12,17 +16,15 @@ param outputs_azure_container_registry_managed_identity_id string
@secure()
param secretparam_value string

param outputs_managed_identity_client_id string

param outputs_azure_container_apps_environment_id string

param outputs_azure_container_registry_endpoint string

param api_containerimage string

param certificateName string
param certificatename_value string

param customDomain string
param customdomain_value string

resource account_secretoutputs_kv 'Microsoft.KeyVault/vaults@2023-07-01' existing = {
name: account_secretoutputs
Expand Down Expand Up @@ -56,9 +58,9 @@ resource api 'Microsoft.App/containerApps@2024-03-01' = {
transport: 'http'
customDomains: [
{
name: customDomain
bindingType: (certificateName != '') ? 'SniEnabled' : 'Disabled'
certificateId: (certificateName != '') ? '${outputs_azure_container_apps_environment_id}/managedCertificates/${certificateName}' : null
name: customdomain_value
bindingType: (certificatename_value != '') ? 'SniEnabled' : 'Disabled'
certificateId: (certificatename_value != '') ? '${outputs_azure_container_apps_environment_id}/managedCertificates/${certificatename_value}' : null
}
]
}
Expand Down Expand Up @@ -114,7 +116,7 @@ resource api 'Microsoft.App/containerApps@2024-03-01' = {
}
{
name: 'AZURE_CLIENT_ID'
value: outputs_managed_identity_client_id
value: api_roles_outputs_clientid
}
]
}
Expand All @@ -127,6 +129,7 @@ resource api 'Microsoft.App/containerApps@2024-03-01' = {
identity: {
type: 'UserAssigned'
userAssignedIdentities: {
'${api_roles_outputs_id}': { }
'${outputs_azure_container_registry_managed_identity_id}': { }
}
}
Expand Down
22 changes: 12 additions & 10 deletions playground/AzureContainerApps/AzureContainerApps.AppHost/aspire-manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,6 @@
"params": {
"cache_volumes_0_storage": "{cache.volumes.0.storage}",
"outputs_azure_container_registry_managed_identity_id": "{.outputs.AZURE_CONTAINER_REGISTRY_MANAGED_IDENTITY_ID}",
"outputs_managed_identity_client_id": "{.outputs.MANAGED_IDENTITY_CLIENT_ID}",
"outputs_azure_container_apps_environment_id": "{.outputs.AZURE_CONTAINER_APPS_ENVIRONMENT_ID}"
}
},
Expand Down Expand Up @@ -74,11 +73,7 @@
},
"storage": {
"type": "azure.bicep.v0",
"path": "storage.module.bicep",
"params": {
"principalId": "",
"principalType": ""
}
"path": "storage.module.bicep"
},
"blobs": {
"type": "value.v0",
Expand All @@ -95,7 +90,6 @@
"path": "pythonapp.module.bicep",
"params": {
"outputs_azure_container_registry_managed_identity_id": "{.outputs.AZURE_CONTAINER_REGISTRY_MANAGED_IDENTITY_ID}",
"outputs_managed_identity_client_id": "{.outputs.MANAGED_IDENTITY_CLIENT_ID}",
"outputs_azure_container_apps_environment_id": "{.outputs.AZURE_CONTAINER_APPS_ENVIRONMENT_ID}",
"outputs_azure_container_registry_endpoint": "{.outputs.AZURE_CONTAINER_REGISTRY_ENDPOINT}",
"pythonapp_containerimage": "{pythonapp.containerImage}"
Expand All @@ -109,17 +103,18 @@
"type": "azure.bicep.v0",
"path": "api.module.bicep",
"params": {
"api_roles_outputs_id": "{api-roles.outputs.id}",
"api_roles_outputs_clientid": "{api-roles.outputs.clientId}",
"api_containerport": "{api.containerPort}",
"storage_outputs_blobendpoint": "{storage.outputs.blobEndpoint}",
"account_secretoutputs": "{account.secretOutputs}",
"outputs_azure_container_registry_managed_identity_id": "{.outputs.AZURE_CONTAINER_REGISTRY_MANAGED_IDENTITY_ID}",
"secretparam_value": "{secretparam.value}",
"outputs_managed_identity_client_id": "{.outputs.MANAGED_IDENTITY_CLIENT_ID}",
"outputs_azure_container_apps_environment_id": "{.outputs.AZURE_CONTAINER_APPS_ENVIRONMENT_ID}",
"outputs_azure_container_registry_endpoint": "{.outputs.AZURE_CONTAINER_REGISTRY_ENDPOINT}",
"api_containerimage": "{api.containerImage}",
"certificateName": "{certificateName.value}",
"customDomain": "{customDomain.value}"
"certificatename_value": "{certificateName.value}",
"customdomain_value": "{customDomain.value}"
}
},
"env": {
Expand Down Expand Up @@ -147,6 +142,13 @@
"external": true
}
}
},
"api-roles": {
"type": "azure.bicep.v0",
"path": "api-roles.module.bicep",
"params": {
"storage_outputs_name": "{storage.outputs.name}"
}
}
}
}
8 changes: 0 additions & 8 deletions playground/AzureContainerApps/AzureContainerApps.AppHost/cache.module.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,6 @@ param cache_volumes_0_storage string

param outputs_azure_container_registry_managed_identity_id string

param outputs_managed_identity_client_id string

param outputs_azure_container_apps_environment_id string

resource cache 'Microsoft.App/containerApps@2024-03-01' = {
Expand All @@ -32,12 +30,6 @@ resource cache 'Microsoft.App/containerApps@2024-03-01' = {
'60'
'1'
]
env: [
{
name: 'AZURE_CLIENT_ID'
value: outputs_managed_identity_client_id
}
]
volumeMounts: [
{
volumeName: 'v0'
Expand Down
8 changes: 0 additions & 8 deletions playground/AzureContainerApps/AzureContainerApps.AppHost/pythonapp.module.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,6 @@ param location string = resourceGroup().location

param outputs_azure_container_registry_managed_identity_id string

param outputs_managed_identity_client_id string

param outputs_azure_container_apps_environment_id string

param outputs_azure_container_registry_endpoint string
Expand All @@ -30,12 +28,6 @@ resource pythonapp 'Microsoft.App/containerApps@2024-03-01' = {
{
image: pythonapp_containerimage
name: 'pythonapp'
env: [
{
name: 'AZURE_CLIENT_ID'
value: outputs_managed_identity_client_id
}
]
}
]
scale: {
Expand Down
38 changes: 3 additions & 35 deletions playground/AzureContainerApps/AzureContainerApps.AppHost/storage.module.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,6 @@
@description('The location for the resource(s) to be deployed.')
param location string = resourceGroup().location

param principalId string

param principalType string

resource storage 'Microsoft.Storage/storageAccounts@2024-01-01' = {
name: take('storage${uniqueString(resourceGroup().id)}', 24)
kind: 'StorageV2'
Expand All @@ -30,38 +26,10 @@ resource blobs 'Microsoft.Storage/storageAccounts/blobServices@2024-01-01' = {
parent: storage
}

resource storage_StorageBlobDataContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
name: guid(storage.id, principalId, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'))
properties: {
principalId: principalId
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')
principalType: principalType
}
scope: storage
}

resource storage_StorageTableDataContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
name: guid(storage.id, principalId, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3'))
properties: {
principalId: principalId
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')
principalType: principalType
}
scope: storage
}

resource storage_StorageQueueDataContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
name: guid(storage.id, principalId, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88'))
properties: {
principalId: principalId
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')
principalType: principalType
}
scope: storage
}

output blobEndpoint string = storage.properties.primaryEndpoints.blob

output queueEndpoint string = storage.properties.primaryEndpoints.queue

output tableEndpoint string = storage.properties.primaryEndpoints.table
output tableEndpoint string = storage.properties.primaryEndpoints.table

output name string = storage.name
Loading
Loading