Skip to content

Commit 72dea81

Browse files
author
Federico Arambarri
committed
Update microservice RI and make it work again
1 parent 15a3e6a commit 72dea81

32 files changed

+689
-1373
lines changed

Diff for: ‎azuredeploy.bicep

+265
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,265 @@
1+
param acrResourceGroupName string
2+
param acrName string
3+
4+
param location string = resourceGroup().location
5+
6+
@description('Name of the delivery managed identity')
7+
param deliveryIdName string
8+
9+
@description('Name of the drone scheduler managed identity')
10+
param droneSchedulerIdName string
11+
12+
@description('Name of the workflow managed identity')
13+
param workflowIdName string
14+
15+
@description('Name of the ingestion managed identity')
16+
param ingestionIdName string
17+
18+
@description('Name of the package managed identity')
19+
param packageIdName string
20+
21+
@description('Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example \'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm\'')
22+
param sshRSAPublicKey string
23+
24+
@description('Client ID (used by cloudprovider)')
25+
param servicePrincipalClientId string
26+
27+
@description('The Service Principal Client Secret.')
28+
@secure()
29+
param servicePrincipalClientSecret string
30+
31+
@description('The type of operating system.')
32+
@allowed([
33+
'Linux'
34+
])
35+
param osType string = 'Linux'
36+
37+
@description('Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize.')
38+
@minValue(0)
39+
@maxValue(1023)
40+
param osDiskSizeGB int = 0
41+
42+
@description('User name for the Linux Virtual Machines.')
43+
param adminUsername string = 'azureuser'
44+
45+
@description('The version of Kubernetes. It must be supported in the target location.')
46+
param kubernetesVersion string
47+
48+
@description('Type of the storage account that will store Redis Cache.')
49+
@allowed([
50+
'Standard_LRS'
51+
'Standard_ZRS'
52+
'Standard_GRS'
53+
])
54+
param deliveryRedisStorageType string = 'Standard_LRS'
55+
56+
var clusterNamePrefix = 'aks'
57+
var managedIdentityOperatorRoleId = subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f1a07417-d97a-45cb-824c-7a7467783830')
58+
var deliveryRedisStorageName = 'rsto${uniqueString(resourceGroup().id)}'
59+
var nestedACRDeploymentName = 'azuredeploy-acr-${acrResourceGroupName}'
60+
var aksLogAnalyticsNamePrefix = 'logsAnalytics'
61+
var monitoringMetricsPublisherRole = subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3913510d-42f4-4e42-8a64-420c390055eb')
62+
var nodeResourceGroupName = 'rg-${aksClusterName}-nodepools'
63+
var aksClusterName = uniqueString(clusterNamePrefix, resourceGroup().id)
64+
var agentCount = 2
65+
var agentVMSize = 'Standard_D2_v2'
66+
var workspaceName = 'la-${uniqueString(aksLogAnalyticsNamePrefix, resourceGroup().id)}'
67+
var workspaceSku = 'pergb2018'
68+
var workspaceRetentionInDays = 0
69+
70+
module nestedACRDeployment './azuredeploy_nested_nestedACRDeployment.bicep' = {
71+
name: nestedACRDeploymentName
72+
scope: resourceGroup(acrResourceGroupName)
73+
params: {
74+
clusterIdentity: aksCluster.properties.identityProfile.kubeletidentity.objectId
75+
acrName: acrName
76+
}
77+
}
78+
79+
resource workspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
80+
name: workspaceName
81+
location: location
82+
properties: {
83+
retentionInDays: workspaceRetentionInDays
84+
sku: {
85+
name: workspaceSku
86+
}
87+
features: {
88+
searchVersion: 1
89+
}
90+
}
91+
}
92+
93+
resource aksCluster 'Microsoft.ContainerService/managedClusters@2023-07-02-preview' = {
94+
name: aksClusterName
95+
location: location
96+
tags: {
97+
environment: 'shared cluster'
98+
}
99+
properties: {
100+
kubernetesVersion: kubernetesVersion
101+
nodeResourceGroup: nodeResourceGroupName
102+
dnsPrefix: aksClusterName
103+
agentPoolProfiles: [
104+
{
105+
name: 'agentpool'
106+
osDiskSizeGB: osDiskSizeGB
107+
count: agentCount
108+
vmSize: agentVMSize
109+
osType: osType
110+
mode: 'System'
111+
}
112+
]
113+
linuxProfile: {
114+
adminUsername: adminUsername
115+
ssh: {
116+
publicKeys: [
117+
{
118+
keyData: sshRSAPublicKey
119+
}
120+
]
121+
}
122+
}
123+
servicePrincipalProfile: {
124+
clientId: servicePrincipalClientId
125+
secret: servicePrincipalClientSecret
126+
}
127+
addonProfiles: {
128+
omsagent: {
129+
config: {
130+
logAnalyticsWorkspaceResourceID: workspace.id
131+
}
132+
enabled: true
133+
}
134+
azureKeyvaultSecretsProvider: {
135+
enabled: true
136+
config: {
137+
enableSecretRotation: 'false'
138+
}
139+
}
140+
}
141+
oidcIssuerProfile: {
142+
enabled: true
143+
}
144+
podIdentityProfile: {
145+
enabled: false
146+
}
147+
securityProfile: {
148+
workloadIdentity: {
149+
enabled: true
150+
}
151+
}
152+
}
153+
identity: {
154+
type: 'SystemAssigned'
155+
}
156+
}
157+
158+
resource deliveryRedisStorage 'Microsoft.Storage/storageAccounts@2022-09-01' = {
159+
name: deliveryRedisStorageName
160+
sku: {
161+
name: deliveryRedisStorageType
162+
}
163+
kind: 'Storage'
164+
location: location
165+
tags: {
166+
displayName: 'Storage account for inflight deliveries'
167+
app: 'fabrikam-delivery'
168+
}
169+
}
170+
171+
resource aksClusterName_Microsoft_Authorization_id_monitoringMetricsPublisherRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
172+
name: guid(concat(resourceGroup().id), monitoringMetricsPublisherRole)
173+
scope: aksCluster
174+
properties: {
175+
roleDefinitionId: monitoringMetricsPublisherRole
176+
principalId: aksCluster.properties.identityProfile.kubeletidentity.objectId
177+
principalType: 'ServicePrincipal'
178+
}
179+
}
180+
181+
resource deliveryId 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' existing = {
182+
name: deliveryIdName
183+
}
184+
185+
resource deliveryIdName_Microsoft_Authorization_msi_delivery_id 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
186+
name: guid('msi-delivery', resourceGroup().id)
187+
scope: deliveryId
188+
properties: {
189+
roleDefinitionId: managedIdentityOperatorRoleId
190+
principalId: aksCluster.properties.identityProfile.kubeletidentity.objectId
191+
principalType: 'ServicePrincipal'
192+
}
193+
}
194+
195+
resource workflowId 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' existing = {
196+
name: workflowIdName
197+
}
198+
199+
resource workflowIdName_Microsoft_Authorization_msi_workflow_id 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
200+
name: guid('msi-workflow', resourceGroup().id)
201+
scope: workflowId
202+
properties: {
203+
roleDefinitionId: managedIdentityOperatorRoleId
204+
principalId: aksCluster.properties.identityProfile.kubeletidentity.objectId
205+
principalType: 'ServicePrincipal'
206+
}
207+
}
208+
209+
resource droneSchedulerId 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' existing = {
210+
name: droneSchedulerIdName
211+
}
212+
213+
resource droneSchedulerIdName_Microsoft_Authorization_msi_dronescheduler_id 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
214+
name: guid('msi-dronescheduler', resourceGroup().id)
215+
scope: droneSchedulerId
216+
properties: {
217+
roleDefinitionId: managedIdentityOperatorRoleId
218+
principalId: aksCluster.properties.identityProfile.kubeletidentity.objectId
219+
principalType: 'ServicePrincipal'
220+
}
221+
}
222+
223+
resource ingestionId 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' existing = {
224+
name: ingestionIdName
225+
}
226+
227+
resource ingestionIdName_Microsoft_Authorization_msi_ingestion_id 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
228+
name: guid('msi-ingestion', resourceGroup().id)
229+
scope: ingestionId
230+
properties: {
231+
roleDefinitionId: managedIdentityOperatorRoleId
232+
principalId: aksCluster.properties.identityProfile.kubeletidentity.objectId
233+
principalType: 'ServicePrincipal'
234+
}
235+
}
236+
237+
resource packageId 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' existing = {
238+
name: packageIdName
239+
}
240+
241+
resource packageIdName_Microsoft_Authorization_msi_package_id 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
242+
name: guid('msi-package', resourceGroup().id)
243+
scope: packageId
244+
properties: {
245+
roleDefinitionId: managedIdentityOperatorRoleId
246+
principalId: aksCluster.properties.identityProfile.kubeletidentity.objectId
247+
principalType: 'ServicePrincipal'
248+
}
249+
}
250+
251+
module EnsureClusterUserAssignedHasRbacToManageVMSS './azuredeploy_nested_EnsureClusterUserAssignedHasRbacToManageVMSS.bicep' = {
252+
name: 'EnsureClusterUserAssignedHasRbacToManageVMSS'
253+
scope: resourceGroup(nodeResourceGroupName)
254+
params: {
255+
clusterIdentity: aksCluster.properties.identityProfile.kubeletidentity.objectId
256+
}
257+
}
258+
259+
output aksClusterName string = aksClusterName
260+
output acrDeploymentName string = nestedACRDeploymentName
261+
output deliveryPrincipalResourceId string = deliveryId.id
262+
output workflowPrincipalResourceId string = workflowId.id
263+
output ingestionPrincipalResourceId string = ingestionId.id
264+
output packagePrincipalResourceId string = packageId.id
265+
output droneSchedulerPrincipalResourceId string = droneSchedulerId.id

0 commit comments

Comments
 (0)