MSI support for Linux consumption

MSI Token service is implemented as a sidecar which gets specialized when the main container (Functions host) is specialized.If MSI is enabled for a site, the specialization payload will include MSI_ENDPOINT and MSI_SECRET which function apps can use to communicate with Token Service.

Author: balag0

src/WebJobs.Script.WebHost/Controllers/InstanceController.cs

@@ -43,6 +43,14 @@ public async Task<IActionResult> Assign([FromBody] EncryptedHostAssignmentContex
                 return StatusCode(StatusCodes.Status400BadRequest, error);
             }
 
+            // Wait for Sidecar specialization to complete before returning ok.
+            // This shouldn't take too long so ok to do this sequentially.
+            error = await _instanceManager.SpecializeMSISidecar(assignmentContext);
+            if (error != null)
+            {
+                return StatusCode(StatusCodes.Status500InternalServerError, error);
+            }
+
             var result = _instanceManager.StartAssignment(assignmentContext);
 
             return result

src/WebJobs.Script.WebHost/Management/IInstanceManager.cs

@@ -14,5 +14,7 @@ public interface IInstanceManager
         Task<string> ValidateContext(HostAssignmentContext assignmentContext);
 
         bool StartAssignment(HostAssignmentContext assignmentContext);
+
+        Task<string> SpecializeMSISidecar(HostAssignmentContext assignmentContext);
     }
 }

src/WebJobs.Script.WebHost/Management/InstanceManager.cs

@@ -16,6 +16,7 @@
 using Microsoft.Azure.WebJobs.Script.WebHost.Models;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
+using Newtonsoft.Json;
 
 namespace Microsoft.Azure.WebJobs.Script.WebHost.Management
 {
@@ -42,6 +43,44 @@ public InstanceManager(IOptionsFactory<ScriptApplicationHostOptions> optionsFact
             _optionsFactory = optionsFactory ?? throw new ArgumentNullException(nameof(optionsFactory));
         }
 
+        public async Task<string> SpecializeMSISidecar(HostAssignmentContext context)
+        {
+            string endpoint;
+            var msiEnabled = context.IsMSIEnabled(out endpoint);
+
+            _logger.LogInformation($"MSI enabled status: {msiEnabled}");
+
+            if (msiEnabled)
+            {
+                using (_metricsLogger.LatencyEvent(MetricEventNames.LinuxContainerSpecializationMSIInit))
+                {
+                    var uri = new Uri(endpoint);
+                    var address = $"http://{uri.Host}:{uri.Port}{ScriptConstants.LinuxMSISpecializationStem}";
+
+                    _logger.LogDebug($"Specializing sidecar at {address}");
+
+                    var requestMessage = new HttpRequestMessage(HttpMethod.Post, address)
+                    {
+                        Content = new StringContent(JsonConvert.SerializeObject(context.MSIContext),
+                            Encoding.UTF8, "application/json")
+                    };
+
+                    var response = await _client.SendAsync(requestMessage);
+
+                    _logger.LogInformation($"Specialize MSI sidecar returned {response.StatusCode}");
+
+                    if (!response.IsSuccessStatusCode)
+                    {
+                        var message = $"Specialize MSI sidecar call failed. StatusCode={response.StatusCode}";
+                        _logger.LogError(message);
+                        return message;
+                    }
+                }
+            }
+
+            return null;
+        }
+
         public bool StartAssignment(HostAssignmentContext context)
         {
             if (!_webHostEnvironment.InStandbyMode)

src/WebJobs.Script.WebHost/Models/HostAssignmentContext.cs

@@ -21,6 +21,9 @@ public class HostAssignmentContext
         [JsonProperty("lastModifiedTime")]
         public DateTime LastModifiedTime { get; set; }
 
+        [JsonProperty("MSISpecializationPayload")]
+        public MSIContext MSIContext { get; set; }
+
         public string ZipUrl
         {
             get
@@ -44,6 +47,21 @@ public string ZipUrl
             }
         }
 
+        public bool IsMSIEnabled(out string endpoint)
+        {
+            endpoint = null;
+            if (Environment.TryGetValue(EnvironmentSettingNames.MsiEndpoint, out endpoint))
+            {
+                string secret;
+                if (Environment.TryGetValue(EnvironmentSettingNames.MsiSecret, out secret))
+                {
+                    return !string.IsNullOrEmpty(endpoint) && !string.IsNullOrEmpty(secret);
+                }
+            }
+
+            return false;
+        }
+
         public bool Equals(HostAssignmentContext other)
         {
             if (other == null)

src/WebJobs.Script.WebHost/Models/MSIContext.cs

@@ -0,0 +1,14 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for license information.
+
+using System.Collections.Generic;
+
+namespace Microsoft.Azure.WebJobs.Script.WebHost.Models
+{
+    public class MSIContext
+    {
+        public string MSISecret { get; set; }
+
+        public IEnumerable<ManagedServiceIdentity> Identities { get; set; }
+    }
+}

src/WebJobs.Script.WebHost/Models/ManagedServiceIdentity.cs

@@ -0,0 +1,22 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for license information.
+
+namespace Microsoft.Azure.WebJobs.Script.WebHost.Models
+{
+    public class ManagedServiceIdentity
+    {
+        public ManagedServiceIdentityType Type { get; set; }
+
+        public string ClientId { get; set; }
+
+        public string TenantId { get; set; }
+
+        public string Thumbprint { get; set; }
+
+        public string SecretUrl { get; set; }
+
+        public string ResourceId { get; set; }
+
+        public string Certificate { get; set; }
+    }
+}

src/WebJobs.Script.WebHost/Models/ManagedServiceIdentityType.cs

@@ -0,0 +1,19 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for license information.
+
+using System;
+using System.Runtime.Serialization;
+
+namespace Microsoft.Azure.WebJobs.Script.WebHost.Models
+{
+    [Flags]
+    public enum ManagedServiceIdentityType
+    {
+        [EnumMember]
+        None = 0,
+        [EnumMember]
+        SystemAssigned = 1,
+        [EnumMember]
+        UserAssigned = 2
+    }
+}

src/WebJobs.Script/Diagnostics/MetricEventNames.cs

@@ -44,5 +44,6 @@ public static class MetricEventNames
         public const string LinuxContainerSpecializationZipWrite = "linux.container.specialization.zip.write";
         public const string LinuxContainerSpecializationZipHead = "linux.container.specialization.zip.head";
         public const string LinuxContainerSpecializationFuseMount = "linux.container.specialization.zip.mount";
+        public const string LinuxContainerSpecializationMSIInit = "linux.container.specialization.msi.init";
     }
 }

src/WebJobs.Script/Environment/EnvironmentSettingNames.cs

@@ -36,6 +36,8 @@ public static class EnvironmentSettingNames
         public const string AzureWebJobsSecretStorageKeyVaultConnectionString = "AzureWebJobsSecretStorageKeyVaultConnectionString";
         public const string AzureWebsiteArmCacheEnabled = "WEBSITE_FUNCTIONS_ARMCACHE_ENABLED";
         public const string MountEnabled = "WEBSITE_MOUNT_ENABLED";
+        public const string MsiEndpoint = "MSI_ENDPOINT";
+        public const string MsiSecret = "MSI_SECRET";
 
         /// <summary>
         /// Environment variable dynamically set by the platform when it is safe to

src/WebJobs.Script/ScriptConstants.cs

@@ -115,6 +115,7 @@ public static class ScriptConstants
         public const string LinuxLogEventStreamName = "MS_FUNCTION_LOGS";
         public const string LinuxMetricEventStreamName = "MS_FUNCTION_METRICS";
         public const string LinuxFunctionDetailsEventStreamName = "MS_FUNCTION_DETAILS";
+        public const string LinuxMSISpecializationStem = "/api/specialize?api-version=2017-09-01";
 
         public const string DurableTaskPropertyName = "durableTask";
         public const string DurableTaskHubName = "HubName";