use static web hosting

Signed-off-by: Jack Francis <[email protected]>

Author: jackfrancis

Makefile

@@ -196,7 +196,7 @@ LDFLAGS := $(shell hack/version.sh)
 CLUSTER_TEMPLATE ?= cluster-template.yaml
 
 export KIND_CLUSTER_NAME ?= capz
-RANDOM_SUFFIX := $(shell /bin/bash -c "echo $$RANDOM")
+export RANDOM_SUFFIX := $(shell /bin/bash -c "echo $$RANDOM")
 export AZWI_RESOURCE_GROUP ?= capz-wi-$(RANDOM_SUFFIX)
 export CI_RG ?= $(AZWI_RESOURCE_GROUP)
 export USER_IDENTITY ?= $(addsuffix $(RANDOM_SUFFIX),$(CI_RG))

scripts/kind-with-registry.sh

@@ -27,15 +27,15 @@ source "${REPO_ROOT}/hack/ensure-tags.sh"
 KUBECTL="${REPO_ROOT}/hack/tools/bin/kubectl"
 KIND="${REPO_ROOT}/hack/tools/bin/kind"
 AZWI="${REPO_ROOT}/hack/tools/bin/azwi"
-AZWI_ENABLED=${AZWI_ENABLED:-true}
-RAND_SUFFIX=$(openssl rand -hex 4)
-export AZWI_STORAGE_ACCOUNT="oidcissuer${RAND_SUFFIX}"
-export AZWI_STORAGE_CONTAINER="oidc"
-export SERVICE_ACCOUNT_ISSUER=${SERVICE_ACCOUNT_ISSUER:-}
-export SERVICE_ACCOUNT_SIGNING_PUB_FILEPATH=${SERVICE_ACCOUNT_SIGNING_PUB_FILEPATH:-}
-export SERVICE_ACCOUNT_SIGNING_KEY_FILEPATH=${SERVICE_ACCOUNT_SIGNING_KEY_FILEPATH:-}
-export AZURE_CLIENT_ID_USER_ASSIGNED_IDENTITY=${AZURE_CLIENT_ID_USER_ASSIGNED_IDENTITY:-}
-export AZURE_IDENTITY_ID_FILEPATH=${AZURE_IDENTITY_ID_FILEPATH:-}
+AZWI_ENABLED="${AZWI_ENABLED:-true}"
+RANDOM_SUFFIX="${RANDOM_SUFFIX:-$RANDOM}"
+export AZWI_STORAGE_ACCOUNT="oidcissuer${RANDOM_SUFFIX}"
+export AZWI_STORAGE_CONTAINER="\$web"
+export SERVICE_ACCOUNT_ISSUER="${SERVICE_ACCOUNT_ISSUER:-}"
+export SERVICE_ACCOUNT_SIGNING_PUB_FILEPATH="${SERVICE_ACCOUNT_SIGNING_PUB_FILEPATH:-}"
+export SERVICE_ACCOUNT_SIGNING_KEY_FILEPATH="${SERVICE_ACCOUNT_SIGNING_KEY_FILEPATH:-}"
+export AZURE_CLIENT_ID_USER_ASSIGNED_IDENTITY="${AZURE_CLIENT_ID_USER_ASSIGNED_IDENTITY:-}"
+export AZURE_IDENTITY_ID_FILEPATH="${AZURE_IDENTITY_ID_FILEPATH:-$REPO_ROOT/azure_identity_id}"
 make --directory="${REPO_ROOT}" "${KUBECTL##*/}" "${KIND##*/}"
 
 # Export desired cluster name; default is "capz"
@@ -70,7 +70,7 @@ fi
 # AZWI_RESOURCE_GROUP - Azure resource group where Workload Identity infra lives
 # AZWI_LOCATION - Azure location for Workload Identity infra
 # AZWI_STORAGE_ACCOUNT - Storage account in resource group $AZWI_RESOURCE_GROUP containing required artifacts
-# AZWI_STORAGE_CONTAINER - Name to use when creating a storage container in storage account $AZWI_STORAGE_ACCOUNT
+#    Must be configured for static website hosting
 # AZURE_CLIENT_ID_USER_ASSIGNED_IDENTITY - BYO existing user-assigned identity
 #    Should be a UUID that represents the clientID of the identity object
 # USER_IDENTITY - Name to use when creating a new user-assigned identity
@@ -100,18 +100,20 @@ function checkAZWIENVPreReqsAndCreateFiles() {
       echo "Creating resource group '${AZWI_RESOURCE_GROUP}' in '${AZWI_LOCATION}'"
       az group create --name "${AZWI_RESOURCE_GROUP}" --location "${AZWI_LOCATION}" --output none --only-show-errors --tags creationTimestamp="${TIMESTAMP}" jobName="${JOB_NAME}" buildProvenance="${BUILD_PROVENANCE}"
     fi
+    # Ensure that our connection to storage is inherited from the existing Azure login context
+    unset AZURE_STORAGE_KEY
+    unset AZURE_STORAGE_ACCOUNT
     if ! az storage account show --name "${AZWI_STORAGE_ACCOUNT}" --resource-group "${AZWI_RESOURCE_GROUP}" > /dev/null 2>&1; then
       echo "Creating storage account '${AZWI_STORAGE_ACCOUNT}' in '${AZWI_RESOURCE_GROUP}'"
-      az storage account create --resource-group "${AZWI_RESOURCE_GROUP}" --name "${AZWI_STORAGE_ACCOUNT}" --allow-blob-public-access true --output none --only-show-errors --tags creationTimestamp="${TIMESTAMP}" jobName="${JOB_NAME}" buildProvenance="${BUILD_PROVENANCE}"
+      az storage account create --resource-group "${AZWI_RESOURCE_GROUP}" --name "${AZWI_STORAGE_ACCOUNT}" --output none --only-show-errors --tags creationTimestamp="${TIMESTAMP}" jobName="${JOB_NAME}" buildProvenance="${BUILD_PROVENANCE}"
+      az storage blob service-properties update --account-name "${AZWI_STORAGE_ACCOUNT}" --static-website
     fi
-    # Ensure that we our connection to storage is inherited from the existing Azure login context
-    unset AZURE_STORAGE_KEY
-    unset AZURE_STORAGE_ACCOUNT
     if ! az storage container show --name "${AZWI_STORAGE_CONTAINER}" --account-name "${AZWI_STORAGE_ACCOUNT}" > /dev/null 2>&1; then
       echo "Creating storage container '${AZWI_STORAGE_CONTAINER}' in '${AZWI_STORAGE_ACCOUNT}'"
-      az storage container create --name "${AZWI_STORAGE_CONTAINER}" --account-name "${AZWI_STORAGE_ACCOUNT}" --public-access blob --output none --only-show-errors
+      az storage container create --name "${AZWI_STORAGE_CONTAINER}" --account-name "${AZWI_STORAGE_ACCOUNT}" --output none --only-show-errors
     fi
-    export SERVICE_ACCOUNT_ISSUER="https://${AZWI_STORAGE_ACCOUNT}.blob.core.windows.net/${AZWI_STORAGE_CONTAINER}/"
+    SERVICE_ACCOUNT_ISSUER=$(az storage account show --name "${AZWI_STORAGE_ACCOUNT}" -o json | jq -r .primaryEndpoints.web)
+    export SERVICE_ACCOUNT_ISSUER
     AZWI_OPENID_CONFIG_FILEPATH="${REPO_ROOT}/openid-configuration.json"
     cat <<EOF > "${AZWI_OPENID_CONFIG_FILEPATH}"
 {