@@ -93,22 +93,27 @@ function checkAZWIENVPreReqsAndCreateFiles() {
9393 echo " AZWI_RESOURCE_GROUP environment variable required - Azure resource group to store required Workload Identity artifacts"
9494 exit 1
9595 fi
96+
9697 if [ " $( az group exists --name " ${AZWI_RESOURCE_GROUP} " ) " == ' false' ; then
9798 echo " Creating resource group '${AZWI_RESOURCE_GROUP} ' in '${AZWI_LOCATION} '"
9899 az group create --name " ${AZWI_RESOURCE_GROUP} " " ${AZWI_LOCATION} " " ${TIMESTAMP} " " ${JOB_NAME} " " ${BUILD_PROVENANCE} "
99100 fi
101+
100102 # Ensure that our connection to storage is inherited from the existing Azure login context
101103 unset AZURE_STORAGE_KEY
102104 unset AZURE_STORAGE_ACCOUNT
105+
103106 if ! az storage account show --name " ${AZWI_STORAGE_ACCOUNT} " " ${AZWI_RESOURCE_GROUP} " > /dev/null 2>&1 ; then
104107 echo " Creating storage account '${AZWI_STORAGE_ACCOUNT} ' in '${AZWI_RESOURCE_GROUP} '"
105108 az storage account create --resource-group " ${AZWI_RESOURCE_GROUP} " " ${AZWI_STORAGE_ACCOUNT} " " ${TIMESTAMP} " " ${JOB_NAME} " " ${BUILD_PROVENANCE} "
106- az storage blob service-properties update --account-name " ${AZWI_STORAGE_ACCOUNT} "
109+ az storage blob service-properties ${ENABLE_AUTH_MODE_LOGIN : + " --auth-mode login " } update --account-name " ${AZWI_STORAGE_ACCOUNT} "
107110 fi
111+
108112 if ! az storage container show --name " ${AZWI_STORAGE_CONTAINER} " " ${AZWI_STORAGE_ACCOUNT} " > /dev/null 2>&1 ; then
109113 echo " Creating storage container '${AZWI_STORAGE_CONTAINER} ' in '${AZWI_STORAGE_ACCOUNT} '"
110- az storage container create --name " ${AZWI_STORAGE_CONTAINER} " " ${AZWI_STORAGE_ACCOUNT} "
114+ az storage container ${ENABLE_AUTH_MODE_LOGIN : + " --auth-mode login " } create --name " ${AZWI_STORAGE_CONTAINER} " " ${AZWI_STORAGE_ACCOUNT} "
111115 fi
116+
112117 SERVICE_ACCOUNT_ISSUER=$( az storage account show --name " ${AZWI_STORAGE_ACCOUNT} " | jq -r .primaryEndpoints.web)
113118 export SERVICE_ACCOUNT_ISSUER
114119 AZWI_OPENID_CONFIG_FILEPATH=" ${REPO_ROOT} /openid-configuration.json"
@@ -131,30 +136,37 @@ EOF
131136 openssl rsa -in " ${SERVICE_ACCOUNT_SIGNING_KEY_FILEPATH} " " ${SERVICE_ACCOUNT_SIGNING_PUB_FILEPATH} "
132137 AZWI_JWKS_JSON_FILEPATH=" ${REPO_ROOT} /jwks.json"
133138 " ${AZWI} " " ${SERVICE_ACCOUNT_SIGNING_PUB_FILEPATH} " " ${AZWI_JWKS_JSON_FILEPATH} "
139+
134140 echo " Uploading openid-configuration document to '${AZWI_STORAGE_ACCOUNT} ' storage account"
135141 upload_to_blob " ${AZWI_OPENID_CONFIG_FILEPATH} " " .well-known/openid-configuration"
142+
136143 echo " Uploading jwks document to '${AZWI_STORAGE_ACCOUNT} ' storage account"
137144 upload_to_blob " ${AZWI_JWKS_JSON_FILEPATH} " " openid/v1/jwks"
138- echo " Removing key access on storage account as no further data writes are required"
139- az storage account update -n " ${AZWI_STORAGE_ACCOUNT} " " ${AZWI_RESOURCE_GROUP} " " ${AZURE_SUBSCRIPTION_ID} "
140145 fi
146+
141147 if [ -z " ${AZURE_CLIENT_ID_USER_ASSIGNED_IDENTITY} " ; then
142148 if [ -z " ${USER_IDENTITY} " ; then
143149 echo " USER_IDENTITY environment variable required if not bringing your own identity via AZURE_CLIENT_ID_USER_ASSIGNED_IDENTITY"
144150 exit 1
145151 fi
152+
146153 az identity create -n " ${USER_IDENTITY} " " ${AZWI_RESOURCE_GROUP} " " ${AZWI_LOCATION} " " ${TIMESTAMP} " " ${JOB_NAME} " " ${BUILD_PROVENANCE} "
147154 AZURE_IDENTITY_ID=$( az identity show -n " ${USER_IDENTITY} " " ${AZWI_RESOURCE_GROUP} " )
148155 AZURE_IDENTITY_ID_PRINCIPAL_ID=$( az identity show -n " ${USER_IDENTITY} " " ${AZWI_RESOURCE_GROUP} " )
156+
149157 echo " ${AZURE_IDENTITY_ID} " > " ${AZURE_IDENTITY_ID_FILEPATH} "
150158 until az role assignment create --assignee-object-id " ${AZURE_IDENTITY_ID_PRINCIPAL_ID} " " Owner" " /subscriptions/${AZURE_SUBSCRIPTION_ID} " ; do
151159 sleep 5
152160 done
161+
162+ echo " Creating federated credentials for capz-federated-identity"
153163 az identity federated-credential create -n " capz-federated-identity"
154164 --identity-name " ${USER_IDENTITY} "
155165 -g " ${AZWI_RESOURCE_GROUP} "
156166 --issuer " ${SERVICE_ACCOUNT_ISSUER} "
157167 --subject " system:serviceaccount:capz-system:capz-manager"
168+
169+ echo " Creating federated credentials for aso-federated-identity"
158170 az identity federated-credential create -n " aso-federated-identity"
159171 --identity-name " ${USER_IDENTITY} "
160172 -g " ${AZWI_RESOURCE_GROUP} "
@@ -168,7 +180,7 @@ function upload_to_blob() {
168180 local blob_name=$2
169181
170182 echo " Uploading ${file_path} to '${AZWI_STORAGE_ACCOUNT} ' storage account"
171- az storage blob upload \
183+ az storage blob upload ${ENABLE_AUTH_MODE_LOGIN : + " --auth-mode login " } \
172184 --container-name " ${AZWI_STORAGE_CONTAINER} "
173185 --file " ${file_path} "
174186 --name " ${blob_name} "
0 commit comments