Skip to content

Commit a4d8a45

Browse files
cmperrocmperro
committed
Remove Cred/AD App during teardown. Rework Cred/AD App AuthZ
Signed-off-by: Chris Perro <[email protected]>
1 parent 7966d07 commit a4d8a45

File tree

4 files changed

+80
-31
lines changed

4 files changed

+80
-31
lines changed

‎roles/platform/defaults/main.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -167,7 +167,9 @@ plat__azure_assignment_name_suffix: "{{ env.azure.role.name_suffix.ass
167167
plat__azure_metagroup_name: "{{ common__azure_metagroup_name }}"
168168
plat__azure_storage_name: "{{ common__azure_storage_name }}"
169169

170-
plat__azure_consistency_wait: "{{ env.azure.app.wait | default(10) }}"
170+
plat__azure_consistency_wait: "{{ env.azure.app.wait | default(30) }}"
171+
plat__azure_xaccount_use_custom_role: "{{ env.azure.app.use_custom_role | default(False) }}"
172+
plat__azure_single_resource_group: "{{ env.azure.single_resource_group | default(False) }}"
171173
plat__azure_xaccount_app_name: "{{ env.azure.app.name | default([plat__namespace, plat__azure_xaccount_suffix, plat__azure_app_suffix] | join('-')) }}"
172174
plat__azure_xaccount_role_name: "{{ env.azure.role.name.cross_account | default([plat__namespace, plat__azure_xaccount_suffix, plat__azure_role_suffix] | join('-')) }}"
173175
plat__azure_policy_url: "{{ env.azure.policy.url | default('https://raw.githubusercontent.com/cloudera-labs/snippets/main/policies/azure/cloudbreak_minimal_multiple_rgs_v1.json') }}"

‎roles/platform/tasks/setup_azure_authz.yml‎

Lines changed: 58 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,18 @@
1414
# See the License for the specific language governing permissions and
1515
# limitations under the License.
1616

17+
- name: Handle Azure Cross Account Role
18+
register: __azure_xaccount_role_info
19+
azure.azcollection.azure_rm_roledefinition: # This version fails idempotence if a description is set
20+
state: present
21+
name: "{{ plat__azure_xaccount_role_name }}"
22+
assignable_scopes: "/subscriptions/{{ plat__azure_subscription_id }}"
23+
permissions:
24+
- actions: "{{ lookup('file', __azure_policy_document.dest ) | from_json | community.general.json_query('Actions') }}"
25+
data_actions: "{{ lookup('file', __azure_policy_document.dest ) | from_json | community.general.json_query('DataActions') }}"
26+
not_actions: "{{ lookup('file', __azure_policy_document.dest ) | from_json | community.general.json_query('NotActions') }}"
27+
not_data_actions: "{{ lookup('file', __azure_policy_document.dest ) | from_json | community.general.json_query('NotDataActions') }}"
28+
1729
- name: Ensure Azure Cross Account App and Credential are Deployed
1830
when: plat__azure_xaccount_app_uuid is undefined or plat__xacccount_credential_name not in plat__cdp_credentials_list
1931
block:
@@ -33,15 +45,26 @@
3345
ansible.builtin.pause:
3446
seconds: "{{ plat__azure_consistency_wait }}"
3547

48+
- name: Dump MetaGroup URI
49+
ansible.builtin.debug:
50+
msg: Dumping... {{ plat__azure_metagroup_uri }}
51+
3652
# Owner role is required for DWX if you are thinking of modifying this task
3753
- name: Request Azure Cross Account App Creation
3854
no_log: True
3955
register: __azure_xaccount_app_info
4056
command: >
4157
az ad sp create-for-rbac
4258
--name {{ plat__azure_xaccount_app_name }}
43-
--role {{ plat__azure_roles.owner }}
44-
--scopes {{ plat__azure_metagroup_uri }}
59+
--role {{ plat__azure_xaccount_use_custom_role | ternary(__azure_xaccount_role_info.id, plat__azure_roles.contrib) }}
60+
--scope {{ plat__azure_subscription_uri }}
61+
# --role {{ __azure_xaccount_role_info.id }}
62+
# --scopes {{ plat__azure_metagroup_uri }}
63+
# Bake ternary into the above
64+
65+
#- name: SLEEEP
66+
# command: >
67+
# sleep 180
4568

4669
- name: Register Azure Cross Account App info
4770
no_log: True
@@ -95,22 +118,24 @@
95118
tenant: "{{ plat__azure_tenant_id }}"
96119
application: "{{ plat__azure_xaccount_app_uuid }}"
97120
secret: "{{ __azure_xaccount_app_pword }}"
98-
99-
- name: Handle Azure Cross Account Role
100-
register: __azure_xaccount_role_info
101-
azure.azcollection.azure_rm_roledefinition: # This version fails idempotence if a description is set
102-
state: present
103-
name: "{{ plat__azure_xaccount_role_name }}"
104-
assignable_scopes: "/subscriptions/{{ plat__azure_subscription_id }}"
105-
permissions:
106-
- actions: "{{ lookup('file', __azure_policy_document.dest ) | from_json | community.general.json_query('Actions') }}"
107-
data_actions: "{{ lookup('file', __azure_policy_document.dest ) | from_json | community.general.json_query('DataActions') }}"
108-
not_actions: "{{ lookup('file', __azure_policy_document.dest ) | from_json | community.general.json_query('NotActions') }}"
109-
not_data_actions: "{{ lookup('file', __azure_policy_document.dest ) | from_json | community.general.json_query('NotDataActions') }}"
110121

111-
- name: Set Azure Cross Account Role URI
112-
ansible.builtin.set_fact:
113-
plat__azure_xaccount_role_uri: "{{ __azure_xaccount_role_info.id }}"
122+
#Move Up
123+
#- name: Handle Azure Cross Account Role
124+
# register: __azure_xaccount_role_info
125+
# azure.azcollection.azure_rm_roledefinition: # This version fails idempotence if a description is set
126+
# state: present
127+
# name: "{{ plat__azure_xaccount_role_name }}"
128+
# assignable_scopes: "/subscriptions/{{ plat__azure_subscription_id }}"
129+
# permissions:
130+
# - actions: "{{ lookup('file', __azure_policy_document.dest ) | from_json | community.general.json_query('Actions') }}"
131+
# data_actions: "{{ lookup('file', __azure_policy_document.dest ) | from_json | community.general.json_query('DataActions') }}"
132+
# not_actions: "{{ lookup('file', __azure_policy_document.dest ) | from_json | community.general.json_query('NotActions') }}"
133+
# not_data_actions: "{{ lookup('file', __azure_policy_document.dest ) | from_json | community.general.json_query('NotDataActions') }}"
134+
135+
#Not Needed?
136+
#- name: Set Azure Cross Account Role URI
137+
# ansible.builtin.set_fact:
138+
# plat__azure_xaccount_role_uri: "{{ __azure_xaccount_role_info.id }}"
114139

115140
- name: Request creation of Azure Managed Identities
116141
when: ( __azure_identity_list_names is undefined ) or ( __azure_msi_item not in __azure_identity_list_names )
@@ -123,7 +148,7 @@
123148
- "{{ plat__azure_datalakeadmin_identity_name }}"
124149
- "{{ plat__azure_log_identity_name }}"
125150
- "{{ plat__azure_ranger_audit_identity_name }}"
126-
151+
#Dupe of Below?
127152
- name: Wait for identities to be listed
128153
command: "az identity list -g {{ plat__azure_metagroup_name }}"
129154
register: __azure_identity_list
@@ -235,16 +260,20 @@
235260
scope: "{{ plat__azure_datapath_uri }}"
236261
assignee: "{{ __azure_ranger_audit_identity_uuid }}"
237262
desc: Assign Storage Blob Data Contributor Role to Ranger Role at Data Container level
238-
- role: "{{ __azure_contributor_role_uri }}"
239-
name: "{{ plat__azure_xaccount_contributor_assn_name }}"
240-
scope: "{{ plat__azure_subscription_uri }}"
241-
assignee: "{{ plat__azure_application_service_principal_objuuid }}"
242-
desc: Assign top level Contributor Role to Cross Account App
243-
- role: "{{ __azure_xaccount_role_uri }}"
244-
name: "{{ plat__azure_xaccount_role_assn_name }}"
245-
scope: "{{ plat__azure_subscription_uri }}"
246-
assignee: "{{ plat__azure_application_service_principal_objuuid }}"
247-
desc: Assign Cross Account Role to Cross Account App
263+
#- role: "{{ __azure_contributor_role_uri }}"
264+
# name: "{{ plat__azure_xaccount_contributor_assn_name }}"
265+
# scope: "{{ plat__azure_subscription_uri }}"
266+
# assignee: "{{ plat__azure_application_service_principal_objuuid }}"
267+
# desc: Assign top level Contributor Role to Cross Account App
268+
#- role: "{{ __azure_xaccount_role_uri }}"
269+
# name: "{{ plat__azure_xaccount_role_assn_name }}"
270+
# scope: "{{ plat__azure_subscription_uri }}"
271+
# assignee: "{{ plat__azure_application_service_principal_objuuid }}"
272+
# desc: Assign Cross Account Role to Cross Account App
248273
loop_control:
249274
loop_var: __azure_rl_assgn_item
250-
label: "{{ __azure_rl_assgn_item.desc }}"
275+
label: "{{ __azure_rl_assgn_item.desc }}"
276+
277+
#- name: SLEEEEEEEEEEP
278+
# command: >
279+
# sleep 1800

‎roles/platform/tasks/setup_azure_env.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
vpc_id: "{{ plat__vpc_name }}"
3131
tunnel: "{{ plat__tunnel }}"
3232
resource_gp: "{{ plat__azure_metagroup_name }}"
33+
use_single_resource_group: "{{ plat__azure_single_resource_group }}"
3334
subnet_ids: "{{ plat__azure_subnets }}"
3435
public_ip: "{{ plat__public_endpoint_access }}"
3536
tags: "{{ plat__tags }}"

‎roles/platform/tasks/teardown_azure_authz.yml‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,4 +49,21 @@
4949
- plat__azure_idbroker_identity_name not in ( __azure_identity_list.stdout | from_json | community.general.json_query('[*].name') )
5050
- plat__azure_datalakeadmin_identity_name not in ( __azure_identity_list.stdout | from_json | community.general.json_query('[*].name') )
5151
- plat__azure_log_identity_name not in ( __azure_identity_list.stdout | from_json | community.general.json_query('[*].name') )
52-
- plat__azure_ranger_audit_identity_name not in ( __azure_identity_list.stdout | from_json | community.general.json_query('[*].name') )
52+
- plat__azure_ranger_audit_identity_name not in ( __azure_identity_list.stdout | from_json | community.general.json_query('[*].name') )
53+
54+
- name: Remove CDP Cross Account Credential for Azure
55+
when: plat__teardown_deletes_credential
56+
cloudera.cloud.env_cred:
57+
state: absent
58+
#cloud: "{{ plat__infra_type }}"
59+
name: "{{ plat__xacccount_credential_name }}"
60+
#subscription: "{{ plat__azure_subscription_id }}"
61+
#tenant: "{{ plat__azure_tenant_id }}"
62+
#application: "{{ plat__azure_xaccount_app_uuid }}"
63+
#secret: "{{ __azure_xaccount_app_pword }}"
64+
65+
- name: Tear down Azure AD App Registration
66+
when: plat__teardown_deletes_xaccount and ( plat__azure_xaccount_app_uuid is defined ) and ( plat__azure_xaccount_app_uuid | length > 0 )
67+
command: >
68+
az ad sp delete
69+
--id {{ plat__azure_application_service_principal_objuuid }}

0 commit comments

Comments
 (0)