Azure AuthZ/Single Resource Group Work - EXE

docs/configuration.yml

@@ -117,6 +117,9 @@ env:
         data:
         logs:
       suffix:
+    use_custom_role:
+    rg_scope:
+    single_resource_group:
   cdp:
     admin_group:
       name:

roles/platform/defaults/main.yml

@@ -175,7 +175,10 @@ plat__azure_assignment_name_suffix:           "{{ env.azure.role.name_suffix.ass
 plat__azure_metagroup_name:                   "{{ common__azure_metagroup_name }}"
 plat__azure_storage_name:                     "{{ common__azure_storage_name }}"
 
-plat__azure_consistency_wait:                 "{{ env.azure.app.wait | default(10) }}"
+plat__azure_consistency_wait:                 "{{ env.azure.app.wait | default(30) }}"
+plat__azure_xaccount_use_custom_role:         "{{ env.azure.use_custom_role | default(False) }}"
+plat__azure_xaccount_rg_scope:                "{{ env.azure.rg_scope | default(False) }}"
+plat__azure_single_resource_group:            "{{ env.azure.single_resource_group | default(False) }}"
 plat__azure_xaccount_app_name:                "{{ env.azure.app.name | default([plat__namespace, plat__azure_xaccount_suffix, plat__azure_app_suffix] | join('-')) }}"
 plat__azure_xaccount_role_name:               "{{ env.azure.role.name.cross_account | default([plat__namespace, plat__azure_xaccount_suffix, plat__azure_role_suffix] | join('-')) }}"
 plat__azure_policy_url:                       "{{ env.azure.policy.url | default('https://raw.githubusercontent.com/cloudera-labs/snippets/main/policies/azure/cloudbreak_minimal_multiple_rgs_v1.json') }}"
@@ -185,14 +188,14 @@ plat__azure_datalakeadmin_identity_name:      "{{ env.azure.role.name.datalake_a
 plat__azure_ranger_audit_identity_name:       "{{ env.azure.role.name.ranger_audit | default([plat__namespace, plat__azure_ranger_audit_suffix, plat__azure_identity_suffix] | join('-')) }}"
 plat__azure_idbroker_identity_name:           "{{ env.azure.role.name.idbroker | default([plat__namespace, plat__azure_idbroker_suffix, plat__azure_identity_suffix] | join('-')) }}"
 
-plat__azure_xaccount_contributor_assn_name:             "{{ env.azure.role.assignment.cross_account.contributor | default('-'.join([plat__namespace, plat__azure_xaccount_suffix, plat__azure_contributor_name_suffix, plat__azure_assignment_name_suffix]) | to_uuid )}}"
-plat__azure_xaccount_role_assn_name:                    "{{ env.azure.role.assignment.cross_account.role | default('-'.join([plat__namespace, plat__azure_xaccount_suffix, plat__azure_assignment_name_suffix]) | to_uuid )}}"
-plat__azure_vmcontributor_idbroker_assn_name:           "{{ env.azure.role.assignment.idbroker.vmcontributor | default('-'.join([plat__namespace, plat__azure_contributor_name_suffix, plat__azure_idbroker_suffix, plat__azure_assignment_name_suffix]) | to_uuid )}}"
-plat__azure_mgdidentop_idbroker_assn_name:              "{{ env.azure.role.assignment.idbroker.mgdidentop | default('-'.join([plat__namespace, plat__azure_operator_name_suffix, plat__azure_idbroker_suffix, plat__azure_assignment_name_suffix]) | to_uuid )}}"
-plat__azure_storageowner_datalakeadmin_logs_assn_name:  "{{ env.azure.role.assignment.datalake_admin.logs.storageowner | default('-'.join([plat__namespace, plat__azure_owner_name_suffix, plat__azure_log_suffix, plat__azure_assignment_name_suffix]) | to_uuid )}}"
-plat__azure_storageowner_datalakeadmin_data_assn_name:  "{{ env.azure.role.assignment.datalake_admin.data.storageowner | default('-'.join([plat__namespace, plat__azure_owner_name_suffix, plat__azure_data_suffix, plat__azure_assignment_name_suffix]) | to_uuid )}}"
-plat__azure_storagecontr_log_assn_name:                 "{{ env.azure.role.assignment.log.storagecontr | default('-'.join([plat__namespace, plat__azure_contributor_name_suffix, plat__azure_log_suffix, plat__azure_assignment_name_suffix]) | to_uuid )}}"
-plat__azure_storagecontr_ranger_audit_assn_name:        "{{ env.azure.role.assignment.ranger_audit.storagecontr | default('-'.join([plat__namespace, plat__azure_contributor_name_suffix, plat__azure_ranger_audit_suffix, plat__azure_assignment_name_suffix]) | to_uuid )}}"
+plat__azure_xaccount_contributor_assn_name:             "{{ env.azure.role.assignment.cross_account.contributor | default('-'.join([plat__namespace, plat__azure_xaccount_suffix, plat__azure_contributor_name_suffix, plat__azure_assignment_name_suffix,ansible_date_time.iso8601]) | to_uuid )}}"
+plat__azure_xaccount_role_assn_name:                    "{{ env.azure.role.assignment.cross_account.role | default('-'.join([plat__namespace, plat__azure_xaccount_suffix, plat__azure_assignment_name_suffix,ansible_date_time.iso8601]) | to_uuid )}}"
+plat__azure_vmcontributor_idbroker_assn_name:           "{{ env.azure.role.assignment.idbroker.vmcontributor | default('-'.join([plat__namespace, plat__azure_contributor_name_suffix, plat__azure_idbroker_suffix, plat__azure_assignment_name_suffix,ansible_date_time.iso8601]) | to_uuid )}}"
+plat__azure_mgdidentop_idbroker_assn_name:              "{{ env.azure.role.assignment.idbroker.mgdidentop | default('-'.join([plat__namespace, plat__azure_operator_name_suffix, plat__azure_idbroker_suffix, plat__azure_assignment_name_suffix,ansible_date_time.iso8601]) | to_uuid )}}"
+plat__azure_storageowner_datalakeadmin_logs_assn_name:  "{{ env.azure.role.assignment.datalake_admin.logs.storageowner | default('-'.join([plat__namespace, plat__azure_owner_name_suffix, plat__azure_log_suffix, plat__azure_assignment_name_suffix,ansible_date_time.iso8601]) | to_uuid )}}"
+plat__azure_storageowner_datalakeadmin_data_assn_name:  "{{ env.azure.role.assignment.datalake_admin.data.storageowner | default('-'.join([plat__namespace, plat__azure_owner_name_suffix, plat__azure_data_suffix, plat__azure_assignment_name_suffix,ansible_date_time.iso8601]) | to_uuid )}}"
+plat__azure_storagecontr_log_assn_name:                 "{{ env.azure.role.assignment.log.storagecontr | default('-'.join([plat__namespace, plat__azure_contributor_name_suffix, plat__azure_log_suffix, plat__azure_assignment_name_suffix,ansible_date_time.iso8601]) | to_uuid )}}"
+plat__azure_storagecontr_ranger_audit_assn_name:        "{{ env.azure.role.assignment.ranger_audit.storagecontr | default('-'.join([plat__namespace, plat__azure_contributor_name_suffix, plat__azure_ranger_audit_suffix, plat__azure_assignment_name_suffix,ansible_date_time.iso8601]) | to_uuid )}}"
 
 plat__azure_netapp_account_name:              "{{ common__azure_netapp_account_name }}"
 plat__azure_netapp_pool_name:                 "{{ common__azure_netapp_pool_name }}"

roles/platform/tasks/setup_azure_authz.yml

@@ -14,6 +14,18 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+- name: Handle Azure Cross Account Role
+  register: __azure_xaccount_role_info
+  azure.azcollection.azure_rm_roledefinition:  # This version fails idempotence if a description is set
+    state: present
+    name: "{{ plat__azure_xaccount_role_name }}"
+    assignable_scopes: "/subscriptions/{{ plat__azure_subscription_id }}"
+    permissions:
+      - actions: "{{ lookup('file', __azure_policy_document.dest ) | from_json | community.general.json_query('Actions') }}"
+        data_actions: "{{ lookup('file', __azure_policy_document.dest ) | from_json | community.general.json_query('DataActions') }}"
+        not_actions: "{{ lookup('file', __azure_policy_document.dest ) | from_json | community.general.json_query('NotActions') }}"
+        not_data_actions: "{{ lookup('file', __azure_policy_document.dest ) | from_json | community.general.json_query('NotDataActions') }}"
+
 - name: Ensure Azure Cross Account App and Credential are Deployed
   when: plat__azure_xaccount_app_uuid is undefined or plat__xacccount_credential_name not in plat__cdp_credentials_list
   block:
@@ -32,16 +44,15 @@
         - name: Wait for consistency
           ansible.builtin.pause:
             seconds: "{{ plat__azure_consistency_wait }}"
-
-    # Owner role is required for DWX if you are thinking of modifying this task
+
     - name: Request Azure Cross Account App Creation
       no_log: True
       register: __azure_xaccount_app_info
       command: >
         az ad sp create-for-rbac
         --name {{ plat__azure_xaccount_app_name }}
-        --role {{ plat__azure_roles.owner }}
-        --scopes {{ plat__azure_metagroup_uri }}
+        --role {{ plat__azure_xaccount_use_custom_role | ternary(__azure_xaccount_role_info.id, plat__azure_roles.contrib) }}
+        --scope {{ plat__azure_xaccount_rg_scope | ternary(plat__azure_metagroup_uri, plat__azure_subscription_uri) }} 
 
     - name: Register Azure Cross Account App info
       no_log: True
@@ -95,22 +106,6 @@
         tenant: "{{ plat__azure_tenant_id }}"
         application: "{{ plat__azure_xaccount_app_uuid }}"
         secret: "{{ __azure_xaccount_app_pword }}"
-
-- name: Handle Azure Cross Account Role
-  register: __azure_xaccount_role_info
-  azure.azcollection.azure_rm_roledefinition:  # This version fails idempotence if a description is set
-    state: present
-    name: "{{ plat__azure_xaccount_role_name }}"
-    assignable_scopes: "/subscriptions/{{ plat__azure_subscription_id }}"
-    permissions:
-      - actions: "{{ lookup('file', __azure_policy_document.dest ) | from_json | community.general.json_query('Actions') }}"
-        data_actions: "{{ lookup('file', __azure_policy_document.dest ) | from_json | community.general.json_query('DataActions') }}"
-        not_actions: "{{ lookup('file', __azure_policy_document.dest ) | from_json | community.general.json_query('NotActions') }}"
-        not_data_actions: "{{ lookup('file', __azure_policy_document.dest ) | from_json | community.general.json_query('NotDataActions') }}"
-
-- name: Set Azure Cross Account Role URI
-  ansible.builtin.set_fact:
-    plat__azure_xaccount_role_uri: "{{ __azure_xaccount_role_info.id }}"
 
 - name: Request creation of Azure Managed Identities
   when: ( __azure_identity_list_names is undefined ) or ( __azure_msi_item not in __azure_identity_list_names )
@@ -198,7 +193,7 @@
   until: __infra_az_sp_assign_result is not failed
   retries: 3
   delay: 3
-  azure.azcollection.azure_rm_roleassignment: # This Azure module is not idempotent at all it seems?
+  azure.azcollection.azure_rm_roleassignment: # This Azure module is not idempotent at all it seems? We have made it so... see error catching below
     state: present
     scope: "{{ __azure_rl_assgn_item.scope }}"
     name: "{{ __azure_rl_assgn_item.name }}"
@@ -235,16 +230,10 @@
       scope: "{{ plat__azure_datapath_uri }}"
       assignee: "{{ __azure_ranger_audit_identity_uuid }}"
       desc: Assign Storage Blob Data Contributor Role to Ranger Role at Data Container level
-    - role: "{{ __azure_contributor_role_uri }}"
-      name: "{{ plat__azure_xaccount_contributor_assn_name }}"
-      scope: "{{ plat__azure_subscription_uri }}"
-      assignee: "{{ plat__azure_application_service_principal_objuuid }}"
-      desc: Assign top level Contributor Role to Cross Account App
-    - role: "{{ __azure_xaccount_role_uri }}"
-      name: "{{ plat__azure_xaccount_role_assn_name }}"
-      scope: "{{ plat__azure_subscription_uri }}"
-      assignee: "{{ plat__azure_application_service_principal_objuuid }}"
-      desc: Assign Cross Account Role to Cross Account App
   loop_control:
     loop_var: __azure_rl_assgn_item
-    label: "{{ __azure_rl_assgn_item.desc }}"
+    label: "{{ __azure_rl_assgn_item.desc }}"
+  failed_when:
+    - "'rc' in __infra_az_sp_assign_result" 
+    - __infra_az_sp_assign_result.rc != 0
+    - "'The role assignment already exists' not in __infra_az_sp_assign_result.module_stderr"

roles/platform/tasks/setup_azure_env.yml

@@ -30,6 +30,7 @@
     vpc_id: "{{ plat__vpc_name }}"
     tunnel: "{{ plat__tunnel }}"
     resource_gp: "{{ plat__azure_metagroup_name }}"
+    use_single_resource_group: "{{ plat__azure_single_resource_group or plat__azure_xaccount_rg_scope | bool }}"
     subnet_ids: "{{ plat__azure_subnets }}"
     public_ip: "{{ plat__public_endpoint_access }}"
     tags: "{{ plat__tags }}"

roles/platform/tasks/teardown_azure_authz.yml

@@ -49,4 +49,22 @@
     - plat__azure_idbroker_identity_name not in ( __azure_identity_list.stdout | from_json | community.general.json_query('[*].name') )
     - plat__azure_datalakeadmin_identity_name not in ( __azure_identity_list.stdout | from_json | community.general.json_query('[*].name') )
     - plat__azure_log_identity_name not in ( __azure_identity_list.stdout | from_json | community.general.json_query('[*].name') )
-    - plat__azure_ranger_audit_identity_name not in ( __azure_identity_list.stdout | from_json | community.general.json_query('[*].name') )
+    - plat__azure_ranger_audit_identity_name not in ( __azure_identity_list.stdout | from_json | community.general.json_query('[*].name') )
+
+- name: Remove CDP Cross Account Credential for Azure
+  when: plat__teardown_deletes_credential
+  cloudera.cloud.env_cred:
+    state: absent
+    name: "{{ plat__xacccount_credential_name }}"
+
+- name: Tear down Azure AD App Registration
+  when: plat__teardown_deletes_xaccount and ( plat__azure_xaccount_app_uuid is defined ) and ( plat__azure_xaccount_app_uuid | length > 0 )
+  command: >
+      az ad sp delete
+      --id {{ plat__azure_application_service_principal_objuuid }}
+
+- name: Tear down Custom Role
+  when: plat__teardown_deletes_roles
+  azure.azcollection.azure_rm_roledefinition:
+    state: absent
+    name: "{{ plat__azure_xaccount_role_name }}"