@@ -1081,7 +1081,8 @@ function uploadCaCertificate {
10811081 --account-name " ${STORAGE_ACCOUNT} " \
10821082 --account-key " ${STORAGE_ACCOUNT_KEY} " \
10831083 --container-name " ${STORAGE_ACCOUNT_CONTAINER} " \
1084- --file " ${HOME} /ca-certificate/${V4_CFG_INGRESS_FQDN} -ca.pem"
1084+ --file " ${HOME} /ca-certificate/${V4_CFG_INGRESS_FQDN} -ca.pem" \
1085+ --overwrite
10851086}
10861087
10871088# Upload logfile
@@ -1134,70 +1135,121 @@ function fixViyaAdmin {
11341135}
11351136
11361137function checkExternalPostgres {
1137- # Detect if external postgres is part of deployment
1138- echolog " [checkExternalPostgres] Check existence of external PostgreSQL server"
1139- STEP_CONFIGURE_POSTGRES_JSON=$( jq -n ' {}' )
1140-
1141- extPgConfig=$( echo " $EXTPG_CONFIG_B64 " | /bin/base64 -d )
1142- echolog " [checkExternalPostgres] extPgConfig: $extPgConfig "
1143- extPgServers=$( echo " $extPgConfig " | jq -r ' .' )
1144- echolog " [checkExternalPostgres] extPgServers: $extPgServers "
1145- extPgServersLength=$( echo " $extPgServers " | jq -r ' length' )
1146- echolog " [checkExternalPostgres] extPgServersLength: $extPgServersLength "
1147- if [ " $extPgServersLength " -ne 0 ]
1148- then
1149- for ix_tmp in $( seq 1 $extPgServersLength )
1150- do
1151- ix=$(( ix_tmp- 1 ))
1152- extPgServer=$( echo " $extPgServers " | jq -r " .[$ix ]" )
1153- extPgServerName=$( echo " $extPgServer " | jq -r " .ServerName" )
1154- extPgServerAdminLogin=$( echo " $extPgServer " | jq -r " .AdministratorLogin" )
1155- extPgServerAdminPassword=$( echo " $extPgServer " | jq -r " .AdministratorLoginPassword" )
1156- extPgServerRole=$( echo " $extPgServer " | jq -r " .Role" )
1157- extPgServerDatabases=$( echo " $extPgServer " | jq -r " .Databases" )
1158- echolog " [checkExternalPostgres] Check external Postgres server existence: $extPgServerName "
1159- if az postgres flexible-server show -g ${RG} -n ${extPgServerName} > /dev/null 2>&1
1160- then
1161- echolog " [checkExternalPostgres] External PostgreSQL server detected ($extPgServerName )"
1162- EXTPG_JSON=$( az postgres flexible-server show -g ${RG} -n ${extPgServerName} -o json)
1163- EXTPG_FQDN=$( echo " $EXTPG_JSON " | jq -r " .fullyQualifiedDomainName" )
1164- EXTPG_PORT=$( az postgres flexible-server parameter show -n port -g ${RG} -s ${extPgServerName} | jq -r " .value" )
1165-
1166- extPgServerDatabasesLength=$( echo " $extPgServerDatabases " | jq -r ' length' )
1167- if [ " $extPgServerDatabasesLength " -ne 0 ]
1168- then
1169- for jx_tmp in $( seq 1 $extPgServerDatabasesLength )
1170- do
1171- jx=$(( jx_tmp- 1 ))
1172- extPgServerDatabase=$( echo " $extPgServerDatabases " | jq -r " .[$jx ]" )
1173- extPgServerDatabaseName=$( echo " $extPgServerDatabase " | jq -r " .name" )
1174- extPgServerDatabaseDefault=$( echo " $extPgServerDatabase " | jq -r " .default" )
1175- echolog " [checkExternalPostgres] Creating database $extPgServerDatabaseName ..."
1176- az postgres flexible-server db create -g ${RG} -s ${extPgServerName} --database-name $extPgServerDatabaseName
1177-
1178- if [ " $extPgServerDatabaseDefault " == " Y" ]
1179- then
1180- echolog " [checkExternalPostgres] Configuring database $extPgServerDatabaseName ..."
1181- STEP_CONFIGURE_POSTGRES_JSON=$( echo " $STEP_CONFIGURE_POSTGRES_JSON " | jq ' . +
1182- { "' " $extPgServerRole " ' ": {
1183- "internal": false,
1184- "admin": "' " $extPgServerAdminLogin " ' ",
1185- "password": "' " $extPgServerAdminPassword " ' ",
1186- "fqdn": "' " $EXTPG_FQDN " ' ",
1187- "ssl_enforcement_enabled": true,
1188- "server_port": "' " $EXTPG_PORT " ' ",
1189- "database": "' " $extPgServerDatabaseName " ' "
1190- }}' )
1191- else
1192- echolog " [checkExternalPostgres] Skipping Configuration for database $extPgServerDatabaseName ..."
1193- fi
1194- done
1195- fi
1196- fi
1197- done
1138+ if [ " ${IS_UPDATE} " == " True" ]; then
1139+ # Detect if external postgres is part of deployment
1140+ echolog " [checkExternalPostgres] Check existence of external PostgreSQL server"
1141+
1142+ extPG_IDS_name=${RG/ -mrg/ -extpg-ids}
1143+ extPG_CDS_name=${RG/ -mrg/ -extpg-cds}
1144+
1145+ if [[ $( az postgres flexible-server list --resource-group $RG --query " [?name=='$extPG_IDS_name '] | length(@)" ) > 0 ]] && [[ $( az postgres flexible-server list --resource-group $RG --query " [?name=='$extPG_CDS_name '] | length(@)" ) > 0 ]]; then
1146+ echolog " [checkExternalPostgres] External postgres instances exist"
1147+
1148+ CDS_POSTGRES_SECRET_NAME=$( kubectl -n ${V4_CFG_NAMESPACE} get secrets -o json | jq ' .items | sort_by(.metadata.creationTimestamp) | reverse | .[].metadata.name | select(test("cds-postgres-platform-postgres-user"; "i"))' --raw-output | head -n 1)
1149+ CDS_ADMIN_USER=$( kubectl -n ${V4_CFG_NAMESPACE} get secret ${CDS_POSTGRES_SECRET_NAME} -o jsonpath=' {.data.username}' | /bin/base64 -d)
1150+ CDS_ADMIN_PASSWORD=$( kubectl -n ${V4_CFG_NAMESPACE} get secret ${CDS_POSTGRES_SECRET_NAME} -o jsonpath=' {.data.password}' | /bin/base64 -d)
1151+ CDS_EXTPG_JSON=$( az postgres flexible-server show -g ${RG} -n ${extPG_CDS_name} -o json)
1152+ CDS_EXTPG_FQDN=$( echo " $CDS_EXTPG_JSON " | jq -r " .fullyQualifiedDomainName" )
1153+ CDS_EXTPG_PORT=$( az postgres flexible-server parameter show -n port -g ${RG} -s ${extPG_CDS_name} | jq -r " .value" )
1154+
1155+ IDS_POSTGRES_SECRET_NAME=$( kubectl -n ${V4_CFG_NAMESPACE} get secrets -o json | jq ' .items | sort_by(.metadata.creationTimestamp) | reverse | .[].metadata.name | select(test("default-platform-postgres-user"; "i"))' --raw-output | head -n 1)
1156+ IDS_ADMIN_USER=$( kubectl -n ${V4_CFG_NAMESPACE} get secret ${IDS_POSTGRES_SECRET_NAME} -o jsonpath=' {.data.username}' | /bin/base64 -d)
1157+ IDS_ADMIN_PASSWORD=$( kubectl -n ${V4_CFG_NAMESPACE} get secret ${IDS_POSTGRES_SECRET_NAME} -o jsonpath=' {.data.password}' | /bin/base64 -d)
1158+ IDS_EXTPG_JSON=$( az postgres flexible-server show -g ${RG} -n ${extPG_IDS_name} -o json)
1159+ IDS_EXTPG_FQDN=$( echo " $IDS_EXTPG_JSON " | jq -r " .fullyQualifiedDomainName" )
1160+ IDS_EXTPG_PORT=$( az postgres flexible-server parameter show -n port -g ${RG} -s ${extPG_IDS_name} | jq -r " .value" )
1161+
1162+ STEP_CONFIGURE_POSTGRES_JSON=$( jq -n ' {}' )
1163+ STEP_CONFIGURE_POSTGRES_JSON=$( echo " $STEP_CONFIGURE_POSTGRES_JSON " | jq ' . +
1164+ { "' " cds-postgres" ' ": {
1165+ "internal": false,
1166+ "admin": "' " $CDS_ADMIN_USER " ' ",
1167+ "password": "' " $CDS_ADMIN_PASSWORD " ' ",
1168+ "fqdn": "' " $CDS_EXTPG_FQDN " ' ",
1169+ "ssl_enforcement_enabled": true,
1170+ "server_port": "' " $CDS_EXTPG_PORT " ' ",
1171+ "database": "' " SharedServices" ' "
1172+ }}' )
1173+ STEP_CONFIGURE_POSTGRES_JSON=$( echo " $STEP_CONFIGURE_POSTGRES_JSON " | jq ' . +
1174+ { "' " default" ' ": {
1175+ "internal": false,
1176+ "admin": "' " $IDS_ADMIN_USER " ' ",
1177+ "password": "' " $IDS_ADMIN_PASSWORD " ' ",
1178+ "fqdn": "' " $IDS_EXTPG_FQDN " ' ",
1179+ "ssl_enforcement_enabled": true,
1180+ "server_port": "' " $IDS_EXTPG_PORT " ' ",
1181+ "database": "' " SharedServices" ' "
1182+ }}' )
1183+ else
1184+ echolog " [checkExternalPostgres] External PostgreSQL server not detected. Proceeding with internal database..."
1185+ export STEP_CONFIGURE_POSTGRES_JSON=" "
1186+ fi
11981187 else
1199- echolog " [checkExternalPostgres] External PostgreSQL server not detected. Proceeding with internal database..."
1200- export STEP_CONFIGURE_POSTGRES_JSON=" "
1188+ # Detect if external postgres is part of deployment
1189+ echolog " [checkExternalPostgres] Check existence of external PostgreSQL server"
1190+ STEP_CONFIGURE_POSTGRES_JSON=$( jq -n ' {}' )
1191+
1192+ extPgConfig=$( echo " $EXTPG_CONFIG_B64 " | /bin/base64 -d )
1193+ echolog " [checkExternalPostgres] extPgConfig: $extPgConfig "
1194+ extPgServers=$( echo " $extPgConfig " | jq -r ' .' )
1195+ echolog " [checkExternalPostgres] extPgServers: $extPgServers "
1196+ extPgServersLength=$( echo " $extPgServers " | jq -r ' length' )
1197+ echolog " [checkExternalPostgres] extPgServersLength: $extPgServersLength "
1198+ if [ " $extPgServersLength " -ne 0 ]
1199+ then
1200+ for ix_tmp in $( seq 1 $extPgServersLength )
1201+ do
1202+ ix=$(( ix_tmp- 1 ))
1203+ extPgServer=$( echo " $extPgServers " | jq -r " .[$ix ]" )
1204+ extPgServerName=$( echo " $extPgServer " | jq -r " .ServerName" )
1205+ extPgServerAdminLogin=$( echo " $extPgServer " | jq -r " .AdministratorLogin" )
1206+ extPgServerAdminPassword=$( echo " $extPgServer " | jq -r " .AdministratorLoginPassword" )
1207+ extPgServerRole=$( echo " $extPgServer " | jq -r " .Role" )
1208+ extPgServerDatabases=$( echo " $extPgServer " | jq -r " .Databases" )
1209+ echolog " [checkExternalPostgres] Check external Postgres server existence: $extPgServerName "
1210+ if az postgres flexible-server show -g ${RG} -n ${extPgServerName} > /dev/null 2>&1
1211+ then
1212+ echolog " [checkExternalPostgres] External PostgreSQL server detected ($extPgServerName )"
1213+ EXTPG_JSON=$( az postgres flexible-server show -g ${RG} -n ${extPgServerName} -o json)
1214+ EXTPG_FQDN=$( echo " $EXTPG_JSON " | jq -r " .fullyQualifiedDomainName" )
1215+ EXTPG_PORT=$( az postgres flexible-server parameter show -n port -g ${RG} -s ${extPgServerName} | jq -r " .value" )
1216+
1217+ extPgServerDatabasesLength=$( echo " $extPgServerDatabases " | jq -r ' length' )
1218+ if [ " $extPgServerDatabasesLength " -ne 0 ]
1219+ then
1220+ for jx_tmp in $( seq 1 $extPgServerDatabasesLength )
1221+ do
1222+ jx=$(( jx_tmp- 1 ))
1223+ extPgServerDatabase=$( echo " $extPgServerDatabases " | jq -r " .[$jx ]" )
1224+ extPgServerDatabaseName=$( echo " $extPgServerDatabase " | jq -r " .name" )
1225+ extPgServerDatabaseDefault=$( echo " $extPgServerDatabase " | jq -r " .default" )
1226+ echolog " [checkExternalPostgres] Creating database $extPgServerDatabaseName ..."
1227+ az postgres flexible-server db create -g ${RG} -s ${extPgServerName} --database-name $extPgServerDatabaseName
1228+
1229+ if [ " $extPgServerDatabaseDefault " == " Y" ]
1230+ then
1231+ echolog " [checkExternalPostgres] Configuring database $extPgServerDatabaseName ..."
1232+ STEP_CONFIGURE_POSTGRES_JSON=$( echo " $STEP_CONFIGURE_POSTGRES_JSON " | jq ' . +
1233+ { "' " $extPgServerRole " ' ": {
1234+ "internal": false,
1235+ "admin": "' " $extPgServerAdminLogin " ' ",
1236+ "password": "' " $extPgServerAdminPassword " ' ",
1237+ "fqdn": "' " $EXTPG_FQDN " ' ",
1238+ "ssl_enforcement_enabled": true,
1239+ "server_port": "' " $EXTPG_PORT " ' ",
1240+ "database": "' " $extPgServerDatabaseName " ' "
1241+ }}' )
1242+ else
1243+ echolog " [checkExternalPostgres] Skipping Configuration for database $extPgServerDatabaseName ..."
1244+ fi
1245+ done
1246+ fi
1247+ fi
1248+ done
1249+ else
1250+ echolog " [checkExternalPostgres] External PostgreSQL server not detected. Proceeding with internal database..."
1251+ export STEP_CONFIGURE_POSTGRES_JSON=" "
1252+ fi
12011253 fi
12021254}
12031255
@@ -2172,36 +2224,33 @@ wait_for_fn_result downloadKubectl
21722224chmod u+x /usr/local/bin/kubectl
21732225
21742226if [ " ${IS_UPDATE} " == " True" ]; then
2175- # echolog "Retrieve IP address of container associated with deployment script"
2176- # DS_IP=$(az resource show \
2177- # --ids "/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RG/providers/Microsoft.Resources/deploymentScripts/${AKS/-aks/-ds-viya-deploy}" \
2178- # --query "properties.containerConfiguration.containerGroupProperties.ipAddress.ip")
2179- # echolog "DS_IP=${DS_IP}"
2180-
2181- DS_IP=" 0.0.0.0/0"
2182- CURRENT_IPS=$( az aks show \
2227+ apk -U add curl
2228+ CURRENT_OUTBOUND_IP=$( curl ipinfo.io/ip)
2229+ CURRENT_AUTHORIZED_IPS=$( az aks show \
21832230 --resource-group " $RG " \
21842231 --name " $AKS " \
2185- --query " apiServerAccessProfile.authorizedIPRanges" \
2186- -o tsv | tr ' \t' ' ,' )
2187- if [[ -z " $CURRENT_IPS " ]]; then
2188- MERGED=" $DS_IP "
2232+ --query " apiServerAccessProfile.authorizedIpRanges" \
2233+ -o tsv | tr ' \n' ' ,' )
2234+
2235+ echolog " Found current IPs of ${CURRENT_AUTHORIZED_IPS} "
2236+ if [[ -z " $CURRENT_AUTHORIZED_IPS " ]]; then
2237+ MERGED=" $CURRENT_OUTBOUND_IP "
21892238 else
2239+ if [[ " ${CURRENT_AUTHORIZED_IPS: -1} " == " ," ]]; then
2240+ CURRENT_AUTHORIZED_IPS=" ${CURRENT_AUTHORIZED_IPS% ,} "
2241+ fi
21902242 # Check if IP already exists
2191- if echo " $CURRENT_IPS " | grep -qw " $DS_IP " ; then
2192- echolog " IP $DS_IP is already authorized. Nothing to do."
2243+ if echo " $CURRENT_AUTHORIZED_IPS " | grep -qw " $CURRENT_OUTBOUND_IP " ; then
2244+ echolog " IP $CURRENT_OUTBOUND_IP is already authorized. Nothing to do."
21932245 exit 0
21942246 fi
2195- MERGED=" $CURRENT_IPS , $DS_IP "
2247+ MERGED=" $CURRENT_AUTHORIZED_IPS , $CURRENT_OUTBOUND_IP /32 "
21962248 fi
2197- echolog " Updating authorized IP ranges: $MERGED "
2198-
2199- az aks update \
2200- --resource-group " $RG " \
2201- --name " $AKS_NAME " \
2202- --api-server-authorized-ip-ranges " $MERGED "
2249+ echolog " Updating current AKS API server authorized IP ranges to: $MERGED "
22032250
2204- echo " Successfully updated AKS API server authorized IP ranges."
2251+ az aks update -g ${RG} -n ${AKS} --debug --api-server-authorized-ip-ranges " ${MERGED} " >> $LOGFILE 2>&1
2252+ az storage account update -g ${RG} -n ${STORAGE_ACCOUNT} --default-action Allow
2253+ echolog " Successfully updated AKS API server authorized IP ranges and storage account default action."
22052254fi
22062255
22072256# Get managed users Kubeconfig
@@ -2215,6 +2264,11 @@ if [ "${IS_UPDATE}" != "True" ]; then
22152264 wait_for_fn_result downloadNfsVmPrivateKey
22162265fi
22172266
2267+ if [ " ${IS_UPDATE} " == " True" ]; then
2268+ LDAP_CONFIG_MAP_NAME=$( kubectl -n ${V4_CFG_NAMESPACE} get configmaps -o json | jq ' .items | sort_by(.metadata.creationTimestamp) | reverse | .[].metadata.name | select(test("openldap-bootstrap-config"; "i"))' --raw-output | head -n 1)
2269+ LDAP_ADMIN_PASSWORD=$( kubectl -n ${V4_CFG_NAMESPACE} get configmap ${LDAP_CONFIG_MAP_NAME} -o jsonpath=' {.data.LDAP_ADMIN_PASSWORD}' )
2270+ fi
2271+
22182272# Create Viya namespace
22192273wait_for_fn_result createViyaNamespace
22202274
@@ -2356,9 +2410,7 @@ wait_for_fn_result createSupersetNamespace
23562410wait_for_fn_result deploySuperset
23572411
23582412# Fix Viya Admin
2359- if [ " ${IS_UPDATE} " != " True" ]; then
2360- wait_for_fn_result fixViyaAdmin
2361- fi
2413+ wait_for_fn_result fixViyaAdmin
23622414
23632415# Register Ext Client
23642416wait_for_fn_with_str_result getAccessToken ACCESS_TOKEN
@@ -2395,7 +2447,9 @@ wait_for_fn_result waitForCirrusDeployments
23952447wait_for_fn_result addUsers
23962448
23972449# Load Cirrus Data
2398- wait_for_fn_result loadCirrusData
2450+ if [ " ${IS_UPDATE} " != " True" ]; then
2451+ wait_for_fn_result loadCirrusData
2452+ fi
23992453
24002454wait_for_fn_result disableNonEssentialAppsRunTime
24012455wait_for_fn_result disableCAS
@@ -2410,47 +2464,23 @@ wait_for_fn_result uploadLogfile
24102464echolog " ---"
24112465# lock down AKS API Server and Storage Account if we need to
24122466if [ " ${USE_IP_ALLOWLIST} " == " True" ]; then
2467+ echolog " USE_IP_ALLOWLIST=${USE_IP_ALLOWLIST} , locking down deployment..."
2468+ applyAllowlist
2469+ echolog " Allow list applied..."
2470+ else
24132471 if [ " ${IS_UPDATE} " != " True" ]; then
2414- echolog " USE_IP_ALLOWLIST=${USE_IP_ALLOWLIST} , locking down deployment..."
2415- applyAllowlist
2416- echolog " Allow list applied..."
2417- else
2418- echolog " Get current list of authorized IPs"
2419- CURRENT_IPS=$( az aks show \
2420- --resource-group " $RG " \
2421- --name " $AKS " \
2422- --query " apiServerAccessProfile.authorizedIPRanges" \
2423- -o tsv | tr ' \t' ' ,' )
2424-
2425- if [[ -z " $CURRENT_IPS " ]]; then
2426- echolog " No authorized IPs are currently set. Nothing to remove."
2427- else
2428- echolog " Current authorized IPs: $CURRENT_IPS "
2429- if [ -n " $DS_IP " ]; then
2430- echolog " Removing DS_IP: $DS_IP "
2431- # Convert to array and filter out REMOVE_IP
2432- NEW_IPS=$( echo " $CURRENT_IPS " | tr ' ,' ' \n' | grep -vw " $DS_IP " | paste -sd " ," -)
2433-
2434- if [[ " $NEW_IPS " == " $CURRENT_IPS " ]]; then
2435- echolog " IP $DS_IP not found in the current list. Nothing to do."
2436- fi
2472+ az aks update -g ${RG} -n ${AKS} --debug --api-server-authorized-ip-ranges " ${CURRENT_AUTHORIZED_IPS} " >> $LOGFILE 2>&1
24372473
2438- echolog " Updating authorized IP ranges: $NEW_IPS "
2474+ echolog " [applyAllowlist] Setting Storage Account Deny default action..."
2475+ wait_for_fn_result setStorageAccountDenyDefaultAction
24392476
2440- az aks update \
2441- --resource-group " $RG " \
2442- --name " $AKS " \
2443- --api-server-authorized-ip-ranges " $NEW_IPS "
2444- else
2445- echolog " DS_IP is empty. Nothing to do."
2446- fi
2447- fi
2477+ echolog " [applyAllowlist] Adding Storage Account Network Rules..."
2478+ wait_for_fn_result addStorageAccountNetworkRules
2479+ else
2480+ echolog " USE_IP_ALLOWLIST=${USE_IP_ALLOWLIST} , so we won't lock down deployment."
24482481 fi
2449- else
2450- echolog " USE_IP_ALLOWLIST=${USE_IP_ALLOWLIST} , so we won't lock down deployment."
24512482fi
24522483
2453-
24542484# Write output
24552485RESULT=" {"
24562486RESULT+=" \" v4CfgCadence\" :\" ${V4_CFG_CADENCE} \" "
0 commit comments