Skip to content

Commit f0ce88b

Browse files
sagustavosagustavo
committed
Fixing ACR and KV permission errors
1 parent 083da9e commit f0ce88b

4 files changed

Lines changed: 232 additions & 11 deletions

File tree

‎.github/capp-kairos-broker.yml‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,10 @@ type: Microsoft.App/containerApps
22
name: capp-kairos-broker
33
location: eastus2
44
identity:
5-
type: SystemAssigned
5+
type: UserAssigned
6+
userAssignedIdentities:
7+
"/subscriptions/28b743cd-805d-4451-ba1f-067df11cbafc/resourcegroups/kairos/providers/Microsoft.ManagedIdentity/userAssignedIdentities/kairos-service": {}
8+
69
properties:
710
environmentId: "/subscriptions/28b743cd-805d-4451-ba1f-067df11cbafc/resourceGroups/kairos/providers/Microsoft.App/managedEnvironments/cae-kairos"
811

@@ -15,13 +18,17 @@ properties:
1518
secrets:
1619
- name: azure-tenant-id
1720
keyVaultUrl: https://kv-kairos.vault.azure.net/secrets/sp-tenant-id
18-
identity: system
21+
identity: "/subscriptions/28b743cd-805d-4451-ba1f-067df11cbafc/resourcegroups/kairos/providers/Microsoft.ManagedIdentity/userAssignedIdentities/kairos-service"
1922
- name: azure-client-id
2023
keyVaultUrl: https://kv-kairos.vault.azure.net/secrets/sp-client-id
21-
identity: system
24+
identity: "/subscriptions/28b743cd-805d-4451-ba1f-067df11cbafc/resourcegroups/kairos/providers/Microsoft.ManagedIdentity/userAssignedIdentities/kairos-service"
2225
- name: azure-client-secret
2326
keyVaultUrl: https://kv-kairos.vault.azure.net/secrets/sp-client-secret
24-
identity: system
27+
identity: "/subscriptions/28b743cd-805d-4451-ba1f-067df11cbafc/resourcegroups/kairos/providers/Microsoft.ManagedIdentity/userAssignedIdentities/kairos-service"
28+
29+
registries:
30+
- server: kairosfinance.azurecr.io
31+
identity: "/subscriptions/28b743cd-805d-4451-ba1f-067df11cbafc/resourcegroups/kairos/providers/Microsoft.ManagedIdentity/userAssignedIdentities/kairos-service"
2532

2633
template:
2734
containers:

‎.github/capp-kairos-rabbitmq.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,10 +30,9 @@ properties:
3030
memory: 2Gi
3131
env:
3232
- name: RABBITMQ_DEFAULT_USER
33-
value: guest
33+
value: dev
3434
- name: RABBITMQ_DEFAULT_PASS
35-
# secretRef: rabbitmq-pass
36-
value: guest
35+
secretRef: rabbitmq-pass
3736

3837
volumeMounts:
3938
- volumeName: rabbitmq-data

‎.github/infra.md‎

Lines changed: 50 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
## Container App Environment
1+
## Container App Env
22

3-
The ACA environment **must** be created with a subnet, because it's required to allow the container apps expose multiple ports. In this case, some containers, like RabbitMQ's and Seq's, will need to expose one HTTP port for the management UI and at least one TCP port, which will be used by the Kairos API to integrate with this infra.
3+
The Azure Container App (ACA) Environment **must** be created with a subnet, because it's required to allow the container apps expose multiple ports. In this case, some containers, like RabbitMQ's and Seq's, will need to expose one HTTP port for the management UI and at least one TCP port, which will be used by the Kairos API to integrate with this infra.
44

55
```bash
66
RG_NAME="kairos"
@@ -76,7 +76,7 @@ az containerapp create \
7676
--yaml .github/capp-kairos-rabbitmq.yml
7777
```
7878

79-
# Seq
79+
## Seq
8080

8181
Assuming that the storage account was already created because of RabbitMQ, then the seq infra creation would be the following:
8282

@@ -113,4 +113,51 @@ az containerapp create \
113113
--resource-group kairos \
114114
--environment cae-kairos \
115115
--yaml .github/capp-kairos-seq.yml
116+
```
117+
118+
## Kairos Broker
119+
120+
Before creating the app itself, a user assigned managed identity should be created, because it'll be granted a ACR Pull permission, which will be used by the capp-kairos-broker creation YAML.
121+
122+
```sh
123+
az identity create -n kairos-service -g kairos
124+
125+
PRINCIPAL_ID=$(az identity show \
126+
--name kairos-service \
127+
--resource-group kairos \
128+
--query principalId \
129+
--output tsv)
130+
131+
az keyvault set-policy \
132+
--name kv-kairos \
133+
--resource-group kairos \
134+
--object-id $PRINCIPAL_ID \
135+
--secret-permissions get list
136+
137+
ACR_ID=$(az acr show \
138+
--name kairosfinance \
139+
--resource-group kairos \
140+
--query id \
141+
--output tsv)
142+
143+
az role assignment create \
144+
--assignee $PRINCIPAL_ID \
145+
--scope $ACR_ID \
146+
--role "AcrPull"
147+
```
148+
149+
Now the app can be created:
150+
151+
```sh
152+
docker build --no-cache \
153+
-t kairosfinance.azurecr.io/kairos/broker . \
154+
-f ./src/Gateway/Dockerfile
155+
156+
docker push kairosfinance.azurecr.io/kairos/broker
157+
158+
az containerapp create \
159+
--name capp-kairos-broker \
160+
--resource-group kairos \
161+
--environment cae-kairos \
162+
--yaml .github/capp-kairos-broker.yml
116163
```

‎README.md‎

Lines changed: 169 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,4 +41,172 @@ AZURE_CLIENT_ID=
4141
AZURE_CLIENT_SECRET=
4242
```
4343

44-
After setting the correct values you can simply execute `docker compose up -d`
44+
After setting the correct values you can simply execute `docker compose up -d`
45+
46+
# Infra
47+
48+
After manually creating some basic resources such as RG, KV and ACR, the following instructions might come in handy for automatically creating more complex infra, such as vnet, subnet, storage account, file share, ACA environment, the ACAs themselves, etc.
49+
50+
## Container App Env
51+
52+
The Azure Container App (ACA) Environment **must** be created with a subnet, because it's required to allow the container apps expose multiple ports. In this case, some containers, like RabbitMQ's and Seq's, will need to expose one HTTP port for the management UI and at least one TCP port, which will be used by the Kairos API to integrate with this infra.
53+
54+
```bash
55+
RG_NAME="kairos"
56+
LOCATION="eastus2"
57+
VNET_NAME="vnet-kairos"
58+
SUBNET_NAME="cae-subnet"
59+
60+
az network vnet create \
61+
--resource-group $RG_NAME \
62+
--name $VNET_NAME \
63+
--location $LOCATION \
64+
--address-prefix 10.0.0.0/16
65+
66+
az network vnet subnet create \
67+
--resource-group $RG_NAME \
68+
--vnet-name $VNET_NAME \
69+
--name $SUBNET_NAME \
70+
--address-prefix 10.0.1.0/27 \
71+
--delegations "Microsoft.App/environments"
72+
73+
SUBNET_ID=$(az network vnet subnet show --resource-group $RG_NAME --vnet-name $VNET_NAME --name $SUBNET_NAME --query id -o tsv)
74+
75+
az containerapp env create \
76+
--name cae-kairos \
77+
--resource-group $RG_NAME \
78+
--location $LOCATION \
79+
--infrastructure-subnet-resource-id $SUBNET_ID
80+
```
81+
82+
## RabbitMQ
83+
84+
Before creating the RabbitMQ container app, it's required to create an Azure File Share that'll be used for mounting the volume, in order to persist the Rabbit data.
85+
86+
```sh
87+
STORAGE_ACCOUNT="kairostoraging"
88+
89+
# Create a Storage Account
90+
az storage account create \
91+
--name $STORAGE_ACCOUNT \
92+
--resource-group kairos \
93+
--location eastus2 \
94+
--sku Standard_LRS
95+
96+
# Get the Storage Account Key
97+
STORAGE_KEY=$(az storage account keys list -g kairos -n $STORAGE_ACCOUNT --query "[0].value" -o tsv)
98+
99+
# Create the File Share
100+
FILE_SHARE="fs-kairos-rabbitmq"
101+
102+
az storage share create \
103+
--name $FILE_SHARE \
104+
--account-name $STORAGE_ACCOUNT \
105+
--account-key $STORAGE_KEY
106+
107+
# Link ACA env to the storage
108+
az containerapp env storage set \
109+
--name cae-kairos \
110+
--resource-group kairos \
111+
--storage-name rabbitmq-data \
112+
--azure-file-account-name $STORAGE_ACCOUNT \
113+
--azure-file-account-key $STORAGE_KEY \
114+
--azure-file-share-name $FILE_SHARE \
115+
--access-mode ReadWrite
116+
```
117+
118+
Now the ACA can be created:
119+
120+
```sh
121+
az containerapp create \
122+
--name capp-kairos-rabbitmq \
123+
--resource-group kairos \
124+
--environment cae-kairos \
125+
--yaml .github/capp-kairos-rabbitmq.yml
126+
```
127+
128+
## Seq
129+
130+
Assuming that the storage account was already created because of RabbitMQ, then the seq infra creation would be the following:
131+
132+
```sh
133+
STORAGE_ACCOUNT="kairostoraging"
134+
135+
# Get the Storage Account Key
136+
STORAGE_KEY=$(az storage account keys list -g kairos -n $STORAGE_ACCOUNT --query "[0].value" -o tsv)
137+
138+
# Create the File Share
139+
FILE_SHARE="fs-kairos-seq"
140+
141+
az storage share create \
142+
--name $FILE_SHARE \
143+
--account-name $STORAGE_ACCOUNT \
144+
--account-key $STORAGE_KEY
145+
146+
# Link ACA env to the storage
147+
az containerapp env storage set \
148+
--name cae-kairos \
149+
--resource-group kairos \
150+
--storage-name seq-data \
151+
--azure-file-account-name $STORAGE_ACCOUNT \
152+
--azure-file-account-key $STORAGE_KEY \
153+
--azure-file-share-name $FILE_SHARE \
154+
--access-mode ReadWrite
155+
```
156+
157+
Now the ACA can be created:
158+
159+
```sh
160+
az containerapp create \
161+
--name capp-kairos-seq \
162+
--resource-group kairos \
163+
--environment cae-kairos \
164+
--yaml .github/capp-kairos-seq.yml
165+
```
166+
167+
## Kairos Broker
168+
169+
Before creating the app itself, a user assigned managed identity should be created, because it'll be granted a ACR Pull permission, which will be used by the capp-kairos-broker creation YAML.
170+
171+
```sh
172+
az identity create -n kairos-service -g kairos
173+
174+
PRINCIPAL_ID=$(az identity show \
175+
--name kairos-service \
176+
--resource-group kairos \
177+
--query principalId \
178+
--output tsv)
179+
180+
az keyvault set-policy \
181+
--name kv-kairos \
182+
--resource-group kairos \
183+
--object-id $PRINCIPAL_ID \
184+
--secret-permissions get list
185+
186+
ACR_ID=$(az acr show \
187+
--name kairosfinance \
188+
--resource-group kairos \
189+
--query id \
190+
--output tsv)
191+
192+
az role assignment create \
193+
--assignee $PRINCIPAL_ID \
194+
--scope $ACR_ID \
195+
--role "AcrPull"
196+
```
197+
198+
Now the app can be created:
199+
200+
```sh
201+
docker build --no-cache \
202+
-t kairosfinance.azurecr.io/kairos/broker . \
203+
-f ./src/Gateway/Dockerfile
204+
205+
docker push kairosfinance.azurecr.io/kairos/broker
206+
207+
az containerapp create \
208+
--name capp-kairos-broker \
209+
--resource-group kairos \
210+
--environment cae-kairos \
211+
--yaml .github/capp-kairos-broker.yml
212+
```

0 commit comments

Comments
 (0)