diff --git a/policies/cilium/egress-tutorial/00-install-cilium-hubble-cli.sh b/policies/cilium/egress-tutorial/00-install-cilium-hubble-cli.sh index 55e5ee1..11b78ad 100755 --- a/policies/cilium/egress-tutorial/00-install-cilium-hubble-cli.sh +++ b/policies/cilium/egress-tutorial/00-install-cilium-hubble-cli.sh @@ -2,18 +2,18 @@ # For more information, see https://docs.cilium.io/en/latest/gettingstarted/k8s-install-default/#install-the-cilium-cli -CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/master/stable.txt) +CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/main/stable.txt) CLI_ARCH=amd64 if [ "$(uname -m)" = "aarch64" ]; then CLI_ARCH=arm64; fi curl -L --fail --remote-name-all https://github.com/cilium/cilium-cli/releases/download/${CILIUM_CLI_VERSION}/cilium-linux-${CLI_ARCH}.tar.gz{,.sha256sum} sha256sum --check cilium-linux-${CLI_ARCH}.tar.gz.sha256sum sudo tar xzvfC cilium-linux-${CLI_ARCH}.tar.gz /usr/local/bin -rm cilium-linux-${CLI_ARCH}.tar.gz{,.sha256sum} +rm cilium-linux-${CLI_ARCH}.tar.gz cilium-linux-${CLI_ARCH}.tar.gz.sha256sum -HUBBLE_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/hubble/master/stable.txt) +HUBBLE_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/hubble/main/stable.txt) HUBBLE_ARCH=amd64 if [ "$(uname -m)" = "aarch64" ]; then HUBBLE_ARCH=arm64; fi curl -L --fail --remote-name-all https://github.com/cilium/hubble/releases/download/$HUBBLE_VERSION/hubble-linux-${HUBBLE_ARCH}.tar.gz{,.sha256sum} sha256sum --check hubble-linux-${HUBBLE_ARCH}.tar.gz.sha256sum sudo tar xzvfC hubble-linux-${HUBBLE_ARCH}.tar.gz /usr/local/bin -rm hubble-linux-${HUBBLE_ARCH}.tar.gz{,.sha256sum} +rm hubble-linux-${HUBBLE_ARCH}.tar.gz hubble-linux-${HUBBLE_ARCH}.tar.gz.sha256sum diff --git a/policies/cilium/egress-tutorial/01-deploy-demo.sh b/policies/cilium/egress-tutorial/01-deploy-demo.sh index 06e1f3a..0816917 100755 --- a/policies/cilium/egress-tutorial/01-deploy-demo.sh +++ b/policies/cilium/egress-tutorial/01-deploy-demo.sh @@ -25,5 +25,9 @@ fi # Deploy the demo kubectl apply -n $namespace -f $template +# Wait for the pod to be ready before running the connectivity checks +echo "Waiting for the mediabot pod to be ready..." +kubectl wait --namespace $namespace --for=condition=Ready pod/mediabot --timeout=120s + # Check the status of the pods and services kubectl get pods,svc -n $namespace diff --git a/policies/cilium/egress-tutorial/02-call-services.sh b/policies/cilium/egress-tutorial/02-call-services.sh new file mode 100755 index 0000000..6a4441b --- /dev/null +++ b/policies/cilium/egress-tutorial/02-call-services.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +# Variables +namespace="starwars" + +# Connect to pods and try to land +echo "Calling https://api.github.com from mediabot pod..." +kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://api.github.com | head -1 # This call should succeed as no network policy is applied yet +echo "Calling http://api.github.com from mediabot pod..." +kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 http://api.github.com | head -1 # This call should succeed as no network policy is applied yet and HTTP is redirected to HTTPS +echo "Calling https://status.github.com from mediabot pod..." +kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://status.github.com | head -1 # This call should succeed as no network policy is applied yet +echo "Calling https://github.com from mediabot pod..." +kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://github.com | head -1 # This call should succeed as no network policy is applied yet \ No newline at end of file diff --git a/policies/cilium/egress-tutorial/02-create-dns-matchname-policy.sh b/policies/cilium/egress-tutorial/03-create-dns-matchname-policy.sh similarity index 100% rename from policies/cilium/egress-tutorial/02-create-dns-matchname-policy.sh rename to policies/cilium/egress-tutorial/03-create-dns-matchname-policy.sh diff --git a/policies/cilium/egress-tutorial/04-call-services.sh b/policies/cilium/egress-tutorial/04-call-services.sh new file mode 100755 index 0000000..37d649c --- /dev/null +++ b/policies/cilium/egress-tutorial/04-call-services.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +# Variables +namespace="starwars" + +# Connect to pods and try to land +echo "Calling https://api.github.com from mediabot pod..." +kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://api.github.com | head -1 # This call should succeed as api.github.com is allowed by the DNS whitelist +echo "Calling http://api.github.com from mediabot pod..." +kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 http://api.github.com | head -1 # This call should succeed as api.github.com is allowed by the DNS whitelist and HTTP is redirected to HTTPS +echo "Calling https://status.github.com from mediabot pod..." +kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://status.github.com | head -1 # This call should fails as status.github.com is not allowed by the DNS whitelist +echo "Calling https://github.com from mediabot pod..." +kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://github.com | head -1 # This call should fail as github.com is not allowed by the DNS whitelist \ No newline at end of file diff --git a/policies/cilium/egress-tutorial/03-create-dns-pattern-policy.sh b/policies/cilium/egress-tutorial/05-create-dns-pattern-policy.sh similarity index 100% rename from policies/cilium/egress-tutorial/03-create-dns-pattern-policy.sh rename to policies/cilium/egress-tutorial/05-create-dns-pattern-policy.sh diff --git a/policies/cilium/egress-tutorial/06-call-services.sh b/policies/cilium/egress-tutorial/06-call-services.sh new file mode 100755 index 0000000..5d61409 --- /dev/null +++ b/policies/cilium/egress-tutorial/06-call-services.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +# Variables +namespace="starwars" + +# Connect to pods and try to land +echo "Calling https://api.github.com from mediabot pod..." +kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://api.github.com | head -1 # This call should succeed as api.github.com is allowed by the DNS whitelist +echo "Calling http://api.github.com from mediabot pod..." +kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 http://api.github.com | head -1 # This call should succeed as api.github.com is allowed by the DNS whitelist and HTTP is redirected to HTTPS +echo "Calling https://status.github.com from mediabot pod..." +kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://status.github.com | head -1 # This call should succeed as api.github.com is allowed by the DNS whitelist +echo "Calling https://github.com from mediabot pod..." +kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://github.com | head -1 # This call should fail as github.com is not allowed by the DNS whitelist \ No newline at end of file diff --git a/policies/cilium/egress-tutorial/07-call-services.sh b/policies/cilium/egress-tutorial/07-call-services.sh deleted file mode 100755 index dd18ee4..0000000 --- a/policies/cilium/egress-tutorial/07-call-services.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/bash - -# Variables -namespace="starwars" - -# Connect to pods and try to land -kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://api.github.com | head -1 # The api.github.com url does not exist -kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 http://api.github.com | head -1 # This call fails as the network policy allows only HTTPS traffic on port 443 -kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://github.com | head -1 # This call is not allowed by the policy because the DNS whitelist does not contain github.com, only *.github.com diff --git a/policies/cilium/egress-tutorial/04-create-dns-port-policy.sh b/policies/cilium/egress-tutorial/07-create-dns-port-policy.sh similarity index 100% rename from policies/cilium/egress-tutorial/04-create-dns-port-policy.sh rename to policies/cilium/egress-tutorial/07-create-dns-port-policy.sh diff --git a/policies/cilium/egress-tutorial/08-call-services.sh b/policies/cilium/egress-tutorial/08-call-services.sh new file mode 100755 index 0000000..3886882 --- /dev/null +++ b/policies/cilium/egress-tutorial/08-call-services.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +# Variables +namespace="starwars" + +# Connect to pods and try to land +echo "Calling https://api.github.com from mediabot pod..." +kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://api.github.com | head -1 # This call should succeed as api.github.com is allowed by the DNS whitelist +echo "Calling http://api.github.com from mediabot pod..." +kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 http://api.github.com | head -1 # This call should fail as the network policy allows only HTTPS traffic on port 443 +echo "Calling https://status.github.com from mediabot pod..." +kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://status.github.com | head -1 # This call should succeed as api.github.com is allowed by the DNS whitelist +echo "Calling https://github.com from mediabot pod..." +kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://github.com | head -1 # This call should fail as github.com is not allowed by the DNS whitelist \ No newline at end of file diff --git a/policies/cilium/egress-tutorial/05-get-policy.sh b/policies/cilium/egress-tutorial/09-get-policy.sh similarity index 100% rename from policies/cilium/egress-tutorial/05-get-policy.sh rename to policies/cilium/egress-tutorial/09-get-policy.sh diff --git a/policies/cilium/egress-tutorial/06-cilium-endpoint-list.sh b/policies/cilium/egress-tutorial/10-cilium-endpoint-list.sh similarity index 100% rename from policies/cilium/egress-tutorial/06-cilium-endpoint-list.sh rename to policies/cilium/egress-tutorial/10-cilium-endpoint-list.sh diff --git a/policies/cilium/egress-tutorial/11-cleanup.sh b/policies/cilium/egress-tutorial/11-cleanup.sh new file mode 100755 index 0000000..0844b01 --- /dev/null +++ b/policies/cilium/egress-tutorial/11-cleanup.sh @@ -0,0 +1,22 @@ +#!/bin/bash + +# Variables +namespace="starwars" + +# Controlla se il namespace esiste nel cluster +if kubectl get namespace "$namespace" >/dev/null 2>&1; then + echo "Deleting [$namespace] namespace and all its resources..." + kubectl delete namespace "$namespace" --wait=false + + # Aspetta il completamento, intercettando il timeout + if ! kubectl wait --for=delete namespace/$namespace --timeout=60s 2>/dev/null; then + echo "Namespace deletion is taking longer than expected. Forcing finalizer removal..." + kubectl patch namespace "$namespace" -p '{"spec":{"finalizers":[]}}' --type=merge 2>/dev/null + + # Ultima verifica breve + kubectl wait --for=delete namespace/$namespace --timeout=10s 2>/dev/null + fi + echo "[$namespace] namespace and all its resources have been deleted" +else + echo "[$namespace] namespace does not exist in the cluster, nothing to clean up" +fi \ No newline at end of file diff --git a/policies/cilium/ingress-tutorial/00-install-cilium-hubble-cli.sh b/policies/cilium/ingress-tutorial/00-install-cilium-hubble-cli.sh index 55e5ee1..11b78ad 100755 --- a/policies/cilium/ingress-tutorial/00-install-cilium-hubble-cli.sh +++ b/policies/cilium/ingress-tutorial/00-install-cilium-hubble-cli.sh @@ -2,18 +2,18 @@ # For more information, see https://docs.cilium.io/en/latest/gettingstarted/k8s-install-default/#install-the-cilium-cli -CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/master/stable.txt) +CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/main/stable.txt) CLI_ARCH=amd64 if [ "$(uname -m)" = "aarch64" ]; then CLI_ARCH=arm64; fi curl -L --fail --remote-name-all https://github.com/cilium/cilium-cli/releases/download/${CILIUM_CLI_VERSION}/cilium-linux-${CLI_ARCH}.tar.gz{,.sha256sum} sha256sum --check cilium-linux-${CLI_ARCH}.tar.gz.sha256sum sudo tar xzvfC cilium-linux-${CLI_ARCH}.tar.gz /usr/local/bin -rm cilium-linux-${CLI_ARCH}.tar.gz{,.sha256sum} +rm cilium-linux-${CLI_ARCH}.tar.gz cilium-linux-${CLI_ARCH}.tar.gz.sha256sum -HUBBLE_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/hubble/master/stable.txt) +HUBBLE_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/hubble/main/stable.txt) HUBBLE_ARCH=amd64 if [ "$(uname -m)" = "aarch64" ]; then HUBBLE_ARCH=arm64; fi curl -L --fail --remote-name-all https://github.com/cilium/hubble/releases/download/$HUBBLE_VERSION/hubble-linux-${HUBBLE_ARCH}.tar.gz{,.sha256sum} sha256sum --check hubble-linux-${HUBBLE_ARCH}.tar.gz.sha256sum sudo tar xzvfC hubble-linux-${HUBBLE_ARCH}.tar.gz /usr/local/bin -rm hubble-linux-${HUBBLE_ARCH}.tar.gz{,.sha256sum} +rm hubble-linux-${HUBBLE_ARCH}.tar.gz hubble-linux-${HUBBLE_ARCH}.tar.gz.sha256sum diff --git a/policies/cilium/ingress-tutorial/01-deploy-demo.sh b/policies/cilium/ingress-tutorial/01-deploy-demo.sh index e1eced7..4c0d3f8 100755 --- a/policies/cilium/ingress-tutorial/01-deploy-demo.sh +++ b/policies/cilium/ingress-tutorial/01-deploy-demo.sh @@ -25,5 +25,11 @@ fi # Deploy the demo kubectl apply -n $namespace -f $template +# Wait for the workloads to be ready before running the connectivity checks +echo "Waiting for the workloads to be ready..." +kubectl wait --namespace $namespace --for=condition=Available deployment/deathstar --timeout=120s +kubectl wait --namespace $namespace --for=condition=Ready pod/tiefighter --timeout=120s +kubectl wait --namespace $namespace --for=condition=Ready pod/xwing --timeout=120s + # Check the status of the pods and services kubectl get pods,svc -n $namespace diff --git a/policies/cilium/ingress-tutorial/05-call-request-landing-web-method.sh b/policies/cilium/ingress-tutorial/05-call-request-landing-web-method.sh index 8f62022..c09d4d7 100755 --- a/policies/cilium/ingress-tutorial/05-call-request-landing-web-method.sh +++ b/policies/cilium/ingress-tutorial/05-call-request-landing-web-method.sh @@ -4,5 +4,5 @@ namespace="starwars" # Connect to pods and try to land -kubectl exec tiefighter -n $namespace -- curl -s -XPOST --connect-timeout 5 deathstar.$namespace.svc.cluster.local/v1/request-landing -kubectl exec xwing -n $namespace -- curl -s -XPOST --connect-timeout 5 deathstar.$namespace.svc.cluster.local/v1/request-landing +kubectl exec tiefighter -n $namespace -- curl -s -XPOST --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/request-landing +kubectl exec xwing -n $namespace -- curl -s -XPOST --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/request-landing diff --git a/policies/cilium/ingress-tutorial/06-call-other-web-method.sh b/policies/cilium/ingress-tutorial/06-call-other-web-method.sh index ba95f77..653fbb5 100755 --- a/policies/cilium/ingress-tutorial/06-call-other-web-method.sh +++ b/policies/cilium/ingress-tutorial/06-call-other-web-method.sh @@ -4,5 +4,5 @@ namespace="starwars" # Connect to pods and try to land -kubectl exec tiefighter -n $namespace -- curl -s -XPUT --connect-timeout 3 deathstar.$namespace.svc.cluster.local/v1/exhaust-port -kubectl exec xwing -n $namespace -- curl -s -XPUT --connect-timeout 3 deathstar.$namespace.svc.cluster.local/v1/exhaust-port +kubectl exec tiefighter -n $namespace -- curl -s -XPUT --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/exhaust-port +kubectl exec xwing -n $namespace -- curl -s -XPUT --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/exhaust-port diff --git a/policies/cilium/ingress-tutorial/08-call-deathstar-methods.sh b/policies/cilium/ingress-tutorial/08-call-deathstar-methods.sh new file mode 100755 index 0000000..98dfce1 --- /dev/null +++ b/policies/cilium/ingress-tutorial/08-call-deathstar-methods.sh @@ -0,0 +1,16 @@ +#!/bin/bash + +# Variables +namespace="starwars" + +# Connect to pods and try to land. The first call should succeed, while the second one should be blocked by Cilium's L7 policy. +echo "Calling /v1/request-landing and /v1/exhaust-port from the tiefighter pod..." +kubectl exec tiefighter -n $namespace -- curl -s -XPOST --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/request-landing +echo "Calling /v1/exhaust-port from the tiefighter pod..." +kubectl exec tiefighter -n $namespace -- curl -s -XPUT --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/exhaust-port + +# The following calls should timeout, as the xwing pod is not allowed to access the deathstar service. +echo "Calling /v1/request-landing and /v1/exhaust-port from the xwing pod..." +kubectl exec xwing -n $namespace -- curl -s -XPOST --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/request-landing +echo "Calling /v1/exhaust-port from the xwing pod..." +kubectl exec xwing -n $namespace -- curl -s -XPUT --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/exhaust-port \ No newline at end of file diff --git a/policies/cilium/ingress-tutorial/09-call-deathstar-methods-from-tiefighter.sh b/policies/cilium/ingress-tutorial/09-call-deathstar-methods-from-tiefighter.sh deleted file mode 100755 index 8524992..0000000 --- a/policies/cilium/ingress-tutorial/09-call-deathstar-methods-from-tiefighter.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/bash - -# Variables -namespace="starwars" - -# Connect to pods and try to land. The first call should succeed, while the second one should be blocked by Cilium's L7 policy. -kubectl exec tiefighter -n $namespace -- curl -s -XPOST deathstar.$namespace.svc.cluster.local/v1/request-landing -kubectl exec tiefighter -n $namespace -- curl -s -XPUT deathstar.$namespace.svc.cluster.local/v1/exhaust-port - -# The following calls should timeout, as the xwing pod is not allowed to access the deathstar service. -kubectl exec xwing -n $namespace -- curl -s -XPOST --connect-timeout 3 deathstar.$namespace.svc.cluster.local/v1/request-landing -kubectl exec xwing -n $namespace -- curl -s -XPUT --connect-timeout 3 deathstar.$namespace.svc.cluster.local/v1/exhaust-port \ No newline at end of file diff --git a/policies/cilium/ingress-tutorial/08-create-l3-l4-l7-policy.sh b/policies/cilium/ingress-tutorial/09-create-l3-l4-l7-policy.sh similarity index 100% rename from policies/cilium/ingress-tutorial/08-create-l3-l4-l7-policy.sh rename to policies/cilium/ingress-tutorial/09-create-l3-l4-l7-policy.sh diff --git a/policies/cilium/ingress-tutorial/10-call-deathstar-methods.sh b/policies/cilium/ingress-tutorial/10-call-deathstar-methods.sh new file mode 100755 index 0000000..98dfce1 --- /dev/null +++ b/policies/cilium/ingress-tutorial/10-call-deathstar-methods.sh @@ -0,0 +1,16 @@ +#!/bin/bash + +# Variables +namespace="starwars" + +# Connect to pods and try to land. The first call should succeed, while the second one should be blocked by Cilium's L7 policy. +echo "Calling /v1/request-landing and /v1/exhaust-port from the tiefighter pod..." +kubectl exec tiefighter -n $namespace -- curl -s -XPOST --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/request-landing +echo "Calling /v1/exhaust-port from the tiefighter pod..." +kubectl exec tiefighter -n $namespace -- curl -s -XPUT --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/exhaust-port + +# The following calls should timeout, as the xwing pod is not allowed to access the deathstar service. +echo "Calling /v1/request-landing and /v1/exhaust-port from the xwing pod..." +kubectl exec xwing -n $namespace -- curl -s -XPOST --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/request-landing +echo "Calling /v1/exhaust-port from the xwing pod..." +kubectl exec xwing -n $namespace -- curl -s -XPUT --connect-timeout 3 --max-time 3 deathstar.$namespace.svc.cluster.local/v1/exhaust-port \ No newline at end of file diff --git a/policies/cilium/ingress-tutorial/10-get-policy.sh b/policies/cilium/ingress-tutorial/11-get-policy.sh similarity index 100% rename from policies/cilium/ingress-tutorial/10-get-policy.sh rename to policies/cilium/ingress-tutorial/11-get-policy.sh diff --git a/policies/cilium/ingress-tutorial/12-cleanup.sh b/policies/cilium/ingress-tutorial/12-cleanup.sh new file mode 100755 index 0000000..0844b01 --- /dev/null +++ b/policies/cilium/ingress-tutorial/12-cleanup.sh @@ -0,0 +1,22 @@ +#!/bin/bash + +# Variables +namespace="starwars" + +# Controlla se il namespace esiste nel cluster +if kubectl get namespace "$namespace" >/dev/null 2>&1; then + echo "Deleting [$namespace] namespace and all its resources..." + kubectl delete namespace "$namespace" --wait=false + + # Aspetta il completamento, intercettando il timeout + if ! kubectl wait --for=delete namespace/$namespace --timeout=60s 2>/dev/null; then + echo "Namespace deletion is taking longer than expected. Forcing finalizer removal..." + kubectl patch namespace "$namespace" -p '{"spec":{"finalizers":[]}}' --type=merge 2>/dev/null + + # Ultima verifica breve + kubectl wait --for=delete namespace/$namespace --timeout=10s 2>/dev/null + fi + echo "[$namespace] namespace and all its resources have been deleted" +else + echo "[$namespace] namespace does not exist in the cluster, nothing to clean up" +fi \ No newline at end of file diff --git a/scripts/01-system-assigned-managed-identity.sh b/scripts/01-system-assigned-managed-identity.sh index ded56d3..f1f6600 100755 --- a/scripts/01-system-assigned-managed-identity.sh +++ b/scripts/01-system-assigned-managed-identity.sh @@ -3,7 +3,7 @@ # Variables # Azure Kubernetes Service (AKS) cluster -prefix="local" # local, poseidon, hades, demeter, apollo, artemis, ares, athena, hephaestus, hermes +prefix="local" # zeus, poseidon, hades, demeter, apollo, artemis, ares, athena, hephaestus, hermes suffix="test" aks_cluster_name="$prefix-aks-$suffix" resource_group_name="$prefix-rg" @@ -46,12 +46,6 @@ ssh_key_value="$HOME/.ssh/id_rsa.pub" windows_admin_username="azadmin" windows_admin_password="Trustno123456!" -# Network policy -network_plugin="azure" #azure, kubenet, none -network_policy="azure" #calico, azure, cilium, none -network_plugin_mode="overlay" -network_dataplane="azure" #cilium, azure - # Node count variables node_count=3 min_count=3 @@ -76,61 +70,94 @@ RETRY_COUNT=3 SLEEP=5 # Extensions to register -install_extensions=0 -aks_extensions=("ManagedGatewayAPIPreview") +install_extensions_and_features=0 +aks_features=("ManagedGatewayAPIPreview") registering_extensions=() ok=0 +# Print the menu +echo "====================================" +echo "Run Docker Container (1-3): " +echo "====================================" +options=( + "Azure Network Plugin + Azure Network Policy" + "Azure Network Plugin + Cilium Network Policy" + "Azure Network Plugin + Calico Network Policy" + "Quit" +) +name="" +# Select an option +COLUMNS=0 +select option in "${options[@]}"; do + case $option in + "Azure Network Plugin + Azure Network Policy") + # Network policy + network_plugin="azure" #azure, kubenet, none + network_policy="azure" #calico, azure, cilium, none + network_plugin_mode="overlay" + network_dataplane="azure" #cilium, azure + break + ;; + "Azure Network Plugin + Cilium Network Policy") + # Network policy + network_plugin="azure" #azure, kubenet, none + network_policy="cilium" #calico, azure, cilium, none + network_plugin_mode="overlay" + network_dataplane="cilium" #cilium, azure + break + ;; + "Azure Network Plugin + Calico Network Policy") + # Network policy + network_plugin="azure" #azure, kubenet, none + network_policy="calico" #calico, azure, cilium, none + network_plugin_mode="overlay" + network_dataplane="azure" #cilium, azure + break + ;; + "Quit") + exit + ;; + *) echo "invalid option $REPLY" ;; + esac +done + # Install aks-preview Azure extension -if [[ $install_extensions == 1 ]]; then - echo "Checking if [aks-preview] extension is already installed..." - az extension show --name aks-preview &>/dev/null +if [[ $install_extensions_and_features == 1 ]]; then + echo "Adding or upgrading [aks-preview] extension..." + az extension add --upgrade --name aks-preview &>/dev/null if [[ $? == 0 ]]; then - echo "[aks-preview] extension is already installed" - - # Update the extension to make sure you have the latest version installed - echo "Updating [aks-preview] extension..." - az extension update --name aks-preview &>/dev/null + echo "[aks-preview] extension successfully installed or upgraded" else - echo "[aks-preview] extension is not installed. Installing..." - - # Install aks-preview extension - az extension add --name aks-preview 1>/dev/null - - if [[ $? == 0 ]]; then - echo "[aks-preview] extension successfully installed" - else - echo "Failed to install [aks-preview] extension" - exit - fi + echo "Failed to install or upgrade [aks-preview] extension" + exit fi # Registering AKS features - for aks_extension in "${aks_extensions[@]}"; do - echo "Checking if [$aks_extension] extension is already registered..." - extension=$(az feature list -o table --query "[?contains(name, 'Microsoft.ContainerService/$aks_extension') && @.properties.state == 'Registered'].{Name:name}" --output tsv) + for aks_feature in "${aks_features[@]}"; do + echo "Checking if [$aks_feature] extension is already registered..." + extension=$(az feature list -o table --query "[?contains(name, 'Microsoft.ContainerService/$aks_feature') && @.properties.state == 'Registered'].{Name:name}" --output tsv) if [[ -z $extension ]]; then - echo "[$aks_extension] extension is not registered." - echo "Registering [$aks_extension] extension..." + echo "[$aks_feature] extension is not registered." + echo "Registering [$aks_feature] extension..." az feature register \ - --name "$aks_extension" \ + --name "$aks_feature" \ --namespace Microsoft.ContainerService \ --only-show-errors 1>/dev/null - registering_extensions+=("$aks_extension") + registering_extensions+=("$aks_feature") ok=1 else - echo "[$aks_extension] extension is already registered." + echo "[$aks_feature] extension is already registered." fi done if [[ ${#registering_extensions[@]} -gt 0 ]]; then echo "${registering_extensions[@]}" fi delay=1 - for aks_extension in "${registering_extensions[@]}"; do - echo -n "Checking if [$aks_extension] extension is already registered..." + for aks_feature in "${registering_extensions[@]}"; do + echo -n "Checking if [$aks_feature] extension is already registered..." while true; do - extension=$(az feature list -o table --query "[?contains(name, 'Microsoft.ContainerService/$aks_extension') && @.properties.state == 'Registered'].{Name:name}" --output tsv) + extension=$(az feature list -o table --query "[?contains(name, 'Microsoft.ContainerService/$aks_feature') && @.properties.state == 'Registered'].{Name:name}" --output tsv) if [[ -z $extension ]]; then echo -n "." sleep $delay @@ -432,6 +459,7 @@ if [[ $? != 0 ]]; then --pod-cidr $pod_cidr \ --dns-service-ip $dns_service_ip \ --service-cidr $service_cidr \ + --enable-acns \ --enable-gateway-api \ --enable-managed-identity \ --enable-workload-identity \ diff --git a/scripts/01-user-assigned-managed-identity.sh b/scripts/01-user-assigned-managed-identity.sh index def718b..76ae8c0 100755 --- a/scripts/01-user-assigned-managed-identity.sh +++ b/scripts/01-user-assigned-managed-identity.sh @@ -3,7 +3,7 @@ # Variables # Azure Kubernetes Service (AKS) cluster -prefix="local" # horus, local, poseidon, hades, demeter, apollo, artemis, ares, athena, hephaestus, hermes +prefix="local" # horus, zeus, poseidon, hades, demeter, apollo, artemis, ares, athena, hephaestus, hermes suffix="test" aks_cluster_name="$prefix-aks-$suffix" aks_managed_identity_name="$prefix-aks-identity-$suffix" @@ -47,12 +47,6 @@ ssh_key_value="$HOME/.ssh/id_rsa.pub" windows_admin_username="azadmin" windows_admin_password="Trustno123456!" -# Network policy -network_plugin="azure" #azure, kubenet, none -network_policy="azure" #calico, azure, cilium, none -network_plugin_mode="overlay" -network_dataplane="azure" #cilium, azure - # Node count variables node_count=3 min_count=3 @@ -77,76 +71,109 @@ RETRY_COUNT=3 SLEEP=5 # Extensions to register -install_extensions=0 -aks_extensions=("ManagedGatewayAPIPreview") +install_extensions_and_features=0 +aks_features=("ManagedGatewayAPIPreview") registering_extensions=() ok=0 +# Print the menu +echo "====================================" +echo "Run Docker Container (1-3): " +echo "====================================" +options=( + "Azure Network Plugin + Azure Network Policy" + "Azure Network Plugin + Cilium Network Policy" + "Azure Network Plugin + Calico Network Policy" + "Quit" +) +name="" +# Select an option +COLUMNS=0 +select option in "${options[@]}"; do + case $option in + "Azure Network Plugin + Azure Network Policy") + # Network policy + network_plugin="azure" #azure, kubenet, none + network_policy="azure" #calico, azure, cilium, none + network_plugin_mode="overlay" + network_dataplane="azure" #cilium, azure + break + ;; + "Azure Network Plugin + Cilium Network Policy") + # Network policy + network_plugin="azure" #azure, kubenet, none + network_policy="cilium" #calico, azure, cilium, none + network_plugin_mode="overlay" + network_dataplane="cilium" #cilium, azure + break + ;; + "Azure Network Plugin + Calico Network Policy") + # Network policy + network_plugin="azure" #azure, kubenet, none + network_policy="calico" #calico, azure, cilium, none + network_plugin_mode="overlay" + network_dataplane="azure" #cilium, azure + break + ;; + "Quit") + exit + ;; + *) echo "invalid option $REPLY" ;; + esac +done + # Install aks-preview Azure extension -if [[ $install_extensions == 1 ]]; then - echo "Checking if [aks-preview] extension is already installed..." - az extension show --name aks-preview &>/dev/null - - if [[ $? == 0 ]]; then - echo "[aks-preview] extension is already installed" - - # Update the extension to make sure you have the latest version installed - echo "Updating [aks-preview] extension..." - az extension update --name aks-preview &>/dev/null - else - echo "[aks-preview] extension is not installed. Installing..." - - # Install aks-preview extension - az extension add --name aks-preview 1>/dev/null - - if [[ $? == 0 ]]; then - echo "[aks-preview] extension successfully installed" - else - echo "Failed to install [aks-preview] extension" - exit - fi - fi - - # Registering AKS features - for aks_extension in "${aks_extensions[@]}"; do - echo "Checking if [$aks_extension] extension is already registered..." - extension=$(az feature list -o table --query "[?contains(name, 'Microsoft.ContainerService/$aks_extension') && @.properties.state == 'Registered'].{Name:name}" --output tsv) - if [[ -z $extension ]]; then - echo "[$aks_extension] extension is not registered." - echo "Registering [$aks_extension] extension..." - az feature register \ - --name "$aks_extension" \ - --namespace Microsoft.ContainerService \ - --only-show-errors 1>/dev/null - registering_extensions+=("$aks_extension") - ok=1 - else - echo "[$aks_extension] extension is already registered." - fi - done - if [[ ${#registering_extensions[@]} -gt 0 ]]; then - echo "${registering_extensions[@]}" - fi - delay=1 - for aks_extension in "${registering_extensions[@]}"; do - echo -n "Checking if [$aks_extension] extension is already registered..." - while true; do - extension=$(az feature list -o table --query "[?contains(name, 'Microsoft.ContainerService/$aks_extension') && @.properties.state == 'Registered'].{Name:name}" --output tsv) - if [[ -z $extension ]]; then - echo -n "." - sleep $delay - else - echo "." - break - fi - done - done - - if [[ $ok == 1 ]]; then - echo "Refreshing the registration of the Microsoft.ContainerService resource provider..." - az provider register --namespace Microsoft.ContainerService --only-show-errors 1>/dev/null - echo "Microsoft.ContainerService resource provider registration successfully refreshed" - fi +if [[ $install_extensions_and_features == 1 ]]; then + echo "Adding or upgrading [aks-preview] extension..." + az extension add --upgrade --name aks-preview &>/dev/null + + if [[ $? == 0 ]]; then + echo "[aks-preview] extension successfully installed or upgraded" + else + echo "Failed to install or upgrade [aks-preview] extension" + exit + fi + + # Registering AKS features + for aks_feature in "${aks_features[@]}"; do + echo "Checking if [$aks_feature] extension is already registered..." + extension=$(az feature list -o table --query "[?contains(name, 'Microsoft.ContainerService/$aks_feature') && @.properties.state == 'Registered'].{Name:name}" --output tsv) + if [[ -z $extension ]]; then + echo "[$aks_feature] extension is not registered." + echo "Registering [$aks_feature] extension..." + az feature register \ + --name "$aks_feature" \ + --namespace Microsoft.ContainerService \ + --only-show-errors 1>/dev/null + registering_extensions+=("$aks_feature") + ok=1 + else + echo "[$aks_feature] extension is already registered." + fi + done + if [[ ${#registering_extensions[@]} -gt 0 ]]; then + echo "${registering_extensions[@]}" + fi + delay=1 + for aks_feature in "${registering_extensions[@]}"; do + echo -n "Checking if [$aks_feature] extension is already registered..." + while true; do + extension=$(az feature list -o table --query "[?contains(name, 'Microsoft.ContainerService/$aks_feature') && @.properties.state == 'Registered'].{Name:name}" --output tsv) + if [[ -z $extension ]]; then + echo -n "." + sleep $delay + else + echo "." + break + fi + done + done + + if [[ $ok == 1 ]]; then + echo "Refreshing the registration of the Microsoft.ContainerService resource provider..." + az provider register --namespace Microsoft.ContainerService --only-show-errors 1>/dev/null + echo "Microsoft.ContainerService resource provider registration successfully refreshed" + fi fi # Check if the resource group already exists @@ -155,303 +182,303 @@ echo "Checking if [$resource_group_name] resource group actually exists in the [ az group show --name $resource_group_name --only-show-errors &>/dev/null if [[ $? != 0 ]]; then - echo "No [$resource_group_name] resource group actually exists in the [$subscription_name] subscription" - echo "Creating [$resource_group_name] resource group in the [$subscription_name] subscription..." - - # create the resource group - az group create \ - --name $resource_group_name \ - --location $location \ - --only-show-errors 1>/dev/null - - if [[ $? == 0 ]]; then - echo "[$resource_group_name] resource group successfully created in the [$subscription_name] subscription" - else - echo "Failed to create [$resource_group_name] resource group in the [$subscription_name] subscription" - exit - fi + echo "No [$resource_group_name] resource group actually exists in the [$subscription_name] subscription" + echo "Creating [$resource_group_name] resource group in the [$subscription_name] subscription..." + + # create the resource group + az group create \ + --name $resource_group_name \ + --location $location \ + --only-show-errors 1>/dev/null + + if [[ $? == 0 ]]; then + echo "[$resource_group_name] resource group successfully created in the [$subscription_name] subscription" + else + echo "Failed to create [$resource_group_name] resource group in the [$subscription_name] subscription" + exit + fi else - echo "[$resource_group_name] resource group already exists in the [$subscription_name] subscription" + echo "[$resource_group_name] resource group already exists in the [$subscription_name] subscription" fi # Check if log analytics workspace exists and retrieve its resource id echo "Retrieving [$log_analytics_name] Log Analytics resource id..." az monitor log-analytics workspace show \ - --name $log_analytics_name \ - --resource-group $resource_group_name \ - --query id \ - --output tsv \ - --only-show-errors &>/dev/null + --name $log_analytics_name \ + --resource-group $resource_group_name \ + --query id \ + --output tsv \ + --only-show-errors &>/dev/null if [[ $? != 0 ]]; then - echo "No [$log_analytics_name] log analytics workspace actually exists in the [$resource_group_name] resource group" - echo "Creating [$log_analytics_name] log analytics workspace in the [$resource_group_name] resource group..." - - # Create the log analytics workspace - az monitor log-analytics workspace create \ - --name $log_analytics_name \ - --resource-group $resource_group_name \ - --identity-type SystemAssigned \ - --sku $log_analytics_sku \ - --location $location \ - --only-show-errors 1>/dev/null - - if [[ $? == 0 ]]; then - echo "[$log_analytics_name] log analytics workspace successfully created in the [$resource_group_name] resource group" - else - echo "Failed to create [$log_analytics_name] log analytics workspace in the [$resource_group_name] resource group" - exit - fi + echo "No [$log_analytics_name] log analytics workspace actually exists in the [$resource_group_name] resource group" + echo "Creating [$log_analytics_name] log analytics workspace in the [$resource_group_name] resource group..." + + # Create the log analytics workspace + az monitor log-analytics workspace create \ + --name $log_analytics_name \ + --resource-group $resource_group_name \ + --identity-type SystemAssigned \ + --sku $log_analytics_sku \ + --location $location \ + --only-show-errors 1>/dev/null + + if [[ $? == 0 ]]; then + echo "[$log_analytics_name] log analytics workspace successfully created in the [$resource_group_name] resource group" + else + echo "Failed to create [$log_analytics_name] log analytics workspace in the [$resource_group_name] resource group" + exit + fi else - echo "Successfully retrieved the resource id for the [$log_analytics_name] log analytics workspace" + echo "Successfully retrieved the resource id for the [$log_analytics_name] log analytics workspace" fi # Retrieve the log analytics workspace id workspace_resource_id=$(az monitor log-analytics workspace show \ - --name $log_analytics_name \ - --resource-group $resource_group_name \ - --query id \ - --output tsv \ - --only-show-errors 2>/dev/null) + --name $log_analytics_name \ + --resource-group $resource_group_name \ + --query id \ + --output tsv \ + --only-show-errors 2>/dev/null) if [[ -n $workspace_resource_id ]]; then - echo "Successfully retrieved the id for the [$log_analytics_name] log analytics workspace" + echo "Successfully retrieved the id for the [$log_analytics_name] log analytics workspace" else - echo "Failed to retrieve the id for the [$log_analytics_name] log analytics workspace" - exit + echo "Failed to retrieve the id for the [$log_analytics_name] log analytics workspace" + exit fi # Check if the client virtual network already exists echo "Checking if [$virtual_network_name] virtual network actually exists in the [$resource_group_name] resource group..." az network vnet show \ - --name $virtual_network_name \ - --resource-group $resource_group_name \ - --only-show-errors &>/dev/null + --name $virtual_network_name \ + --resource-group $resource_group_name \ + --only-show-errors &>/dev/null if [[ $? != 0 ]]; then - echo "No [$virtual_network_name] virtual network actually exists in the [$resource_group_name] resource group" - echo "Creating [$virtual_network_name] virtual network in the [$resource_group_name] resource group..." - - # Create the client virtual network - az network vnet create \ - --name $virtual_network_name \ - --resource-group $resource_group_name \ - --location $location \ - --address-prefixes $virtual_network_address_prefix \ - --subnet-name $system_subnet_name \ - --subnet-prefix $system_subnet_prefix \ - --only-show-errors 1>/dev/null - - if [[ $? == 0 ]]; then - echo "[$virtual_network_name] virtual network successfully created in the [$resource_group_name] resource group" - else - echo "Failed to create [$virtual_network_name] virtual network in the [$resource_group_name] resource group" - exit - fi + echo "No [$virtual_network_name] virtual network actually exists in the [$resource_group_name] resource group" + echo "Creating [$virtual_network_name] virtual network in the [$resource_group_name] resource group..." + + # Create the client virtual network + az network vnet create \ + --name $virtual_network_name \ + --resource-group $resource_group_name \ + --location $location \ + --address-prefixes $virtual_network_address_prefix \ + --subnet-name $system_subnet_name \ + --subnet-prefix $system_subnet_prefix \ + --only-show-errors 1>/dev/null + + if [[ $? == 0 ]]; then + echo "[$virtual_network_name] virtual network successfully created in the [$resource_group_name] resource group" + else + echo "Failed to create [$virtual_network_name] virtual network in the [$resource_group_name] resource group" + exit + fi else - echo "[$virtual_network_name] virtual network already exists in the [$resource_group_name] resource group" + echo "[$virtual_network_name] virtual network already exists in the [$resource_group_name] resource group" fi # Check if the user subnet already exists echo "Checking if [$user_subnet_name] user subnet actually exists in the [$virtual_network_name] virtual network..." az network vnet subnet show \ - --name $user_subnet_name \ - --vnet-name $virtual_network_name \ - --resource-group $resource_group_name \ - --only-show-errors &>/dev/null + --name $user_subnet_name \ + --vnet-name $virtual_network_name \ + --resource-group $resource_group_name \ + --only-show-errors &>/dev/null if [[ $? != 0 ]]; then - echo "No [$user_subnet_name] user subnet actually exists in the [$virtual_network_name] virtual network" - echo "Creating [$user_subnet_name] user subnet in the [$virtual_network_name] virtual network..." - - # Create the user subnet - az network vnet subnet create \ - --name $user_subnet_name \ - --vnet-name $virtual_network_name \ - --resource-group $resource_group_name \ - --address-prefix $user_subnet_prefix \ - --only-show-errors 1>/dev/null - - if [[ $? == 0 ]]; then - echo "[$user_subnet_name] user subnet successfully created in the [$virtual_network_name] virtual network" - else - echo "Failed to create [$user_subnet_name] user subnet in the [$virtual_network_name] virtual network" - exit - fi + echo "No [$user_subnet_name] user subnet actually exists in the [$virtual_network_name] virtual network" + echo "Creating [$user_subnet_name] user subnet in the [$virtual_network_name] virtual network..." + + # Create the user subnet + az network vnet subnet create \ + --name $user_subnet_name \ + --vnet-name $virtual_network_name \ + --resource-group $resource_group_name \ + --address-prefix $user_subnet_prefix \ + --only-show-errors 1>/dev/null + + if [[ $? == 0 ]]; then + echo "[$user_subnet_name] user subnet successfully created in the [$virtual_network_name] virtual network" + else + echo "Failed to create [$user_subnet_name] user subnet in the [$virtual_network_name] virtual network" + exit + fi else - echo "[$user_subnet_name] user subnet already exists in the [$virtual_network_name] virtual network" + echo "[$user_subnet_name] user subnet already exists in the [$virtual_network_name] virtual network" fi # Check if the bastion subnet already exists echo "Checking if [$bastion_subnet_name] bastion subnet actually exists in the [$virtual_network_name] virtual network..." az network vnet subnet show \ - --name $bastion_subnet_name \ - --vnet-name $virtual_network_name \ - --resource-group $resource_group_name \ - --only-show-errors &>/dev/null + --name $bastion_subnet_name \ + --vnet-name $virtual_network_name \ + --resource-group $resource_group_name \ + --only-show-errors &>/dev/null if [[ $? != 0 ]]; then - echo "No [$bastion_subnet_name] bastion subnet actually exists in the [$virtual_network_name] virtual network" - echo "Creating [$bastion_subnet_name] bastion subnet in the [$virtual_network_name] virtual network..." - - # Create the bastion subnet - az network vnet subnet create \ - --name $bastion_subnet_name \ - --vnet-name $virtual_network_name \ - --resource-group $resource_group_name \ - --address-prefix $bastion_subnet_prefix \ - --only-show-errors 1>/dev/null - - if [[ $? == 0 ]]; then - echo "[$bastion_subnet_name] bastion subnet successfully created in the [$virtual_network_name] virtual network" - else - echo "Failed to create [$bastion_subnet_name] bastion subnet in the [$virtual_network_name] virtual network" - exit - fi + echo "No [$bastion_subnet_name] bastion subnet actually exists in the [$virtual_network_name] virtual network" + echo "Creating [$bastion_subnet_name] bastion subnet in the [$virtual_network_name] virtual network..." + + # Create the bastion subnet + az network vnet subnet create \ + --name $bastion_subnet_name \ + --vnet-name $virtual_network_name \ + --resource-group $resource_group_name \ + --address-prefix $bastion_subnet_prefix \ + --only-show-errors 1>/dev/null + + if [[ $? == 0 ]]; then + echo "[$bastion_subnet_name] bastion subnet successfully created in the [$virtual_network_name] virtual network" + else + echo "Failed to create [$bastion_subnet_name] bastion subnet in the [$virtual_network_name] virtual network" + exit + fi else - echo "[$bastion_subnet_name] bastion subnet already exists in the [$virtual_network_name] virtual network" + echo "[$bastion_subnet_name] bastion subnet already exists in the [$virtual_network_name] virtual network" fi # Retrieve the virtual network resource ID virtual_network_id=$(az network vnet show \ - --name $virtual_network_name \ - --resource-group $resource_group_name \ - --query id \ - --output tsv \ - --only-show-errors 2>/dev/null) + --name $virtual_network_name \ + --resource-group $resource_group_name \ + --query id \ + --output tsv \ + --only-show-errors 2>/dev/null) if [[ -n $virtual_network_id ]]; then - echo "Successfully retrieved the resource ID for the [$virtual_network_name] virtual network" + echo "Successfully retrieved the resource ID for the [$virtual_network_name] virtual network" else - echo "Failed to retrieve the resource ID for the [$virtual_network_name] virtual network" - exit + echo "Failed to retrieve the resource ID for the [$virtual_network_name] virtual network" + exit fi # Retrieve the system subnet id system_subnet_id=$(az network vnet subnet show \ - --name $system_subnet_name \ - --vnet-name $virtual_network_name \ - --resource-group $resource_group_name \ - --query id \ - --output tsv \ - --only-show-errors 2>/dev/null) + --name $system_subnet_name \ + --vnet-name $virtual_network_name \ + --resource-group $resource_group_name \ + --query id \ + --output tsv \ + --only-show-errors 2>/dev/null) if [[ -n $system_subnet_id ]]; then - echo "Successfully retrieved the id for the [$system_subnet_name] subnet" + echo "Successfully retrieved the id for the [$system_subnet_name] subnet" else - echo "Failed to retrieve the id for the [$system_subnet_name] subnet" - exit + echo "Failed to retrieve the id for the [$system_subnet_name] subnet" + exit fi # Retrieve the user subnet id user_subnet_id=$(az network vnet subnet show \ - --name $user_subnet_name \ - --vnet-name $virtual_network_name \ - --resource-group $resource_group_name \ - --query id \ - --output tsv \ - --only-show-errors 2>/dev/null) + --name $user_subnet_name \ + --vnet-name $virtual_network_name \ + --resource-group $resource_group_name \ + --query id \ + --output tsv \ + --only-show-errors 2>/dev/null) if [[ -n $user_subnet_id ]]; then - echo "Successfully retrieved the id for the [$user_subnet_name] subnet" + echo "Successfully retrieved the id for the [$user_subnet_name] subnet" else - echo "Failed to retrieve the id for the [$user_subnet_name] subnet" - exit + echo "Failed to retrieve the id for the [$user_subnet_name] subnet" + exit fi # Check if the user-defined managed identity of the AKS cluster already exists echo "Checking if [$aks_managed_identity_name] user-defined managed identity actually exists in the [$resource_group_name] resource group..." aksManagedIdentityId=$(az identity show \ - --name "$aks_managed_identity_name" \ - --resource-group "$resource_group_name" \ - --query id \ - --output tsv 2>/dev/null) + --name "$aks_managed_identity_name" \ + --resource-group "$resource_group_name" \ + --query id \ + --output tsv 2>/dev/null) if [[ -z $aksManagedIdentityId ]]; then - echo "No [$aks_managed_identity_name] user-defined managed identity actually exists in the [$resource_group_name] resource group" - aksManagedIdentityId=$(az identity create \ - --name "$aks_managed_identity_name" \ - --resource-group "$resource_group_name" \ - --query id \ - --output tsv) - - if [[ -n $aksManagedIdentityId ]]; then - echo "[$aks_managed_identity_name] user-defined managed identity successfully created" - else - echo "Failed to create [$aks_managed_identity_name] user-defined managed identity in the [$resource_group_name] resource group" - exit - fi + echo "No [$aks_managed_identity_name] user-defined managed identity actually exists in the [$resource_group_name] resource group" + aksManagedIdentityId=$(az identity create \ + --name "$aks_managed_identity_name" \ + --resource-group "$resource_group_name" \ + --query id \ + --output tsv) + + if [[ -n $aksManagedIdentityId ]]; then + echo "[$aks_managed_identity_name] user-defined managed identity successfully created" + else + echo "Failed to create [$aks_managed_identity_name] user-defined managed identity in the [$resource_group_name] resource group" + exit + fi else - echo "[$aks_managed_identity_name] user-defined managed identity already exists in the [$resource_group_name] resource group" + echo "[$aks_managed_identity_name] user-defined managed identity already exists in the [$resource_group_name] resource group" fi # Retrieve the cluster identity resource ID echo "Retrieving the id for the [$aks_managed_identity_name] managed identity..." managed_identity_id=$(az identity show \ - --name "$aks_managed_identity_name" \ - --resource-group "$resource_group_name" \ - --query id \ - --output tsv \ - --only-show-errors 2>/dev/null) + --name "$aks_managed_identity_name" \ + --resource-group "$resource_group_name" \ + --query id \ + --output tsv \ + --only-show-errors 2>/dev/null) if [[ -n $managed_identity_id ]]; then - echo "Successfully retrieved the id for the [$aks_managed_identity_name] managed identity" + echo "Successfully retrieved the id for the [$aks_managed_identity_name] managed identity" else - echo "Failed to retrieve the id for the [$aks_managed_identity_name] managed identity" - exit + echo "Failed to retrieve the id for the [$aks_managed_identity_name] managed identity" + exit fi # Retrieve the cluster identity principal ID echo "Retrieving the principalId for the [$aks_managed_identity_name] managed identity..." managed_identity_principal_id=$(az identity show \ - --name "$aks_managed_identity_name" \ - --resource-group "$resource_group_name" \ - --query principalId \ - --output tsv \ - --only-show-errors 2>/dev/null) + --name "$aks_managed_identity_name" \ + --resource-group "$resource_group_name" \ + --query principalId \ + --output tsv \ + --only-show-errors 2>/dev/null) if [[ -n $managed_identity_principal_id ]]; then - echo "Successfully retrieved the principalId for the [$aks_managed_identity_name] managed identity" + echo "Successfully retrieved the principalId for the [$aks_managed_identity_name] managed identity" else - echo "Failed to retrieve the principalId for the [$aks_managed_identity_name] managed identity" - exit + echo "Failed to retrieve the principalId for the [$aks_managed_identity_name] managed identity" + exit fi # Check if the Azure Container Registry already exists echo "Checking if [$acr_name] container registry actually exists in the [$resource_group_name] resource group..." az acr show \ - --name $acr_name \ - --resource-group $resource_group_name \ - --only-show-errors &>/dev/null + --name $acr_name \ + --resource-group $resource_group_name \ + --only-show-errors &>/dev/null if [[ $? != 0 ]]; then - echo "No [$acr_name] container registry actually exists in the [$resource_group_name] resource group" - echo "Creating [$acr_name] container registry in the [$resource_group_name] resource group..." - - az acr create \ - --name $acr_name \ - --resource-group $resource_group_name \ - --location $location \ - --sku $acr_sku \ - --admin-enabled true \ - --only-show-errors 1>/dev/null - - if [[ $? == 0 ]]; then - echo "[$acr_name] container registry successfully created in the [$resource_group_name] resource group" - else - echo "Failed to create [$acr_name] container registry in the [$resource_group_name] resource group" - exit - fi + echo "No [$acr_name] container registry actually exists in the [$resource_group_name] resource group" + echo "Creating [$acr_name] container registry in the [$resource_group_name] resource group..." + + az acr create \ + --name $acr_name \ + --resource-group $resource_group_name \ + --location $location \ + --sku $acr_sku \ + --admin-enabled true \ + --only-show-errors 1>/dev/null + + if [[ $? == 0 ]]; then + echo "[$acr_name] container registry successfully created in the [$resource_group_name] resource group" + else + echo "Failed to create [$acr_name] container registry in the [$resource_group_name] resource group" + exit + fi else - echo "[$acr_name] container registry already exists in the [$resource_group_name] resource group" + echo "[$acr_name] container registry already exists in the [$resource_group_name] resource group" fi # Get the last Kubernetes version available in the region kubernetes_version=$(az aks get-versions \ - --location $location \ - --query "values[?isPreview==null].version | sort(@) | [-1]" \ - --output tsv \ - --only-show-errors 2>/dev/null) + --location $location \ + --query "values[?isPreview==null].version | sort(@) | [-1]" \ + --output tsv \ + --only-show-errors 2>/dev/null) # Create AKS cluster echo "Checking if [$aks_cluster_name] aks cluster actually exists in the [$resource_group_name] resource group..." @@ -459,88 +486,89 @@ echo "Checking if [$aks_cluster_name] aks cluster actually exists in the [$resou az aks show --name $aks_cluster_name --resource-group $resource_group_name &>/dev/null if [[ $? != 0 ]]; then - echo "No [$aks_cluster_name] aks cluster actually exists in the [$resource_group_name] resource group" - echo "Creating [$aks_cluster_name] aks cluster in the [$resource_group_name] resource group..." - - # Create the aks cluster - az aks create \ - --name $aks_cluster_name \ - --resource-group $resource_group_name \ - --os-sku $os_sku \ - --node-osdisk-size $os_disk_size \ - --node-osdisk-type $os_disk_type \ - --vnet-subnet-id $system_subnet_id \ - --nodepool-name $system_node_pool_name \ - --enable-cluster-autoscaler \ - --node-count $node_count \ - --min-count $min_count \ - --max-count $max_count \ - --max-pods $max_pods \ - --location $location \ - --kubernetes-version $kubernetes_version \ - --ssh-key-value $ssh_key_value \ - --windows-admin-username $windows_admin_username \ - --windows-admin-password $windows_admin_password \ - --node-vm-size $node_size \ - --enable-addons monitoring \ - --workspace-resource-id $workspace_resource_id \ - --network-dataplane $network_dataplane \ - --network-policy $network_policy \ - --network-plugin $network_plugin \ - --network-plugin-mode $network_plugin_mode \ - --pod-cidr $pod_cidr \ - --dns-service-ip $dns_service_ip \ - --service-cidr $service_cidr \ - --enable-gateway-api \ - --enable-managed-identity \ + echo "No [$aks_cluster_name] aks cluster actually exists in the [$resource_group_name] resource group" + echo "Creating [$aks_cluster_name] aks cluster in the [$resource_group_name] resource group..." + + # Create the aks cluster + az aks create \ + --name $aks_cluster_name \ + --resource-group $resource_group_name \ + --os-sku $os_sku \ + --node-osdisk-size $os_disk_size \ + --node-osdisk-type $os_disk_type \ + --vnet-subnet-id $system_subnet_id \ + --nodepool-name $system_node_pool_name \ + --enable-cluster-autoscaler \ + --node-count $node_count \ + --min-count $min_count \ + --max-count $max_count \ + --max-pods $max_pods \ + --location $location \ + --kubernetes-version $kubernetes_version \ + --ssh-key-value $ssh_key_value \ + --windows-admin-username $windows_admin_username \ + --windows-admin-password $windows_admin_password \ + --node-vm-size $node_size \ + --enable-addons monitoring \ + --workspace-resource-id $workspace_resource_id \ + --network-dataplane $network_dataplane \ + --network-policy $network_policy \ + --network-plugin $network_plugin \ + --network-plugin-mode $network_plugin_mode \ + --pod-cidr $pod_cidr \ + --dns-service-ip $dns_service_ip \ + --service-cidr $service_cidr \ + --enable-acns \ + --enable-gateway-api \ + --enable-managed-identity \ --assign-identity "$managed_identity_id" \ - --enable-workload-identity \ - --enable-oidc-issuer \ - --enable-aad \ - --enable-azure-rbac \ - --aad-admin-group-object-ids $aad_profile_admin_group_object_ids \ - --attach-acr $acr_name \ - --only-show-errors 1>/dev/null - - if [[ $? == 0 ]]; then - echo "[$aks_cluster_name] aks cluster successfully created in the [$resource_group_name] resource group" - else - echo "Failed to create [$aks_cluster_name] aks cluster in the [$resource_group_name] resource group" - exit - fi + --enable-workload-identity \ + --enable-oidc-issuer \ + --enable-aad \ + --enable-azure-rbac \ + --aad-admin-group-object-ids $aad_profile_admin_group_object_ids \ + --attach-acr $acr_name \ + --only-show-errors 1>/dev/null + + if [[ $? == 0 ]]; then + echo "[$aks_cluster_name] aks cluster successfully created in the [$resource_group_name] resource group" + else + echo "Failed to create [$aks_cluster_name] aks cluster in the [$resource_group_name] resource group" + exit + fi else - echo "[$aks_cluster_name] aks cluster already exists in the [$resource_group_name] resource group" + echo "[$aks_cluster_name] aks cluster already exists in the [$resource_group_name] resource group" fi # Retrieve the node resource group name and ID echo "Retrieving the node resource group name for the [$aks_cluster_name] AKS cluster..." node_resource_group_name=$(az aks show \ - --name $aks_cluster_name \ - --resource-group $resource_group_name \ - --query nodeResourceGroup \ - --output tsv \ - --only-show-errors 2>/dev/null) + --name $aks_cluster_name \ + --resource-group $resource_group_name \ + --query nodeResourceGroup \ + --output tsv \ + --only-show-errors 2>/dev/null) if [[ -n $node_resource_group_name ]]; then - echo "Successfully retrieved the node resource group [$node_resource_group_name] for the [$aks_cluster_name] AKS cluster" + echo "Successfully retrieved the node resource group [$node_resource_group_name] for the [$aks_cluster_name] AKS cluster" else - echo "Failed to retrieve the node resource group for the [$aks_cluster_name] AKS cluster" - exit + echo "Failed to retrieve the node resource group for the [$aks_cluster_name] AKS cluster" + exit fi # Retrieve the node resource group ID echo "Retrieving the node resource group ID for the [$node_resource_group_name] resource group..." node_resource_group_id=$(az group show \ - --name "$node_resource_group_name" \ - --query id \ - --output tsv \ - --only-show-errors 2>/dev/null) + --name "$node_resource_group_name" \ + --query id \ + --output tsv \ + --only-show-errors 2>/dev/null) if [[ -n $node_resource_group_id ]]; then - echo "Successfully retrieved the resource ID for the [$node_resource_group_name] resource group" + echo "Successfully retrieved the resource ID for the [$node_resource_group_name] resource group" else - echo "Failed to retrieve the resource ID for the [$node_resource_group_name] resource group" - exit + echo "Failed to retrieve the resource ID for the [$node_resource_group_name] resource group" + exit fi # Assign the Contributor role to the managed identity on the node resource group @@ -552,41 +580,41 @@ scope_name="$node_resource_group_name" scope_type="node resource group" echo "Checking if the [$managed_identity_name] managed identity has the [$role] role assignment on the [$scope_name] $scope_type..." current=$(az role assignment list \ - --assignee "$principal_id" \ - --scope "$scope_id" \ - --query "[?roleDefinitionName=='$role'].roleDefinitionName" \ - --output tsv 2>/dev/null) + --assignee "$principal_id" \ + --scope "$scope_id" \ + --query "[?roleDefinitionName=='$role'].roleDefinitionName" \ + --output tsv 2>/dev/null) if [[ $current == "$role" ]]; then - echo "Managed identity [$managed_identity_name] already has the [$role] role assignment on the [$scope_name] $scope_type" + echo "Managed identity [$managed_identity_name] already has the [$role] role assignment on the [$scope_name] $scope_type" else - echo "Managed identity [$managed_identity_name] does not have the [$role] role assignment on the [$scope_name] $scope_type" - echo "Creating role assignment: assigning [$role] role to managed identity [$managed_identity_name] on the [$scope_name] $scope_type..." - ATTEMPT=1 - while [ $ATTEMPT -le $RETRY_COUNT ]; do - echo "Attempt $ATTEMPT of $RETRY_COUNT to assign role..." - az role assignment create \ - --assignee "$principal_id" \ - --role "$role" \ - --scope "$scope_id" 1>/dev/null - - if [[ $? == 0 ]]; then - break - else - if [ $ATTEMPT -lt $RETRY_COUNT ]; then - echo "Role assignment failed. Waiting [$SLEEP] seconds before retry..." - sleep $SLEEP - fi - ATTEMPT=$((ATTEMPT + 1)) - fi - done - - if [[ $? == 0 ]]; then - echo "Successfully assigned [$role] role to managed identity [$managed_identity_name] on the [$scope_name] $scope_type" - else - echo "Failed to assign [$role] role to managed identity [$managed_identity_name] on the [$scope_name] $scope_type" - exit 1 - fi + echo "Managed identity [$managed_identity_name] does not have the [$role] role assignment on the [$scope_name] $scope_type" + echo "Creating role assignment: assigning [$role] role to managed identity [$managed_identity_name] on the [$scope_name] $scope_type..." + ATTEMPT=1 + while [ $ATTEMPT -le $RETRY_COUNT ]; do + echo "Attempt $ATTEMPT of $RETRY_COUNT to assign role..." + az role assignment create \ + --assignee "$principal_id" \ + --role "$role" \ + --scope "$scope_id" 1>/dev/null + + if [[ $? == 0 ]]; then + break + else + if [ $ATTEMPT -lt $RETRY_COUNT ]; then + echo "Role assignment failed. Waiting [$SLEEP] seconds before retry..." + sleep $SLEEP + fi + ATTEMPT=$((ATTEMPT + 1)) + fi + done + + if [[ $? == 0 ]]; then + echo "Successfully assigned [$role] role to managed identity [$managed_identity_name] on the [$scope_name] $scope_type" + else + echo "Failed to assign [$role] role to managed identity [$managed_identity_name] on the [$scope_name] $scope_type" + exit 1 + fi fi # Assign the Network Contributor role to the managed identity on the virtual network @@ -598,95 +626,95 @@ scope_name="$virtual_network_name" scope_type="virtual network" echo "Checking if the [$managed_identity_name] managed identity has the [$role] role assignment on the [$scope_name] $scope_type..." current=$(az role assignment list \ - --assignee "$principal_id" \ - --scope "$scope_id" \ - --query "[?roleDefinitionName=='$role'].roleDefinitionName" \ - --output tsv 2>/dev/null) + --assignee "$principal_id" \ + --scope "$scope_id" \ + --query "[?roleDefinitionName=='$role'].roleDefinitionName" \ + --output tsv 2>/dev/null) if [[ $current == "$role" ]]; then - echo "Managed identity [$managed_identity_name] already has the [$role] role assignment on the [$scope_name] $scope_type" + echo "Managed identity [$managed_identity_name] already has the [$role] role assignment on the [$scope_name] $scope_type" else - echo "Managed identity [$managed_identity_name] does not have the [$role] role assignment on the [$scope_name] $scope_type" - echo "Creating role assignment: assigning [$role] role to managed identity [$managed_identity_name] on the [$scope_name] $scope_type..." - ATTEMPT=1 - while [ $ATTEMPT -le $RETRY_COUNT ]; do - echo "Attempt $ATTEMPT of $RETRY_COUNT to assign role..." - az role assignment create \ - --assignee "$principal_id" \ - --role "$role" \ - --scope "$scope_id" 1>/dev/null - - if [[ $? == 0 ]]; then - break - else - if [ $ATTEMPT -lt $RETRY_COUNT ]; then - echo "Role assignment failed. Waiting [$SLEEP] seconds before retry..." - sleep $SLEEP - fi - ATTEMPT=$((ATTEMPT + 1)) - fi - done - - if [[ $? == 0 ]]; then - echo "Successfully assigned [$role] role to managed identity [$managed_identity_name] on the [$scope_name] $scope_type" - else - echo "Failed to assign [$role] role to managed identity [$managed_identity_name] on the [$scope_name] $scope_type" - exit 1 - fi + echo "Managed identity [$managed_identity_name] does not have the [$role] role assignment on the [$scope_name] $scope_type" + echo "Creating role assignment: assigning [$role] role to managed identity [$managed_identity_name] on the [$scope_name] $scope_type..." + ATTEMPT=1 + while [ $ATTEMPT -le $RETRY_COUNT ]; do + echo "Attempt $ATTEMPT of $RETRY_COUNT to assign role..." + az role assignment create \ + --assignee "$principal_id" \ + --role "$role" \ + --scope "$scope_id" 1>/dev/null + + if [[ $? == 0 ]]; then + break + else + if [ $ATTEMPT -lt $RETRY_COUNT ]; then + echo "Role assignment failed. Waiting [$SLEEP] seconds before retry..." + sleep $SLEEP + fi + ATTEMPT=$((ATTEMPT + 1)) + fi + done + + if [[ $? == 0 ]]; then + echo "Successfully assigned [$role] role to managed identity [$managed_identity_name] on the [$scope_name] $scope_type" + else + echo "Failed to assign [$role] role to managed identity [$managed_identity_name] on the [$scope_name] $scope_type" + exit 1 + fi fi # Check if the user node pool exists echo "Checking if [$aks_cluster_name] aks cluster actually has a user node pool..." az aks nodepool show \ - --name $user_node_pool_name \ - --cluster-name $aks_cluster_name \ - --resource-group $resource_group_name &>/dev/null + --name $user_node_pool_name \ + --cluster-name $aks_cluster_name \ + --resource-group $resource_group_name &>/dev/null if [[ $? == 0 ]]; then - echo "A node pool called [$user_node_pool_name] already exists in the [$aks_cluster_name] AKS cluster" + echo "A node pool called [$user_node_pool_name] already exists in the [$aks_cluster_name] AKS cluster" else - echo "No node pool called [$user_node_pool_name] actually exists in the [$aks_cluster_name] AKS cluster" - echo "Creating [$user_node_pool_name] node pool in the [$aks_cluster_name] AKS cluster..." - - az aks nodepool add \ - --name $user_node_pool_name \ - --mode $mode \ - --cluster-name $aks_cluster_name \ - --resource-group $resource_group_name \ - --enable-cluster-autoscaler \ - --os-type $os_type \ - --os-sku $os_sku \ - --node-vm-size $vm_size \ - --node-osdisk-size $os_disk_size \ - --node-osdisk-type $os_disk_type \ - --node-count $node_pool_node_count \ - --min-count $node_pool_min_count \ - --max-count $node_pool_max_count \ - --max-pods $node_pool_max_pods \ - --tags os_disk_type=$os_disk_type os_type=Linux \ - --labels os_disk_type=$os_disk_type os_type=Linux \ - --vnet-subnet-id $user_subnet_id \ - --zones 1 2 3 \ + echo "No node pool called [$user_node_pool_name] actually exists in the [$aks_cluster_name] AKS cluster" + echo "Creating [$user_node_pool_name] node pool in the [$aks_cluster_name] AKS cluster..." + + az aks nodepool add \ + --name $user_node_pool_name \ + --mode $mode \ + --cluster-name $aks_cluster_name \ + --resource-group $resource_group_name \ + --enable-cluster-autoscaler \ + --os-type $os_type \ + --os-sku $os_sku \ + --node-vm-size $vm_size \ + --node-osdisk-size $os_disk_size \ + --node-osdisk-type $os_disk_type \ + --node-count $node_pool_node_count \ + --min-count $node_pool_min_count \ + --max-count $node_pool_max_count \ + --max-pods $node_pool_max_pods \ + --tags os_disk_type=$os_disk_type os_type=Linux \ + --labels os_disk_type=$os_disk_type os_type=Linux \ + --vnet-subnet-id $user_subnet_id \ + --zones 1 2 3 \ --only-show-errors 1>/dev/null - if [[ $? == 0 ]]; then - echo "[$user_node_pool_name] node pool successfully created in the [$aks_cluster_name] AKS cluster" - else - echo "Failed to create the [$user_node_pool_name] node pool in the [$aks_cluster_name] AKS cluster" - fi + if [[ $? == 0 ]]; then + echo "[$user_node_pool_name] node pool successfully created in the [$aks_cluster_name] AKS cluster" + else + echo "Failed to create the [$user_node_pool_name] node pool in the [$aks_cluster_name] AKS cluster" + fi fi # Use the following command to configure kubectl to connect to the new Kubernetes cluster echo "Getting access credentials configure kubectl to connect to the [$aks_cluster_name] AKS cluster..." az aks get-credentials \ - --name $aks_cluster_name \ - --resource-group $resource_group_name \ - --overwrite-existing \ + --name $aks_cluster_name \ + --resource-group $resource_group_name \ + --overwrite-existing \ --only-show-errors if [[ $? == 0 ]]; then - echo "Credentials for the [$aks_cluster_name] cluster successfully retrieved" + echo "Credentials for the [$aks_cluster_name] cluster successfully retrieved" else - echo "Failed to retrieve the credentials for the [$aks_cluster_name] cluster" - exit + echo "Failed to retrieve the credentials for the [$aks_cluster_name] cluster" + exit fi