|
| 1 | +#!/usr/bin/env bash |
| 2 | +set -euo pipefail |
| 3 | + |
| 4 | +SUBSCRIPTION_ID="XXX" |
| 5 | +RG_NAME="XXX" |
| 6 | +LOCATION="westeurope" |
| 7 | +KV_NAME="sysext-bakery" |
| 8 | +CERT_NAME="sysext-bakery-signing" |
| 9 | +IDENTITY_NAME="sysext-bakery-github-actions" |
| 10 | +FED_CRED_NAME="gh-main" |
| 11 | +GITHUB_REPO="flatcar/sysext-bakery" # owner/repo |
| 12 | +GITHUB_BRANCH="main" |
| 13 | + |
| 14 | +echo "Setting subscription..." |
| 15 | +az account set --subscription "$SUBSCRIPTION_ID" |
| 16 | +TENANT_ID="$(az account show --query tenantId -o tsv)" |
| 17 | + |
| 18 | +echo "Creating resource group $RG_NAME in $LOCATION..." |
| 19 | +az group create -n "$RG_NAME" -l "$LOCATION" -o none |
| 20 | + |
| 21 | +# ============ |
| 22 | +# KEY VAULT |
| 23 | +# ============ |
| 24 | +echo "Creating Key Vault $KV_NAME..." |
| 25 | +# Enable RBAC authorization and purge protection (soft-delete is on by default) |
| 26 | +# |
| 27 | +az keyvault show -n "$KV_NAME" -g "$RG_NAME" -o none 2>/dev/null || \ |
| 28 | + az keyvault create \ |
| 29 | + --name "$KV_NAME" \ |
| 30 | + --resource-group "$RG_NAME" \ |
| 31 | + --location "$LOCATION" \ |
| 32 | + --sku standard \ |
| 33 | + --enable-purge-protection true \ |
| 34 | + --enable-rbac-authorization true \ |
| 35 | + -o none |
| 36 | +KV_ID="$(az keyvault show -n "$KV_NAME" -g "$RG_NAME" --query id -o tsv)" |
| 37 | + |
| 38 | +# 2) Get your Azure AD object id (the caller shown in the error) |
| 39 | +# This works when you're logged in as a user (not a service principal) |
| 40 | +USER_OID=$(az ad signed-in-user show --query id -o tsv) |
| 41 | +USER_NAME=$(az ad signed-in-user show --query userPrincipalName -o tsv) |
| 42 | +RG_ID=$(az group show -n "$RG_NAME" --query id -o tsv) |
| 43 | + |
| 44 | +# 3) Grant yourself a data-plane role that includes certificate create |
| 45 | +# Pick ONE of the two; Administrator is broader than Certificates Officer. |
| 46 | +for role in "Key Vault Administrator" "Owner"; do |
| 47 | + echo "Granting $role role in RG $RG_NAME to $USER_NAME" |
| 48 | + az role assignment create \ |
| 49 | + --assignee-object-id "$USER_OID" \ |
| 50 | + --assignee-principal-type User \ |
| 51 | + --role "$role" \ |
| 52 | + --scope "$RG_ID" \ |
| 53 | + -o none |
| 54 | +done |
| 55 | + |
| 56 | +echo "Waiting 30 seconds for the permissions to apply. If the script fails, please wait and run it again." |
| 57 | +sleep 30 |
| 58 | + |
| 59 | +# ============ |
| 60 | +# CERTIFICATE |
| 61 | +# ============ |
| 62 | +echo "Creating self-signed certificate $CERT_NAME in $KV_NAME (default policy)..." |
| 63 | +DEFAULT_POLICY="$(az keyvault certificate get-default-policy)" |
| 64 | +az keyvault certificate show --vault-name "$KV_NAME" -n "$CERT_NAME" -o none 2>/dev/null || \ |
| 65 | + az keyvault certificate create \ |
| 66 | + --vault-name "$KV_NAME" \ |
| 67 | + --name "$CERT_NAME" \ |
| 68 | + --policy "$DEFAULT_POLICY" \ |
| 69 | + -o none |
| 70 | + |
| 71 | +# =============================== |
| 72 | +# USER-ASSIGNED MANAGED IDENTITY |
| 73 | +# =============================== |
| 74 | +echo "Creating user-assigned managed identity $IDENTITY_NAME..." |
| 75 | +az identity show --name "$IDENTITY_NAME" --resource-group "$RG_NAME" -o none 2>/dev/null || \ |
| 76 | + az identity create \ |
| 77 | + --name "$IDENTITY_NAME" \ |
| 78 | + --resource-group "$RG_NAME" \ |
| 79 | + --location "$LOCATION" \ |
| 80 | + -o none |
| 81 | + |
| 82 | +IDENTITY_JSON="$(az identity show -n "$IDENTITY_NAME" -g "$RG_NAME")" |
| 83 | +IDENTITY_CLIENT_ID="$(echo "$IDENTITY_JSON" | jq -r .clientId)" |
| 84 | +IDENTITY_PRINCIPAL_ID="$(echo "$IDENTITY_JSON" | jq -r .principalId)" |
| 85 | +# IDENTITY_ID="$(echo "$IDENTITY_JSON" | jq -r .id)" |
| 86 | + |
| 87 | +echo "Identity clientId: $IDENTITY_CLIENT_ID" |
| 88 | +echo "Identity principalId: $IDENTITY_PRINCIPAL_ID" |
| 89 | + |
| 90 | +# ===================================== |
| 91 | +# FEDERATED CREDENTIAL FOR GITHUB OIDC |
| 92 | +# ===================================== |
| 93 | +echo "Creating federated credential $FED_CRED_NAME on identity $IDENTITY_NAME for repo $GITHUB_REPO branch ${GITHUB_BRANCH}..." |
| 94 | +ISSUER="https://token.actions.githubusercontent.com" |
| 95 | +AUDIENCE="api://AzureADTokenExchange" |
| 96 | +SUBJECT="repo:${GITHUB_REPO}:ref:refs/heads/${GITHUB_BRANCH}" |
| 97 | + |
| 98 | +az identity federated-credential show --name "$FED_CRED_NAME" --identity-name "$IDENTITY_NAME" --resource-group "$RG_NAME" -o none || \ |
| 99 | + az identity federated-credential create \ |
| 100 | + --name "$FED_CRED_NAME" \ |
| 101 | + --identity-name "$IDENTITY_NAME" \ |
| 102 | + --resource-group "$RG_NAME" \ |
| 103 | + --issuer "$ISSUER" \ |
| 104 | + --subject "$SUBJECT" \ |
| 105 | + --audiences "$AUDIENCE" \ |
| 106 | + -o none |
| 107 | + |
| 108 | +# ================================== |
| 109 | +# ROLE ASSIGNMENTS (Key Vault RBAC) |
| 110 | +# ================================== |
| 111 | + |
| 112 | +IDENTITY_NAME="sysext-bakery-github-actions" |
| 113 | +PRINCIPAL_ID=$(az identity show -n "$IDENTITY_NAME" -g "$RG_NAME" --query principalId -o tsv) |
| 114 | +for role in "Key Vault Crypto User" "Key Vault Secrets User" "Key Vault Reader"; do |
| 115 | + echo "Granting $role role in RG $RG_NAME to $IDENTITY_NAME" |
| 116 | + az role assignment create \ |
| 117 | + --assignee-object-id "$PRINCIPAL_ID" \ |
| 118 | + --assignee-principal-type ServicePrincipal \ |
| 119 | + --role "$role" \ |
| 120 | + --scope "$RG_ID" \ |
| 121 | + -o none |
| 122 | +done |
| 123 | + |
| 124 | +# az role assignment create \ |
| 125 | +# --assignee-object-id "$PRINCIPAL_ID" \ |
| 126 | +# --assignee-principal-type ServicePrincipal \ |
| 127 | +# --role "Reader" \ |
| 128 | +# --scope "$KV_ID" |
| 129 | + |
| 130 | +echo "All done." |
| 131 | +echo "---------------------------------------------" |
| 132 | +echo "Key Vault: $KV_NAME" |
| 133 | +echo "Certificate: $CERT_NAME" |
| 134 | +echo "Managed Identity: $IDENTITY_NAME" |
| 135 | +echo "Identity clientId: $IDENTITY_CLIENT_ID" |
| 136 | +echo "Tenant ID: $TENANT_ID" |
| 137 | +echo "Subscription ID: $SUBSCRIPTION_ID" |
| 138 | +echo "---------------------------------------------" |
| 139 | +echo "" |
| 140 | +echo "Please set these GitHub secrets on repo ${GITHUB_REPO}:" |
| 141 | +echo "" |
| 142 | +echo "---------------------------------------------" |
| 143 | +echo "AZURE_CLIENT_ID : $IDENTITY_CLIENT_ID" |
| 144 | +echo "AZURE_SUBSCRIPTION_ID : $SUBSCRIPTION_ID" |
| 145 | +echo "AZURE_TENANT_ID : $TENANT_ID" |
| 146 | +echo "KEYVAULT_CERT_NAME : $CERT_NAME" |
| 147 | +echo "KEYVAULT_NAME : $KV_NAME" |
| 148 | +echo "" |
| 149 | +echo "You can do it like this:" |
| 150 | +echo "" |
| 151 | +echo "echo '$IDENTITY_CLIENT_ID' | gh secret set --repo '$GITHUB_REPO' AZURE_CLIENT_ID" |
| 152 | +echo "echo '$SUBSCRIPTION_ID' | gh secret set --repo '$GITHUB_REPO' AZURE_SUBSCRIPTION_ID" |
| 153 | +echo "echo '$TENANT_ID' | gh secret set --repo '$GITHUB_REPO' AZURE_TENANT_ID" |
| 154 | +echo "echo '$CERT_NAME' | gh secret set --repo '$GITHUB_REPO' KEYVAULT_CERT_NAME" |
| 155 | +echo "echo '$KV_NAME' | gh secret set --repo '$GITHUB_REPO' KEYVAULT_NAME" |
| 156 | +echo "---------------------------------------------" |
0 commit comments