01-deploy-resources.sh

#!/bin/bash

# Variables
source ./00-variables.sh

# Change the current directory to the script's directory
cd "$CURRENT_DIR" || exit

# Ask how the Azure file share holding the activities should be provisioned.
# Both answers are persisted below, so 05-deploy-app.sh deploys the app for the same combination
# without asking again. Export PROVISIONING_MODE and FILE_SHARE_PROTOCOL beforehand to skip the
# menus altogether, for example in an unattended run:
#
#   PROVISIONING_MODE=dynamic FILE_SHARE_PROTOCOL=nfs ./01-deploy-resources.sh
if [[ -z "$PROVISIONING_MODE" ]]; then
	# Print the menu
	echo "===================================="
	echo "Provisioning Mode (1-3): "
	echo "===================================="
	options=(
		"Static: use a file share created by this script"
		"Dynamic: let the CSI driver create the file share"
		"Quit"
	)
	# Select an option
	COLUMNS=0
	select option in "${options[@]}"; do
		case $option in
		"Static: use a file share created by this script")
			PROVISIONING_MODE='static'
			break
			;;
		"Dynamic: let the CSI driver create the file share")
			PROVISIONING_MODE='dynamic'
			break
			;;
		"Quit")
			exit
			;;
		*) echo "invalid option $REPLY" ;;
		esac
	done
fi

PROVISIONING_MODE="${PROVISIONING_MODE,,}"

if [[ "$PROVISIONING_MODE" != 'static' && "$PROVISIONING_MODE" != 'dynamic' ]]; then
	echo "Invalid provisioning mode [$PROVISIONING_MODE]: expected [static] or [dynamic]"
	exit 1
fi

# Ask which protocol the Azure file share should use.
if [[ -z "$FILE_SHARE_PROTOCOL" ]]; then
	# Print the menu
	echo "===================================="
	echo "File Share Protocol (1-3): "
	echo "===================================="
	options=(
		"SMB: mounted with the storage account key"
		"NFS: mounted from a virtual network, no key"
		"Quit"
	)
	# Select an option
	COLUMNS=0
	select option in "${options[@]}"; do
		case $option in
		"SMB: mounted with the storage account key")
			FILE_SHARE_PROTOCOL='smb'
			break
			;;
		"NFS: mounted from a virtual network, no key")
			FILE_SHARE_PROTOCOL='nfs'
			break
			;;
		"Quit")
			exit
			;;
		*) echo "invalid option $REPLY" ;;
		esac
	done
fi

FILE_SHARE_PROTOCOL="${FILE_SHARE_PROTOCOL,,}"

if [[ "$FILE_SHARE_PROTOCOL" != 'smb' && "$FILE_SHARE_PROTOCOL" != 'nfs' ]]; then
	echo "Invalid file share protocol [$FILE_SHARE_PROTOCOL]: expected [smb] or [nfs]"
	exit 1
fi

# Persist both answers so 05-deploy-app.sh deploys the app for the same combination.
# Each value is written with ${VAR:-value} syntax, so an exported environment variable still takes
# precedence when 00-variables.sh sources this file.
cat <<EOF >"$DEPLOY_OPTIONS_FILE"
# Generated by 01-deploy-resources.sh - do not edit.
# An exported environment variable takes precedence over the value stored here.
PROVISIONING_MODE="\${PROVISIONING_MODE:-$PROVISIONING_MODE}"
FILE_SHARE_PROTOCOL="\${FILE_SHARE_PROTOCOL:-$FILE_SHARE_PROTOCOL}"
EOF

if [[ $? == 0 ]]; then
	echo "Deployment options saved to [$DEPLOY_OPTIONS_FILE]"
else
	echo "Failed to save the deployment options to [$DEPLOY_OPTIONS_FILE]"
	exit 1
fi

echo "Deploying the resources for [$PROVISIONING_MODE] provisioning over [${FILE_SHARE_PROTOCOL^^}]..."

# Create a resource group
echo "Checking if resource group [$RESOURCE_GROUP_NAME] exists in the subscription [$SUBSCRIPTION_NAME]..."
az group show --name $RESOURCE_GROUP_NAME &>/dev/null

if [[ $? != 0 ]]; then
	echo "No resource group [$RESOURCE_GROUP_NAME] exists in the subscription [$SUBSCRIPTION_NAME]"
	echo "Creating resource group [$RESOURCE_GROUP_NAME] in the subscription [$SUBSCRIPTION_NAME]..."

	az group create \
		--name $RESOURCE_GROUP_NAME \
		--location "$LOCATION" \
		--only-show-errors 1>/dev/null

	if [[ $? == 0 ]]; then
		echo "Resource group [$RESOURCE_GROUP_NAME] successfully created in the subscription [$SUBSCRIPTION_NAME]"
	else
		echo "Failed to create resource group [$RESOURCE_GROUP_NAME] in the subscription [$SUBSCRIPTION_NAME]"
		exit 1
	fi
else
	echo "Resource group [$RESOURCE_GROUP_NAME] already exists in the subscription [$SUBSCRIPTION_NAME]"
fi

# Create the Azure Container Registry
echo "Checking if [$ACR_NAME] Azure Container Registry already exists in the [$RESOURCE_GROUP_NAME] resource group..."
az acr show \
	--name "$ACR_NAME" \
	--resource-group "$RESOURCE_GROUP_NAME" \
	--only-show-errors &>/dev/null

if [[ $? != 0 ]]; then
	echo "No [$ACR_NAME] Azure Container Registry exists in the [$RESOURCE_GROUP_NAME] resource group"
	echo "Creating Azure Container Registry [$ACR_NAME]..."
	az acr create \
		--name "$ACR_NAME" \
		--resource-group "$RESOURCE_GROUP_NAME" \
		--location "$LOCATION" \
		--sku "$ACR_SKU" \
		--admin-enabled "true" \
		--only-show-errors 1>/dev/null

	if [ $? -eq 0 ]; then
		echo "Azure Container Registry [$ACR_NAME] created successfully."
	else
		echo "Failed to create Azure Container Registry [$ACR_NAME]."
		exit 1
	fi
else
	echo "[$ACR_NAME] Azure Container Registry already exists in the [$RESOURCE_GROUP_NAME] resource group"
fi

# In dynamic mode there is nothing else to create: the Azure Files CSI driver creates the storage
# account and the file share in the node resource group when the PersistentVolumeClaim is bound.
if [[ "$PROVISIONING_MODE" == 'dynamic' ]]; then
	echo "Dynamic provisioning selected: the Azure Files CSI driver creates the storage account and the [$FILE_SHARE_NAME] file share when the [$PERSISTENT_VOLUME_CLAIM_NAME] persistent volume claim is bound by 05-deploy-app.sh."
	exit 0
fi

# Static provisioning: create the storage account and the file share the PersistentVolume points at.
if [[ "$FILE_SHARE_PROTOCOL" == 'smb' ]]; then
	STORAGE_ACCOUNT_NAME="$SMB_STORAGE_ACCOUNT_NAME"
	STORAGE_ACCOUNT_KIND="$SMB_STORAGE_ACCOUNT_KIND"
	STORAGE_ACCOUNT_SKU="$SMB_STORAGE_ACCOUNT_SKU"
	ENABLED_PROTOCOLS='SMB'

	# An SMB share is mounted with the account key over an encrypted connection, so secure transfer
	# stays on and the account keeps its default network access.
	STORAGE_ACCOUNT_EXTRA_ARGS=(--https-only true)
	FILE_SHARE_EXTRA_ARGS=()
else
	STORAGE_ACCOUNT_NAME="$NFS_STORAGE_ACCOUNT_NAME"
	STORAGE_ACCOUNT_KIND="$NFS_STORAGE_ACCOUNT_KIND"
	STORAGE_ACCOUNT_SKU="$NFS_STORAGE_ACCOUNT_SKU"
	ENABLED_PROTOCOLS='NFS'

	# An NFSv4.1 mount is not encrypted in transit unless the client uses the AZNFS TLS helper, so
	# secure transfer has to be off for the CSI driver to mount the share
	# (https://learn.microsoft.com/en-us/azure/storage/files/files-nfs-protocol).
	STORAGE_ACCOUNT_EXTRA_ARGS=(--https-only false)

	# NoRootSquash lets the init container of the deployment chown the mount point as root, which is
	# how the NFS variant makes the share writable by the non-root user of the app.
	FILE_SHARE_EXTRA_ARGS=(--root-squash NoRootSquash)
fi

echo "Checking if storage account [$STORAGE_ACCOUNT_NAME] exists in the resource group [$RESOURCE_GROUP_NAME]..."
az storage account show \
	--name $STORAGE_ACCOUNT_NAME \
	--resource-group $RESOURCE_GROUP_NAME &>/dev/null

if [[ $? != 0 ]]; then
	echo "Creating [$STORAGE_ACCOUNT_KIND] storage account [$STORAGE_ACCOUNT_NAME] with the [$STORAGE_ACCOUNT_SKU] sku..."
	az storage account create \
		--name $STORAGE_ACCOUNT_NAME \
		--location "$LOCATION" \
		--resource-group $RESOURCE_GROUP_NAME \
		--kind $STORAGE_ACCOUNT_KIND \
		--sku $STORAGE_ACCOUNT_SKU \
		"${STORAGE_ACCOUNT_EXTRA_ARGS[@]}" \
		--only-show-errors 1>/dev/null

	if [ $? -eq 0 ]; then
		echo "Storage account [$STORAGE_ACCOUNT_NAME] created successfully."
	else
		echo "Failed to create storage account [$STORAGE_ACCOUNT_NAME]."
		exit 1
	fi
else
	echo "Storage account [$STORAGE_ACCOUNT_NAME] already exists in the [$RESOURCE_GROUP_NAME] resource group"
fi

# An NFS share has no user-based authentication: access is granted by network rules only, so the
# account must be restricted to the subnets of the AKS nodes that mount the share. The subnets are
# read from the cluster itself, so this works with either of the two cluster provisioning scripts.
# The Microsoft.Storage service endpoint on those subnets is enabled by the cluster script.
if [[ "$FILE_SHARE_PROTOCOL" == 'nfs' ]]; then
	echo "Retrieving the node subnets of the [$AKS_CLUSTER_NAME] AKS cluster..."
	node_subnet_ids=$(az aks show \
		--name $AKS_CLUSTER_NAME \
		--resource-group $RESOURCE_GROUP_NAME \
		--query "agentPoolProfiles[?vnetSubnetId!=null].vnetSubnetId" \
		--output tsv \
		--only-show-errors 2>/dev/null | sort --unique)

	if [[ -z "$node_subnet_ids" ]]; then
		echo "WARNING: no node subnet found for the [$AKS_CLUSTER_NAME] AKS cluster: the [$STORAGE_ACCOUNT_NAME] storage account is left open to all networks."
		echo "WARNING: on Azure the NFS mount will fail, because an NFS share can only be reached from a restricted network."
	else
		network_rules_added='true'

		for node_subnet_id in $node_subnet_ids; do
			echo "Allowing access to the [$STORAGE_ACCOUNT_NAME] storage account from the [$(basename "$node_subnet_id")] subnet..."
			az storage account network-rule add \
				--account-name $STORAGE_ACCOUNT_NAME \
				--resource-group $RESOURCE_GROUP_NAME \
				--subnet "$node_subnet_id" \
				--only-show-errors 1>/dev/null

			if [[ $? != 0 ]]; then
				network_rules_added='false'
				echo "WARNING: failed to allow access from the [$(basename "$node_subnet_id")] subnet to the [$STORAGE_ACCOUNT_NAME] storage account."
			fi
		done

		# The account is closed to every other network only once every subnet rule is in place:
		# denying by default while a rule is missing would lock the nodes out of their own share.
		if [[ "$network_rules_added" == 'true' ]]; then
			echo "Restricting the [$STORAGE_ACCOUNT_NAME] storage account to the node subnets..."
			az storage account update \
				--name $STORAGE_ACCOUNT_NAME \
				--resource-group $RESOURCE_GROUP_NAME \
				--default-action Deny \
				--only-show-errors 1>/dev/null

			if [[ $? == 0 ]]; then
				echo "The [$STORAGE_ACCOUNT_NAME] storage account is now reachable from the node subnets only."
			else
				echo "WARNING: failed to restrict the [$STORAGE_ACCOUNT_NAME] storage account to the node subnets."
				echo "WARNING: on Azure the NFS mount will fail, because an NFS share can only be reached from a restricted network."
			fi
		else
			echo "WARNING: the [$STORAGE_ACCOUNT_NAME] storage account is left open to all networks, because at least one subnet rule could not be created."
			echo "WARNING: on Azure the NFS mount will fail, because an NFS share can only be reached from a restricted network."
		fi
	fi
fi

# Create the Azure file share.
# az storage share-rm talks to the storage resource provider (the control plane) instead of the file
# data plane, which is what makes --enabled-protocols and --root-squash available and lets the share
# be created without an account key.
echo "Checking if file share [$FILE_SHARE_NAME] exists in storage account [$STORAGE_ACCOUNT_NAME]..."
az storage share-rm show \
	--name $FILE_SHARE_NAME \
	--storage-account $STORAGE_ACCOUNT_NAME \
	--resource-group $RESOURCE_GROUP_NAME \
	--only-show-errors &>/dev/null

if [[ $? != 0 ]]; then
	echo "Creating [$ENABLED_PROTOCOLS] file share [$FILE_SHARE_NAME] with a quota of [$FILE_SHARE_QUOTA_GB] GiB..."
	az storage share-rm create \
		--name $FILE_SHARE_NAME \
		--storage-account $STORAGE_ACCOUNT_NAME \
		--resource-group $RESOURCE_GROUP_NAME \
		--enabled-protocols $ENABLED_PROTOCOLS \
		--quota $FILE_SHARE_QUOTA_GB \
		"${FILE_SHARE_EXTRA_ARGS[@]}" \
		--only-show-errors 1>/dev/null

	if [ $? -eq 0 ]; then
		echo "File share [$FILE_SHARE_NAME] created successfully."
	else
		echo "Failed to create file share [$FILE_SHARE_NAME]."
		exit 1
	fi
else
	echo "File share [$FILE_SHARE_NAME] already exists in the [$STORAGE_ACCOUNT_NAME] storage account"
fi

echo "The [$FILE_SHARE_NAME] $ENABLED_PROTOCOLS file share of the [$STORAGE_ACCOUNT_NAME] storage account is ready to be mounted by the app."