Move oidc permissions to dev-infra

Azure · Nov 26, 2024 · dcec044 · dcec044
1 parent df5de83
commit dcec044
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 11 deletions.
diff --git a/cluster-service/Makefile b/cluster-service/Makefile
@@ -76,16 +76,7 @@ local-deploy-provision-shard:
 	../templatize.sh $(DEPLOY_ENV) deploy/provisioning-shards.tmpl.yml deploy/local-provisioning-shards.yml -e zoneResourceId=$${ZONE_RESOURCE_ID},cxSecretsKeyVaultUrl=$${CX_SECRETS_KV_URL},cxMiKeyVaultUrl=$${CX_MI_KV_URL},maestroRestUrl=http://localhost:8001,maestroGrpUrl=localhost:8090
 	@cat deploy/local-provisioning-shards.yml
 
-personal-storage-permissions:
-	USER_OBJECT_ID=$(shell az ad signed-in-user show --query id -o tsv) && \
-	STORAGEACCOUNTID=$(shell az storage account show -n ${OIDC_STORAGE_ACCOUNT} -g ${RESOURCEGROUP} --query id -o tsv) && \
-	az role assignment create \
-	--role "Storage Blob Data Contributor" \
-	--assignee  $${USER_OBJECT_ID} \
-	--scope "$${STORAGEACCOUNTID}"
-.PHONY: personal-storage-permissions
-
-personal-runtime-config: personal-storage-permissions
+personal-runtime-config:
 	@TENANT_ID=$(shell az account show --query tenantId --output tsv) && \
 	OIDC_BLOB_SERVICE_ENDPOINT=$(shell az storage account show -n ${OIDC_STORAGE_ACCOUNT} -g ${RESOURCEGROUP} --query primaryEndpoints.blob -o tsv) && \
 	OIDC_ISSUER_BASE_ENDPOINT=$(shell az storage account show -n ${OIDC_STORAGE_ACCOUNT} -g ${RESOURCEGROUP} --query primaryEndpoints.web -o tsv) && \

diff --git a/dev-infrastructure/Makefile b/dev-infrastructure/Makefile
@@ -247,7 +247,15 @@ svc.aks.kubeconfigfile:
 	@echo ${SVC_KUBECONFIG_FILE}
 .PHONY: svc.aks.kubeconfigfile
 
-svc.init: region svc svc.aks.admin-access svc.aks.kubeconfig metrics-infra svc.enable-aks-metrics
+svc.oidc.storage.permissions:
+	STORAGEACCOUNTID=$(shell az storage account show -n ${OIDC_STORAGE_ACCOUNT} -g ${SVC_RESOURCEGROUP} --query id -o tsv) && \
+	az role assignment create \
+	--role "Storage Blob Data Contributor" \
+	--assignee ${PRINCIPAL_ID} \
+	--scope "$${STORAGEACCOUNTID}"
+.PHONY: svc.oidc.storage.permissions
+
+svc.init: region svc svc.aks.admin-access svc.aks.kubeconfig metrics-infra svc.enable-aks-metrics svc.oidc.storage.permissions
 .PHONY: svc.init
 
 svc.what-if: svc.rg

diff --git a/dev-infrastructure/config.tmpl.mk b/dev-infrastructure/config.tmpl.mk
@@ -11,3 +11,4 @@ REPOSITORIES_TO_SYNC ?= '{{ .imageSync.repositories }}'
 AKS_NAME ?= {{ .aksName }}
 CS_PG_NAME ?= {{ .clusterService.postgres.name }}
 MAESTRO_PG_NAME ?= {{ .maestro.postgres.name }}
+OIDC_STORAGE_ACCOUNT ?= {{ .oidcStorageAccountName }}