Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disable public endpoints of Azure storage accounts #135

Open
pbobov opened this issue Nov 7, 2024 · 0 comments
Open

Disable public endpoints of Azure storage accounts #135

pbobov opened this issue Nov 7, 2024 · 0 comments
Labels
enhancement New feature or request

Comments

@pbobov
Copy link
Collaborator

pbobov commented Nov 7, 2024

ArcGIS Enterprise on Kubernetes now uses private endpoints to access blob stores (see #133), therefore the public endpoints can be disabled.

Disabling the public endpoints for the storage accounts is tricky, because this blocks access to the endpoints for Terraform from GitHub Actions runners. In particular, Terraform cannot create blob containers once the network access to the blob store endpoint is blocked.

Possible workarounds:

  1. Configure firewalls for the storage accounts with exceptions for the GitHub Actions IP addresses. This is not an ideal solution because this allows access to the storage accounts to any GitHub Actions workflow.
  2. Create blob containers in ArcGIS Enterprise Admin CLI pod running in AKS cluster before creating an organization and registering backup stores. This requires granting the AKS cluster identity permissions to create blob containers and makes ArcGIS Enterprise Admin CLI dependent on Azure SDK for Python. Ideally, all the Azure infrastructure management should by done by Terraform.
  3. Hack the Terraform modules to enable public network access to the storage account before creating/describing the blob containers and disable it after the container are created. This hack could have unpredictable side effects.
  4. Ask users to disable public network access manually. That will make subsequent Terraform executions fail when Terraform tries to retrieve state of the blob containers.
@pbobov pbobov added the enhancement New feature or request label Nov 7, 2024
@pbobov pbobov changed the title Disable public network access to Azure storage accounts Disable public endpoints of Azure storage accounts Nov 7, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant