Update test/dev/cluster-template-custom-builds.yaml to use managed id…

… and az storage blob download Signed-off-by: Jeremy Rickard <[email protected]> Co-authored-by: Danny Brito <[email protected]>
kubernetes-sigs · Oct 16, 2023 · a0702cd · a0702cd
1 parent 620382a
commit a0702cd
Show file tree

Hide file tree

Showing 6 changed files with 68 additions and 6 deletions.
diff --git a/templates/test/dev/cluster-template-custom-builds.yaml b/templates/test/dev/cluster-template-custom-builds.yaml
diff --git a/templates/test/dev/custom-builds/patches/kubeadm-bootstrap-windows-k8s-pr-binaries.yaml b/templates/test/dev/custom-builds/patches/kubeadm-bootstrap-windows-k8s-pr-binaries.yaml
@@ -1,3 +1,16 @@
+- op: add
+  path: /spec/template/spec/files/-
+  value:
+    content: |
+      Write-Host "Installing Azure CLI"
+      $ProgressPreference = 'SilentlyContinue'; Invoke-WebRequest -Uri https://azcliprod.blob.core.windows.net/msi/azure-cli-2.53.0.msi -OutFile .\AzureCLI.msi; Start-Process msiexec.exe -Wait -ArgumentList '/I AzureCLI.msi /quiet'; Remove-Item .\AzureCLI.msi
+      # Need to add manually AZ to PATH as it is not added without a reset
+      Write-Host "Adding AZ to path:"
+      $env:PATH +=";C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\wbin"
+      Write-Host "Version Azure CLI:"
+      az version
+    path: C:/install-az-cli.ps1
+    permissions: "0744"
 - op: add
   path: /spec/template/spec/files/-
   value:
@@ -9,12 +22,18 @@
       $$KUBE_GIT_VERSION="${KUBE_GIT_VERSION}"
       if($$KUBE_GIT_VERSION -ne "")
       {
+        # Need to add manually AZ to PATH as it is not added without a reset
+        Write-Host "Adding AZ to path:"
+        $env:PATH +=";C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\wbin"
+        # Install Binaries
         $$binaries=@("kubeadm", "kubectl", "kubelet", "kube-proxy")
         $$ci_url="https://${AZURE_STORAGE_ACCOUNT}.blob.core.windows.net/${JOB_NAME}/${KUBE_GIT_VERSION}/bin/windows/amd64"
+        echo "running az login via identity"
+        az login --identity
         foreach ( $$binary in $$binaries )
         {
           echo "downloading binary: $$ci_url/$$binary.exe"
-          curl.exe --retry 10 --retry-delay 5 "$$ci_url/$$binary.exe" --output "c:/k/$$binary.exe"
+          az storage blob download --blob-url "$$ci_url/$$binary.exe" --file "c:/k/$$binary.exe" --auth-mode login
         }
       }
 
@@ -29,6 +48,10 @@
       kube-proxy.exe --version
     path: C:/replace-pr-binaries.ps1
     permissions: "0744"
+- op: add
+  path: /spec/template/spec/preKubeadmCommands/-
+  value:
+    powershell C:/install-az-cli.ps1
 - op: add
   path: /spec/template/spec/preKubeadmCommands/-
   value:

diff --git a/templates/test/dev/custom-builds/patches/kubeadm-bootstrap.yaml b/templates/test/dev/custom-builds/patches/kubeadm-bootstrap.yaml
@@ -10,9 +10,10 @@
 
       systemctl stop kubelet
       declare -a BINARIES=("kubeadm" "kubectl" "kubelet")
+      az login --identity
       for BINARY in "$${BINARIES[@]}"; do
         echo "* installing package: $${BINARY} ${KUBE_GIT_VERSION}"
-        curl --retry 10 --retry-delay 5 "https://${AZURE_STORAGE_ACCOUNT}.blob.core.windows.net/${JOB_NAME}/${KUBE_GIT_VERSION}/bin/linux/amd64/$${BINARY}" --output "/usr/bin/$${BINARY}"
+        az storage blob download --blob-url "https://${AZURE_STORAGE_ACCOUNT}.blob.core.windows.net/${JOB_NAME}/${KUBE_GIT_VERSION}/bin/linux/amd64/$${BINARY}" -f "/usr/bin/$${BINARY}" --auth-mode login
       done
       systemctl restart kubelet
 

diff --git a/templates/test/dev/custom-builds/patches/kubeadm-controlplane-bootstrap.yaml b/templates/test/dev/custom-builds/patches/kubeadm-controlplane-bootstrap.yaml
@@ -10,9 +10,10 @@
 
         systemctl stop kubelet
         declare -a BINARIES=("kubeadm" "kubectl" "kubelet")
+        az login --identity
         for BINARY in "$${BINARIES[@]}"; do
           echo "* installing package: $${BINARY} ${KUBE_GIT_VERSION}"
-          curl --retry 10 --retry-delay 5 "https://${AZURE_STORAGE_ACCOUNT}.blob.core.windows.net/${JOB_NAME}/${KUBE_GIT_VERSION}/bin/linux/amd64/$${BINARY}" --output "/usr/bin/$${BINARY}"
+          az storage blob download --blob-url "https://${AZURE_STORAGE_ACCOUNT}.blob.core.windows.net/${JOB_NAME}/${KUBE_GIT_VERSION}/bin/linux/amd64/$${BINARY}" -f "/usr/bin/$${BINARY}" --auth-mode login
         done
         systemctl restart kubelet
 

diff --git a/templates/test/dev/custom-builds/patches/machine-deployment-pr-version-windows.yaml b/templates/test/dev/custom-builds/patches/machine-deployment-pr-version-windows.yaml
@@ -6,6 +6,9 @@ metadata:
 spec:
   template:
     spec:
+      identity: UserAssigned
+      userAssignedIdentities:
+        - providerID: /subscriptions/${AZURE_SUBSCRIPTION_ID}/resourceGroups/${CI_RG:=capz-ci}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/${USER_IDENTITY:=cloud-provider-user-identity}
       image:
         # we use the latest image as a workaround there is no published marketplace image for k8s CI versions.
         # latest binaries and images will get replaced to the desired version by the script above.

diff --git a/templates/test/dev/custom-builds/patches/machine-deployment-pr-version.yaml b/templates/test/dev/custom-builds/patches/machine-deployment-pr-version.yaml
@@ -5,6 +5,9 @@ metadata:
 spec:
   template:
     spec:
+      identity: UserAssigned
+      userAssignedIdentities:
+        - providerID: /subscriptions/${AZURE_SUBSCRIPTION_ID}/resourceGroups/${CI_RG:=capz-ci}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/${USER_IDENTITY:=cloud-provider-user-identity}
       image:
         # we use the latest image as a workaround there is no published marketplace image for k8s CI versions.
         # latest binaries and images will get replaced to the desired version by the script above.
@@ -21,6 +24,9 @@ metadata:
 spec:
   template:
     spec:
+      identity: UserAssigned
+      userAssignedIdentities:
+        - providerID: /subscriptions/${AZURE_SUBSCRIPTION_ID}/resourceGroups/${CI_RG:=capz-ci}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/${USER_IDENTITY:=cloud-provider-user-identity}
       image:
         # we use the latest image as a workaround there is no published marketplace image for k8s CI versions.
         # latest binaries and images will get replaced to the desired version by the script above.