-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathfunctions.sh
1101 lines (858 loc) · 37.2 KB
/
functions.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
error() {
local parent_lineno="$1"
local message="$2"
local code="${3:-1}"
if [[ -n "$message" ]] ; then
>&2 echo -e "\e[41mError on or near line ${parent_lineno}: ${message}; exiting with status ${code}\e[0m"
else
>&2 echo -e "\e[41mError on or near line ${parent_lineno}; exiting with status ${code}\e[0m"
fi
echo ""
clean_up_variables
exit "${code}"
}
exit_if_error() {
local exit_code=$1
shift
[[ $exit_code ]] && # do nothing if no error code passed
((exit_code != 0)) && { # do nothing if error code is 0
printf 'ERROR: %s\n' "$@" >&2 # we can use better logging here
exit "$exit_code" # we could also check to make sure
# error code is numeric when passed
}
}
function process_actions {
echo "@calling process_actions"
case "${caf_command}" in
workspace)
workspace ${tf_command}
exit 0
;;
clone)
clone_repository
exit 0
;;
landingzone_mgmt)
landing_zone ${tf_command}
exit 0
;;
launchpad|landingzone)
verify_parameters
deploy ${TF_VAR_workspace}
;;
tfc)
verify_parameters
deploy_tfc ${TF_VAR_workspace}
;;
*)
display_instructions
esac
}
function display_login_instructions {
echo ""
echo "To login the rover to azure:"
echo " rover login --tenant [tenant_name.onmicrosoft.com or tenant_guid (optional)] --subscription [subscription_id_to_target(optional)]"
echo ""
echo " rover logout"
echo ""
echo "To display the current azure session"
echo " rover login "
echo ""
}
function display_instructions {
echo ""
echo "You can deploy a landingzone with the rover by running:"
echo " rover -lz [landingzone_folder_name] -a [plan|apply|validate|import|taint|state list]"
echo ""
echo "List of the landingzones loaded in the rover:"
if [ -d "/tf/caf/landingzones" ]; then
for i in $(ls -d /tf/caf/landingzones/*); do echo ${i%%/}; done
echo ""
fi
if [ -d "/tf/caf/public/landingzones" ]; then
for i in $(ls -d /tf/caf/public/landingzones/*); do echo ${i%%/}; done
echo ""
fi
}
function display_launchpad_instructions {
echo ""
echo "You need to deploy the launchpad from the rover by running:"
if [ -z "${TF_VAR_environment}" ]; then
echo " rover -lz /tf/caf/public/landingzones/caf_launchpad -a apply -launchpad"
else
echo " rover -lz /tf/caf/public/landingzones/caf_launchpad -a apply -launchpad -env ${TF_VAR_environment}"
fi
echo ""
}
function verify_parameters {
echo "@calling verify_parameters"
if [ -z "${landingzone_name}" ]; then
echo "landingzone : '' (not specified)"
if [ ${caf_command} == "launchpad" ]; then
display_instructions
error ${LINENO} "action must be set when deploying a landing zone" 11
fi
else
echo "landingzone : '$(echo ${landingzone_name})'"
cd ${TF_DATA_DIR}
pwd
cd ${landingzone_name}
export TF_VAR_tf_name=${TF_VAR_tf_name:="$(basename $(pwd)).tfstate"}
export TF_VAR_tf_plan=${TF_VAR_tf_plan:="$(basename $(pwd)).tfplan"}
# Must provide an action when the tf_command is set
if [ -z "${tf_action}" ]; then
display_instructions
error ${LINENO} "action must be set when deploying a landing zone" 11
fi
fi
}
# The rover stores the Azure sessions in a local rover/.azure subfolder
# This function verifies the rover has an opened azure session
function verify_azure_session {
echo "@calling verify_azure_session"
if [ "${caf_command}" == "login" ]; then
echo ""
echo "Checking existing Azure session"
session=$(az account show 2>/dev/null || true)
# Cleanup any service principal variables
unset ARM_TENANT_ID
unset ARM_SUBSCRIPTION_ID
unset ARM_CLIENT_ID
unset ARM_CLIENT_SECRET
if [ ! -z "${tenant}" ]; then
echo "Login to azure with tenant ${tenant}"
ret=$(az login --tenant ${tenant} >/dev/null >&1)
else
ret=$(az login >/dev/null >&1)
fi
# the second parameter would be the subscription id to target
if [ ! -z "${subscription}" ]; then
echo "Set default subscription to ${subscription}"
az account set -s ${subscription}
fi
fi
if [ "${caf_command}" == "logout" ]; then
echo "Closing Azure session"
az logout || true
# Cleaup any service principal session
unset ARM_TENANT_ID
unset ARM_SUBSCRIPTION_ID
unset ARM_CLIENT_ID
unset ARM_CLIENT_SECRET
echo "Azure session closed"
exit
fi
echo "Checking existing Azure session"
session=$(az account show -o json 2>/dev/null || true)
if [ "$session" == '' ]; then
display_login_instructions
error ${LINENO} "you must login to an Azure subscription first or 'rover login' again" 2
fi
}
function check_subscription_required_role {
echo "@checking if current user (object_id: ${TF_VAR_logged_user_objectId}) is ${1} of the subscription - only for launchpad"
role=$(az role assignment list --role "${1}" --assignee ${TF_VAR_logged_user_objectId} --include-inherited --include-groups)
if [ "${role}" == "[]" ]; then
error ${LINENO} "the current account must have ${1} privilege on the subscription to deploy launchpad." 2
else
echo "User is ${1} of the subscription"
fi
}
function initialize_state {
echo "@calling initialize_state"
echo "Checking required permissions"
check_subscription_required_role "Owner"
echo "Pwd is $(pwd)"
echo "Installing launchpad from ${landingzone_name}"
cd ${TF_DATA_DIR}
cd ${landingzone_name}
ls
rm -f -- ${landingzone_name}/backend.azurerm.tf
rm -f -- "${TF_DATA_DIR}/terraform.tfstate"
export TF_VAR_tf_name=${TF_VAR_tf_name:="$(basename $(pwd)).tfstate"}
export TF_VAR_tf_plan=${TF_VAR_tf_plan:="$(basename $(pwd)).tfplan"}
export STDERR_FILE="${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/$(basename $(pwd))_stderr.txt"
mkdir -p "${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}"
terraform init \
-get-plugins=true \
-upgrade=true # \
# ${landingzone_name}
RETURN_CODE=$? && echo "Line ${LINENO} - Terraform init return code ${RETURN_CODE}"
case "${tf_action}" in
"plan")
echo "calling plan"
plan
;;
"apply")
echo "calling plan and apply"
plan
apply
get_storage_id
upload_tfstate
;;
"validate")
echo "calling validate"
validate
;;
"destroy")
echo "No more tfstate file"
exit
;;
*)
other
;;
esac
rm -rf backend.azurerm.tf
cd "${current_path}"
}
function deploy_from_remote_state {
echo "@calling deploy_from_remote_state"
echo 'Connecting to the launchpad'
pwd
# cd ${landingzone_name}
if [ -f "backend.azurerm" ]; then
cp backend.azurerm backend.azurerm.tf
fi
login_as_launchpad
deploy_landingzone
rm -rf backend.azurerm.tf
cd "${current_path}"
}
function destroy_from_remote_state {
echo "@calling destroy_from_remote_state"
echo "Destroying from remote state"
echo 'Connecting to the launchpad'
pwd
# cd ${landingzone_name}
login_as_launchpad
export TF_VAR_tf_name=${TF_VAR_tf_name:="$(basename $(pwd)).tfstate"}
export TF_VAR_tf_plan=${TF_VAR_tf_plan:="$(basename $(pwd)).tfplan"}
export STDERR_FILE="${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/$(basename $(pwd))_stderr.txt"
# Cleanup previous deployments
rm -rf "${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}"
rm -rf "${TF_DATA_DIR}/tfstates/terraform.tfstate"
mkdir -p "${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}"
stg_name=$(az storage account show --ids ${id} -o json | jq -r .name)
fileExists=$(az storage blob exists \
--subscription ${TF_VAR_tfstate_subscription_id} \
--name ${TF_VAR_tf_name} \
--container-name ${TF_VAR_workspace} \
--auth-mode 'login' \
--account-name ${stg_name} -o json | jq .exists)
if [ "${fileExists}" == "true" ]; then
if [ ${caf_command} == "launchpad" ]; then
az storage blob download \
--subscription ${TF_VAR_tfstate_subscription_id} \
--name ${TF_VAR_tf_name} \
--file "${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/${TF_VAR_tf_name}" \
--container-name ${TF_VAR_workspace} \
--auth-mode "login" \
--account-name ${stg_name} \
--no-progress
RETURN_CODE=$?
if [ $RETURN_CODE != 0 ]; then
error ${LINENO} "Error downloading the blob storage" $RETURN_CODE
fi
destroy
else
destroy "remote"
fi
else
echo "landing zone already deleted"
fi
cd "${current_path}"
}
function upload_tfstate {
echo "@calling upload_tfstate"
echo "Moving launchpad to the cloud"
stg=$(az storage account show --ids ${id} -o json)
export storage_account_name=$(echo ${stg} | jq -r .name) && echo " - storage_account_name: ${storage_account_name}"
export resource_group=$(echo ${stg} | jq -r .resourceGroup) && echo " - resource_group: ${resource_group}"
export access_key=$(az storage account keys list --subscription ${TF_VAR_tfstate_subscription_id} --account-name ${storage_account_name} --resource-group ${resource_group} -o json | jq -r .[0].value) && echo " - storage_key: retrieved"
az storage blob upload -f "${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/${TF_VAR_tf_name}" \
--container-name ${TF_VAR_workspace} \
--name ${TF_VAR_tf_name} \
--account-name ${storage_account_name} \
--auth-mode key \
--account-key ${access_key} \
--no-progress
RETURN_CODE=$?
if [ $RETURN_CODE != 0 ]; then
error ${LINENO} "Error uploading the blob storage" $RETURN_CODE
fi
rm -f "${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/${TF_VAR_tf_name}"
}
function list_deployed_landingzones {
echo "@calling list_deployed_landingzones"
stg=$(az storage account show --ids ${id} -o json)
export storage_account_name=$(echo ${stg} | jq -r .name) && echo " - storage_account_name: ${storage_account_name}"
echo ""
echo "Landing zones deployed:"
echo ""
az storage blob list \
--subscription ${TF_VAR_tfstate_subscription_id} \
-c ${TF_VAR_workspace} \
--auth-mode login \
--account-name ${storage_account_name} -o json | \
jq -r '["landing zone", "size in Kb", "last modification"], (.[] | [.name, .properties.contentLength / 1024, .properties.lastModified]) | @csv' | \
awk 'BEGIN{ FS=OFS="," }NR>1{ $2=sprintf("%.2f",$2) }1' | \
column -t -s ','
echo ""
}
function login_as_launchpad {
echo "@calling login_as_launchpad"
echo ""
echo "Getting launchpad coordinates from subscription: ${TF_VAR_tfstate_subscription_id}"
export keyvault=$(az keyvault list --subscription ${TF_VAR_tfstate_subscription_id} --query "[?tags.tfstate=='${TF_VAR_level}' && tags.environment=='${TF_VAR_environment}']" -o json | jq -r .[0].name)
echo " - keyvault_name: ${keyvault}"
stg=$(az storage account show --ids ${id} -o json)
export TF_VAR_tenant_id=$(az keyvault secret show --subscription ${TF_VAR_tfstate_subscription_id} -n tenant-id --vault-name ${keyvault} -o json | jq -r .value) && echo " - tenant_id : ${TF_VAR_tenant_id}"
# If the logged in user does not have access to the launchpad
if [ "${TF_VAR_tenant_id}" == "" ]; then
error 326 "Not authorized to manage landingzones. User must be member of the security group to access the launchpad and deploy a landing zone" 102
fi
export TF_VAR_tfstate_storage_account_name=$(echo ${stg} | jq -r .name) && echo " - storage_account_name (current): ${TF_VAR_tfstate_storage_account_name}"
export TF_VAR_lower_storage_account_name=$(az keyvault secret show --subscription ${TF_VAR_tfstate_subscription_id} -n lower-storage-account-name --vault-name ${keyvault} -o json 2>/dev/null | jq -r .value || true) && echo " - storage_account_name (lower): ${TF_VAR_lower_storage_account_name}"
export TF_VAR_tfstate_resource_group_name=$(echo ${stg} | jq -r .resourceGroup) && echo " - resource_group (current): ${TF_VAR_tfstate_resource_group_name}"
export TF_VAR_lower_resource_group_name=$(az keyvault secret show --subscription ${TF_VAR_tfstate_subscription_id} -n lower-resource-group-name --vault-name ${keyvault} -o json 2>/dev/null | jq -r .value || true) && echo " - resource_group (lower): ${TF_VAR_lower_resource_group_name}"
export TF_VAR_tfstate_container_name=${TF_VAR_workspace}
export TF_VAR_lower_container_name=${TF_VAR_workspace}
export TF_VAR_tfstate_key=${TF_VAR_tf_name}
if [ ${caf_command} == "landingzone" ]; then
if [ ${impersonate} = true ]; then
export SECRET_PREFIX=$(az keyvault secret show --subscription ${TF_VAR_tfstate_subscription_id} -n launchpad-secret-prefix --vault-name ${keyvault} -o json | jq -r .value) && echo " - Name: ${SECRET_PREFIX}"
echo "Set terraform provider context to Azure AD application launchpad "
export ARM_CLIENT_ID=$(az keyvault secret show --subscription ${TF_VAR_tfstate_subscription_id} -n ${SECRET_PREFIX}-client-id --vault-name ${keyvault} -o json | jq -r .value) && echo " - client id: ${ARM_CLIENT_ID}"
export ARM_CLIENT_SECRET=$(az keyvault secret show --subscription ${TF_VAR_tfstate_subscription_id} -n ${SECRET_PREFIX}-client-secret --vault-name ${keyvault} -o json | jq -r .value)
export ARM_TENANT_ID=$(az keyvault secret show --subscription ${TF_VAR_tfstate_subscription_id} -n ${SECRET_PREFIX}-tenant-id --vault-name ${keyvault} -o json | jq -r .value) && echo " - tenant id: ${ARM_TENANT_ID}"
export TF_VAR_logged_aad_app_objectId=$(az ad sp show --subscription ${TF_VAR_tfstate_subscription_id} --id ${ARM_CLIENT_ID} --query objectId -o tsv) && echo " - Set logged in aad app object id from keyvault: ${TF_VAR_logged_aad_app_objectId}"
echo "Impersonating with the azure session with the launchpad service principal to deploy the landingzone"
az login --service-principal -u ${ARM_CLIENT_ID} -p ${ARM_CLIENT_SECRET} --tenant ${ARM_TENANT_ID}
fi
fi
}
function plan {
echo "@calling plan"
echo "running terraform plan with ${tf_command}"
echo " -TF_VAR_workspace: ${TF_VAR_workspace}"
echo " -state: ${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/${TF_VAR_tf_name}"
echo " -plan: ${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/${TF_VAR_tf_plan}"
mkdir -p "${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}"
rm -f $STDERR_FILE
# export TF_LOG=${TF_LOG:="DEBUG"}
terraform plan ${tf_command} \
-refresh=true \
-state="${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/${TF_VAR_tf_name}" \
-out="${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/${TF_VAR_tf_plan}" $PWD 2>$STDERR_FILE | tee ${tf_output_file}
RETURN_CODE=$? && echo "Terraform plan return code: ${RETURN_CODE}"
if [ -s $STDERR_FILE ]; then
if [ ${tf_output_file+x} ]; then cat $STDERR_FILE >> ${tf_output_file}; fi
echo "Terraform returned errors:"
cat $STDERR_FILE
RETURN_CODE=2000
fi
if [ $RETURN_CODE != 0 ]; then
error ${LINENO} "Error running terraform plan" $RETURN_CODE
fi
}
function apply {
echo "@calling apply"
echo 'running terraform apply'
rm -f $STDERR_FILE
terraform apply \
-state="${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/${TF_VAR_tf_name}" \
"${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/${TF_VAR_tf_plan}" 2>$STDERR_FILE | tee ${tf_output_file}
RETURN_CODE=$? && echo "Terraform apply return code: ${RETURN_CODE}"
if [ -s $STDERR_FILE ]; then
if [ ${tf_output_file+x} ]; then cat $STDERR_FILE >> ${tf_output_file}; fi
echo "Terraform returned errors:"
cat $STDERR_FILE
RETURN_CODE=2001
fi
if [ $RETURN_CODE != 0 ]; then
error ${LINENO} "Error running terraform apply" $RETURN_CODE
fi
}
function validate {
echo "@calling validate"
echo 'running terraform validate'
terraform validate
RETURN_CODE=$? && echo "Terraform validate return code: ${RETURN_CODE}"
if [ -s $STDERR_FILE ]; then
if [ ${tf_output_file+x} ]; then cat $STDERR_FILE >> ${tf_output_file}; fi
echo "Terraform returned errors:"
cat $STDERR_FILE
RETURN_CODE=2002
fi
if [ $RETURN_CODE != 0 ]; then
error ${LINENO} "Error running terraform validate" $RETURN_CODE
fi
}
function destroy {
echo "@calling destroy $1"
# cd ${landingzone_name}
export TF_VAR_tf_name=${TF_VAR_tf_name:="$(basename $(pwd)).tfstate"}
echo "Calling function destroy"
echo " -TF_VAR_workspace: ${TF_VAR_workspace}"
echo " -TF_VAR_tf_name: ${TF_VAR_tf_name}"
pwd
rm -f "${TF_DATA_DIR}/terraform.tfstate"
sudo rm -f ${landingzone_name}/backend.azurerm.tf
if [ "$1" == "remote" ]; then
if [ -e backend.azurerm ]; then
sudo cp -f backend.azurerm backend.azurerm.tf
fi
# if [ -z "${ARM_USE_MSI}" ]; then
# export ARM_ACCESS_KEY=$(az storage account keys list --subscription ${TF_VAR_tfstate_subscription_id} --account-name ${TF_VAR_tfstate_storage_account_name} --resource-group ${TF_VAR_tfstate_resource_group_name} -o json | jq -r .[0].value)
# fi
echo 'running terraform destroy remote'
terraform init \
-reconfigure=true \
-backend=true \
-get-plugins=true \
-upgrade=true \
-backend-config storage_account_name=${TF_VAR_tfstate_storage_account_name} \
-backend-config resource_group_name=${TF_VAR_tfstate_resource_group_name} \
-backend-config container_name=${TF_VAR_workspace} \
-backend-config key=${TF_VAR_tf_name} \
-backend-config subscription_id=${TF_VAR_tfstate_subscription_id} #\
# ${landingzone_name}
RETURN_CODE=$? && echo "Line ${LINENO} - Terraform init return code ${RETURN_CODE}"
terraform destroy \
-refresh=false \
${tf_command} # \
# ${landingzone_name}
RETURN_CODE=$?
if [ $RETURN_CODE != 0 ]; then
error ${LINENO} "Error running terraform destroy" $RETURN_CODE
fi
else
echo 'running terraform destroy with local tfstate'
# Destroy is performed with the logged in user who last ran the launchap .. apply from the rover. Only this user has permission in the kv access policy
if [ ${TF_VAR_user_type} == "user" ]; then
unset ARM_TENANT_ID
unset ARM_SUBSCRIPTION_ID
unset ARM_CLIENT_ID
unset ARM_CLIENT_SECRET
fi
terraform init \
-reconfigure=true \
-get-plugins=true \
-upgrade=true # \
# ${landingzone_name}
RETURN_CODE=$? && echo "Line ${LINENO} - Terraform init return code ${RETURN_CODE}"
echo "using tfstate from ${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/${TF_VAR_tf_name}"
mkdir -p "${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}"
terraform destroy ${tf_command} \
-refresh=false \
-state="${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/${TF_VAR_tf_name}" # \
# ${landingzone_name}
RETURN_CODE=$?
if [ $RETURN_CODE != 0 ]; then
error ${LINENO} "Error running terraform destroy" $RETURN_CODE
fi
fi
echo "Removing ${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/${TF_VAR_tf_name}"
rm -f "${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/${TF_VAR_tf_name}"
# Delete tfstate
get_storage_id
if [ "$id" != "null" ]; then
echo "Delete state file on storage account:"
echo " -tfstate: ${TF_VAR_tf_name}"
stg_name=$(az storage account show \
--ids ${id} -o json | \
jq -r .name) && echo " -stg_name: ${stg_name}"
fileExists=$(az storage blob exists \
--subscription ${TF_VAR_tfstate_subscription_id} \
--name ${TF_VAR_tf_name} \
--container-name ${TF_VAR_workspace} \
--auth-mode login \
--account-name ${stg_name} -o json | \
jq .exists)
if [ "${fileExists}" == "true" ]; then
echo " -found"
az storage blob delete \
--subscription ${TF_VAR_tfstate_subscription_id} \
--name ${TF_VAR_tf_name} \
--container-name ${TF_VAR_workspace} \
--delete-snapshots include \
--auth-mode login \
--account-name ${stg_name}
echo " -deleted"
fi
fi
rm -rf ${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}
clean_up_variables
}
function other {
echo "@calling other"
echo "running terraform ${tf_action} -state="${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/${TF_VAR_tf_name}" ${tf_command}"
rm -f $STDERR_FILE
terraform ${tf_action} \
-state="${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/${TF_VAR_tf_name}" \
${tf_command} 2>$STDERR_FILE | tee ${tf_output_file}
RETURN_CODE=$? && echo "Terraform ${tf_action} return code: ${RETURN_CODE}"
if [ -s $STDERR_FILE ]; then
if [ ${tf_output_file+x} ]; then cat $STDERR_FILE >> ${tf_output_file}; fi
echo "Terraform returned errors:"
cat $STDERR_FILE
RETURN_CODE=2003
fi
if [ $RETURN_CODE != 0 ]; then
error ${LINENO} "Error running terraform ${tf_action}" $RETURN_CODE
fi
}
function deploy_landingzone {
echo "@calling deploy_landingzone"
echo "Deploying '${landingzone_name}'"
cd ${TF_DATA_DIR}
cd ${landingzone_name}
pwd
export TF_VAR_tf_name=${TF_VAR_tf_name:="$(basename $(pwd)).tfstate"}
export TF_VAR_tf_plan=${TF_VAR_tf_plan:="$(basename $(pwd)).tfplan"}
export STDERR_FILE="${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/$(basename $(pwd))_stderr.txt"
rm -f -- "${TF_DATA_DIR}/terraform.tfstate"
mkdir -p "${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}"
terraform init -reconfigure=true \
-backend=true \
-get-plugins=true \
-upgrade=true \
-backend-config storage_account_name=${TF_VAR_tfstate_storage_account_name} \
-backend-config resource_group_name=${TF_VAR_tfstate_resource_group_name} \
-backend-config container_name=${TF_VAR_workspace} \
-backend-config key=${TF_VAR_tf_name} \
-backend-config subscription_id=${TF_VAR_tfstate_subscription_id} # \
# ${landingzone_name}
RETURN_CODE=$? && echo "Terraform init return code ${RETURN_CODE}"
case "${tf_action}" in
"plan")
echo "calling plan"
plan
;;
"apply")
echo "calling plan and apply"
plan
apply
;;
"validate")
echo "calling validate"
validate
;;
"destroy")
echo "calling destroy"
destroy
;;
*)
other
;;
esac
rm -f "${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/${TF_VAR_tf_plan}"
rm -f "${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/${TF_VAR_tf_name}"
cd "${current_path}"
}
##### workspace functions
## Workspaces are used for an additional level of isolation. Mainly used by CI
function workspace {
echo "@calling workspace function with $@"
get_storage_id
if [ "${id}" == "null" ]; then
display_launchpad_instructions
exit 1000
fi
case "${1}" in
"list")
workspace_list
;;
"create")
workspace_create ${2}
;;
"delete")
workspace_delete ${2}
;;
*)
echo "launchpad workspace [ list | create | delete ]"
;;
esac
}
function workspace_list {
echo "@calling workspace_list"
echo " Calling workspace_list function"
stg=$(az storage account show \
--ids ${id} \
-o json)
export storage_account_name=$(echo ${stg} | jq -r .name)
echo " Listing workspaces:"
echo ""
az storage container list \
--subscription ${TF_VAR_tfstate_subscription_id} \
--auth-mode "login" \
--account-name ${storage_account_name} -o json | \
jq -r '["workspace", "last modification", "lease ststus"], (.[] | [.name, .properties.lastModified, .properties.leaseStatus]) | @csv' | \
column -t -s ','
echo ""
}
function workspace_create {
echo "@calling workspace_create"
echo " Calling workspace_create function"
stg=$(az storage account show \
--ids ${id} -o json)
export storage_account_name=$(echo ${stg} | jq -r .name)
echo " Create $1 workspace"
echo ""
az storage container create \
--subscription ${TF_VAR_tfstate_subscription_id} \
--name $1 \
--auth-mode login \
--account-name ${storage_account_name}
mkdir -p ${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}
echo ""
}
function workspace_delete {
echo "@calling workspace_delete"
stg=$(az storage account show \
--ids ${id} -o json)
export storage_account_name=$(echo ${stg} | jq -r .name)
echo " Delete $1 workspace"
echo ""
az storage container delete \
--subscription ${TF_VAR_tfstate_subscription_id} \
--name $1 \
--auth-mode login \
--account-name ${storage_account_name}
mkdir -p ${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}
echo ""
}
function clean_up_variables {
echo "@calling clean_up_variables"
echo "cleanup variables"
unset TF_VAR_lower_storage_account_name
unset TF_VAR_lower_resource_group_name
unset TF_VAR_lower_key
unset LAUNCHPAD_NAME
unset ARM_TENANT_ID
unset ARM_SUBSCRIPTION_ID
unset ARM_CLIENT_ID
unset ARM_USE_MSI
unset ARM_SAS_TOKEN
unset ARM_CLIENT_SECRET
unset TF_VAR_logged_user_objectId
unset TF_VAR_logged_aad_app_objectId
unset keyvault
unset TF_LOG
echo "clean_up backend_files"
# find /tf/caf -name backend.azurerm.tf -delete
find . -name backend.azurerm.tf -delete
}
function get_logged_user_object_id {
echo "@calling_get_logged_user_object_id"
export TF_VAR_user_type=$(az account show \
--query user.type -o tsv)
if [ ${TF_VAR_user_type} == "user" ]; then
unset ARM_TENANT_ID
unset ARM_SUBSCRIPTION_ID
unset ARM_CLIENT_ID
unset ARM_CLIENT_SECRET
unset TF_VAR_logged_aad_app_objectId
export TF_VAR_tenant_id=$(az account show -o json | jq -r .tenantId)
export TF_VAR_logged_user_objectId=$(az ad signed-in-user show --query objectId -o tsv)
export logged_user_upn=$(az ad signed-in-user show --query userPrincipalName -o tsv)
echo " - logged in user objectId: ${TF_VAR_logged_user_objectId} (${logged_user_upn})"
echo "Initializing state with user: $(az ad signed-in-user show --query userPrincipalName -o tsv)"
else
unset TF_VAR_logged_user_objectId
export clientId=$(az account show --query user.name -o tsv)
export keyvault=$(az keyvault list --subscription ${TF_VAR_tfstate_subscription_id} --query "[?tags.tfstate=='${TF_VAR_level}' && tags.environment=='${TF_VAR_environment}']" -o json | jq -r .[0].name)
case "${clientId}" in
"systemAssignedIdentity")
echo " - logged in Azure with System Assigned Identity"
;;
"userAssignedIdentity")
echo " - logged in Azure with User Assigned Identity: ($(az account show -o json | jq -r .user.assignedIdentityInfo))"
msi=$(az account show | jq -r .user.assignedIdentityInfo)
export TF_VAR_logged_aad_app_objectId=$(az identity show --ids ${msi//MSIResource-} | jq -r .principalId)
export TF_VAR_logged_user_objectId=$(az identity show --ids ${msi//MSIResource-} | jq -r .principalId) && echo " Logged in rover msi object_id: ${TF_VAR_logged_user_objectId}"
export ARM_CLIENT_ID=$(az identity show --ids ${msi//MSIResource-} | jq -r .clientId)
export ARM_TENANT_ID=$(az keyvault secret show --subscription ${TF_VAR_tfstate_subscription_id} -n tenant-id --vault-name ${keyvault} -o json | jq -r .value) && echo " - tenant_id : ${ARM_TENANT_ID}"
;;
*)
# When connected with a service account the name contains the objectId
export TF_VAR_logged_aad_app_objectId=$(az ad sp show --id ${clientId} --query objectId -o tsv) && echo " Logged in rover app object_id: ${TF_VAR_logged_aad_app_objectId}"
export TF_VAR_logged_user_objectId=$(az ad sp show --id ${clientId} --query objectId -o tsv) && echo " Logged in rover app object_id: ${TF_VAR_logged_aad_app_objectId}"
echo " - logged in Azure AD application: $(az ad sp show --id ${clientId} --query displayName -o tsv)"
;;
esac
export TF_VAR_tenant_id=${ARM_TENANT_ID}
fi
}
function deploy {
echo "@calling_deploy"
get_storage_id
get_logged_user_object_id
case "${id}" in
"null")
echo "No launchpad found."
if [ "${caf_command}" == "launchpad" ]; then
if [ -e "${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/${TF_VAR_tf_name}" ]; then
echo "Recover from an un-finished previous execution"
if [ "${tf_action}" == "destroy" ]; then
destroy
else
initialize_state
fi
else
rm -rf "${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}"
if [ "${tf_action}" == "destroy" ]; then
echo "There is no launchpad in this subscription"
else
echo "Deploying from scratch the launchpad"
rm -rf "${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}"
initialize_state
fi
exit
fi
else
error ${LINENO} "You need to initialise a launchpad first with the command \n
rover /tf/caf/landingzones/launchpad [plan | apply | destroy] -launchpad" 1000
fi
;;
'')
error ${LINENO} "you must login to an Azure subscription first or logout / login again" 2
;;
*)
# Get the launchpad version
caf_launchpad=$(az storage account show --ids $id -o json | jq -r .tags.launchpad)
echo ""
echo "${caf_launchpad} already installed"
echo ""
if [ -e "${TF_DATA_DIR}/tfstates/${TF_VAR_level}/${TF_VAR_workspace}/${TF_VAR_tf_name}" ]; then
echo "Recover from an un-finished previous execution"
if [ "${tf_action}" == "destroy" ]; then
if [ "${caf_command}" == "landingzone" ]; then
login_as_launchpad
fi
destroy
else
initialize_state
fi
exit 0
else
echo "Proceed with execution"
case "${tf_action}" in
"destroy")
destroy_from_remote_state
;;
"plan"|"apply"|"validate"|"import"|"output"|"taint"|"state list")
deploy_from_remote_state
;;
*)
display_instructions
;;
esac
fi
;;
esac
}
function landing_zone {
echo "@calling landing_zone"
get_storage_id
case "${1}" in
"list")
echo "Listing the deployed landing zones"
list_deployed_landingzones
;;
*)
echo "rover landingzone [ list ]"
;;
esac
}
function get_storage_id {
echo "@calling get_storage_id"
id=$(az storage account list \
--subscription ${TF_VAR_tfstate_subscription_id} \
--query "[?tags.tfstate=='${TF_VAR_level}' && tags.environment=='${TF_VAR_environment}'].{id:id}" -o json | \
jq -r .[0].id)
echo "ID is ${id}"
if [ ${id} == null ] && [ "${caf_command}" != "launchpad" ]; then
# Check if other launchpad are installed
id=$(az storage account list \
--subscription ${TF_VAR_tfstate_subscription_id} \
--query "[?tags.tfstate=='${TF_VAR_level}'].{id:id}" -o json | \
jq -r .[0].id)
if [ ${id} == null ]; then