-
Notifications
You must be signed in to change notification settings - Fork 86
/
roleassignments.go
67 lines (56 loc) · 2.11 KB
/
roleassignments.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
package cloud
import (
"context"
"time"
"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization"
"github.com/google/uuid"
"github.com/pkg/errors"
"monis.app/mlog"
)
const (
roleAssignmentCreateRetryCount = 7
roleAssignmentCreateRetryDelay = 5 * time.Second
)
// CreateRoleAssignment creates a role assignment.
func (c *AzureClient) CreateRoleAssignment(ctx context.Context, scope, roleName, principalID string) (armauthorization.RoleAssignment, error) {
var result armauthorization.RoleAssignment
roleDefinitionID, err := c.GetRoleDefinitionIDByName(ctx, "", roleName)
if err != nil {
return result, errors.Wrapf(err, "failed to get role definition id for role %s", roleName)
}
mlog.Debug("Creating role assignment",
"principalID", principalID,
"role", roleName,
)
parameters := armauthorization.RoleAssignmentCreateParameters{
Properties: &armauthorization.RoleAssignmentProperties{
RoleDefinitionID: roleDefinitionID.ID,
PrincipalID: to.Ptr(principalID),
},
}
// Adding retries to handle the propagation delay of the service principal.
// Trying to create role assignment immediately after service principal is created
// results in "PrincipalNotFound" error.
for i := 0; i < roleAssignmentCreateRetryCount; i++ {
resp, err := c.roleAssignmentsClient.Create(ctx, scope, uuid.New().String(), parameters, nil)
if err == nil {
return resp.RoleAssignment, nil
}
if IsRoleAssignmentExists(err) {
mlog.Warning("Role assignment already exists", "principalID", principalID, "role", roleName)
return result, err
}
time.Sleep(roleAssignmentCreateRetryDelay)
}
return result, err
}
// DeleteRoleAssignment deletes a role assignment.
func (c *AzureClient) DeleteRoleAssignment(ctx context.Context, roleAssignmentID string) (armauthorization.RoleAssignment, error) {
mlog.Debug("Deleting role assignment", "id", roleAssignmentID)
resp, err := c.roleAssignmentsClient.DeleteByID(ctx, roleAssignmentID, nil)
if err != nil {
return armauthorization.RoleAssignment{}, err
}
return resp.RoleAssignment, nil
}