On branch uami-improvement Make it so UAMI and SP are not required as preconditions. Rather, they are dynamically created as needed, and cleaned up when done.

.github/workflows/setupForWlsAks.sh
.github/workflows/teardownForWlsAks.sh

- The workflow does not need to provide the UAMI or SP as inputs, so
  it does not need to generate them.  This simplifies the workflow significantly.

weblogic-azure-aks/src/main/arm/scripts/buildWLSDockerImage.sh
weblogic-azure-aks/src/main/arm/scripts/genImageModel.sh
weblogic-azure-aks/src/main/arm/scripts/setupWLSDomain.sh

- Add retry to cURL invocations.

weblogic-azure-aks/src/main/arm/scripts/common.sh

- Retry increases.

weblogic-azure-aks/src/main/arm/scripts/createAppGatewayIngress.sh

- Account for passing of parameters.

weblogic-azure-aks/src/main/arm/scripts/createLbSvc.sh

- Use environment variable naming style.

weblogic-azure-aks/src/main/arm/scripts/createVMAndBuildImage.sh

- Add clean up of newly created resources required by the change to
  handle UAMI and SP internal to the deployment.

- Bash best practices.

weblogic-azure-aks/src/main/arm/scripts/inline-scripts/enableAgic.sh

- New script to do the heavy lifting with the UAMI.

weblogic-azure-aks/src/main/arm/scripts/inline-scripts/validateParameters.sh

- Remove repetitive declarations of several functions. They are
  declared in `utility.sh`.

- Remove declaration of `validate_user_assigned_managed_identity` and
  `validate_aks_network_plugin`.  They are unused.

- Add retry to cURL invocations.

weblogic-azure-aks/src/main/arm/scripts/setupNetworking.sh

- Use different technique for invoking scripts without passing
  passwords in cleartext on command line.

- Bash best practices.

weblogic-azure-aks/src/main/arm/scripts/utility.sh

- `utility_validate_status` proper indenting.

- Add retry capability to `install_jdk`.

- Add `install_docker`, with retry capability.

- Add retry capability to `install_kubectl`.

- Add retry to cURL invocations.

weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-appgw-upload-trusted-root-certificate.bicep
weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-datasource-connection.bicep
weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-output-domain-configurations.bicep
weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-query-storage-account.bicep
weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-validate-parameters.bicep
weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds_query_available_private_ip_from_subnet.bicep
weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds_update-applications.bicep
weblogic-azure-aks/src/main/bicep/modules/_setupDBConnection.bicep
weblogic-azure-aks/src/main/bicep/modules/setupDBConnection.bicep
weblogic-azure-aks/src/main/bicep/modules/setupWebLogicCluster.bicep
weblogic-azure-aks/src/main/bicep/modules/updateWebLogicApplications.bicep
weblogic-azure-aks/src/main/bicep/modules/_azure-resoruces/_keyvault/_keyvaultWithNewCert.bicep
weblogic-azure-aks/src/main/bicep/modules/_azure-resoruces/_keyvaultForGateway.bicep
weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-create-wls-cluster.bicep
weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-datasource-connection.bicep

- Avoid ttk failure regarding empty params.

- Use `azCliVersion` from `mainTemplate.bicep`.

weblogic-azure-aks/src/main/bicep/mainTemplate.bicep

- Remove UAMI parameter.

- Remove Service Principal paremeter.

- Numerous changes to implement feature.

weblogic-azure-aks/src/main/bicep/modules/_appGateway.bicep

- Entirely new file, deploys app gateway without accepting UAMI as input.

weblogic-azure-aks/src/main/bicep/modules/_azure-resoruces/_aks.bicep

- remove unused reference to `aksClusterDefault`.

weblogic-azure-aks/src/main/bicep/modules/_azure-resoruces/_appgateway.bicep

- Called from `src/main/bicep/modules/_appGateway.bicep` to handle
  different query cases necessary for making deployment decisions.

weblogic-azure-aks/src/main/bicep/modules/_azure-resoruces/_vnetAppGateway.bicep

- Called from `src/main/bicep/modules/_appGateway.bicep`

- Returns the vnet for the app gateway.

weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-create-networking.bicep

- Avoid ttk failure regarding empty params.

- Use `azCliVersion` from `mainTemplate.bicep`.

- Invoke `ds-networking-deployment.sh`, passing env vars.

weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-validate-applications.bicep

- Avoid ttk failure regarding empty params.

- Use `azCliVersion` from `mainTemplate.bicep`.

- Fix incorrect path to WLST script.

weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds_ensure_available_agic.bicep

- New script to envoke `enableAgic.sh`.

weblogic-azure-aks/src/main/bicep/modules/_rolesAssignment/_agicRoleAssignment.bicep

- Assign Resource Group Contributor role to User Assigned Managed Identity

weblogic-azure-aks/src/main/bicep/modules/_rolesAssignment/_roleAssignmentinSubscription.bicep

- Assign subscription scope role to User Assigned Managed Identity

weblogic-azure-aks/src/main/bicep/modules/_uamiAndRoles.bicep

- Invoke `_roleAssignmentinSubscription.bicep`

weblogic-azure-aks/src/main/bicep/modules/networking.bicep

- Main bicep module for networking.  This is where the hard work of
  the entire networking tab happens.

renamed:    weblogic-azure-aks/src/test/setupWlsAksParameters.json -> weblogic-azure-aks/src/test/setupWlsAksParameters.jsonc

According to Alex Frankel,

> if it was only for someone maintaining the code in the future, why
> not use a // style comment? You can use a .jsonc file which will
> accept comments

- This file is used by CI/CD workflows. It allows the workflows to provide parameters when invoking the offer from the command line.

- Remove parameters related to UAMI.

weblogic-azure-aks/src/main/arm/createUiDefinition.json

- Repurpose existing info box on first pane. This info box was called
  `domainHomeSourceTypeExplainer` and is now called
  `infoForBeforeDeployment`.  The text in the box has been expanded to
  also clearly state what Azure RBAC roles are necessary in order to
  successfully perform the deployment.

- Remove the UAMI selector.

- Temporarily hide the `Configure frontend IP with private IP address`
  checkbox due to an existing Azure outage with an uncertain timeframe
  for resolution. We will un-hide it when the outage is resolved.

- Remove the service principal box in the App Gateway Ingress Controller section.

- Necessary removals from the `outputs` section.

.github/workflows/testWlsAksWithDependencyCreation.yml
.github/workflows/testWlsAksWithoutDependencyCreation.yml

- Remove service principal

- Use passing arm-ttk version

- Use .jsonc parameters file.

Author: galiacheng

.github/workflows/buildWlsAksArtifact.yml

@@ -9,7 +9,7 @@ on:
 
 env:
     refArmttk: 500a3a612ef51d4421c114183f97b425c9bfaab8
-    refJavaee: f25ab89a2a8848da39b84e5d6c927f4c4cb47200
+    refJavaee: bad2965565e2e69318039bc15c2496844d55a59d
     azCliVersion: 2.30.0
     location: eastus
     aksRepoUserName: oracle

.github/workflows/setupForWlsAks.sh

@@ -89,7 +89,6 @@ fi
 
 DISAMBIG_PREFIX=${DISAMBIG_PREFIX}`date +%m%d`
 SERVICE_PRINCIPAL_NAME=${DISAMBIG_PREFIX}sp
-USER_ASSIGNED_MANAGED_IDENTITY_NAME=${DISAMBIG_PREFIX}u
 
 # get default location if not set at the beginning of this file
 if [ "$LOCATION" == '' ] ; then
@@ -137,34 +136,14 @@ USE_GITHUB_CLI=false
 }
 
 # Execute commands
-msg "${GREEN}(3/6) Create service principal and Azure credentials ${SERVICE_PRINCIPAL_NAME}"
+msg "${GREEN}(3/6) Create Azure credentials ${SERVICE_PRINCIPAL_NAME}"
 SUBSCRIPTION_ID=$(az account show --query id --output tsv --only-show-errors)
 
 ### AZ ACTION CREATE
 
-SERVICE_PRINCIPAL=$(az ad sp create-for-rbac --name ${SERVICE_PRINCIPAL_NAME} --role="Contributor" --scopes="/subscriptions/${SUBSCRIPTION_ID}" --sdk-auth --only-show-errors | base64 -w0)
-AZURE_CREDENTIALS=$(echo $SERVICE_PRINCIPAL | base64 -d)
-
-### AZ ACTION CREATE
-
-msg "${GREEN}(4/6) Create User assigned managed identity ${USER_ASSIGNED_MANAGED_IDENTITY_NAME}"
-az group create --name ${USER_ASSIGNED_MANAGED_IDENTITY_NAME} --location ${LOCATION}
-az identity create --name ${USER_ASSIGNED_MANAGED_IDENTITY_NAME} --location ${LOCATION} --resource-group ${USER_ASSIGNED_MANAGED_IDENTITY_NAME} --subscription ${SUBSCRIPTION_ID}
-USER_ASSIGNED_MANAGED_IDENTITY_ID_NOT_ESCAPED=$(az identity show --name ${USER_ASSIGNED_MANAGED_IDENTITY_NAME} --resource-group ${USER_ASSIGNED_MANAGED_IDENTITY_NAME} --query id)
-
-### AZ ACTION MUTATE
-
-msg "${GREEN}(5/6) Grant Contributor role in subscription scope to ${USER_ASSIGNED_MANAGED_IDENTITY_NAME}. Sleeping for ${SLEEP_VALUE} first."
-sleep ${SLEEP_VALUE}
-ASSIGNEE_OBJECT_ID=$(az identity show --name ${USER_ASSIGNED_MANAGED_IDENTITY_NAME} --resource-group ${USER_ASSIGNED_MANAGED_IDENTITY_NAME} --query principalId)
-# strip quotes
-ASSIGNEE_OBJECT_ID=${ASSIGNEE_OBJECT_ID//\"/}
-az role assignment create --role Contributor --assignee-principal-type ServicePrincipal --assignee-object-id ${ASSIGNEE_OBJECT_ID} --subscription ${SUBSCRIPTION_ID} --scope /subscriptions/${SUBSCRIPTION_ID}
-
-# https://stackoverflow.com/questions/13210880/replace-one-substring-for-another-string-in-shell-script
-USER_ASSIGNED_MANAGED_IDENTITY_ID=${USER_ASSIGNED_MANAGED_IDENTITY_ID_NOT_ESCAPED//\//\\/}
-# remove leading and trailing quote
-USER_ASSIGNED_MANAGED_IDENTITY_ID=${USER_ASSIGNED_MANAGED_IDENTITY_ID//\"/}
+AZURE_CREDENTIALS=$(az ad sp create-for-rbac --name ${SERVICE_PRINCIPAL_NAME} --role="Contributor" --scopes="/subscriptions/${SUBSCRIPTION_ID}" --sdk-auth --only-show-errors)
+SP_ID=$( az ad sp list --display-name $SERVICE_PRINCIPAL_NAME --query [0].id -o tsv)
+az role assignment create --assignee ${SP_ID} --role "User Access Administrator"
 
 msg "${GREEN}(6/6) Create secrets in GitHub"
 if $USE_GITHUB_CLI; then
@@ -177,12 +156,6 @@ if $USE_GITHUB_CLI; then
     gh ${GH_FLAGS} secret set DB_PASSWORD -b"${DB_PASSWORD}"
     gh ${GH_FLAGS} secret set ORC_SSOPSW -b"${ORC_SSOPSW}"
     gh ${GH_FLAGS} secret set ORC_SSOUSER -b"${ORC_SSOUSER}"
-    gh ${GH_FLAGS} secret set SERVICE_PRINCIPAL -b"${SERVICE_PRINCIPAL}"
-    msg "${YELLOW}\"SERVICE_PRINCIPAL\""
-    msg "${GREEN}${SERVICE_PRINCIPAL}"
-    gh ${GH_FLAGS} secret set USER_ASSIGNED_MANAGED_IDENTITY_ID -b"${USER_ASSIGNED_MANAGED_IDENTITY_ID}"
-    msg "${YELLOW}\"USER_ASSIGNED_MANAGED_IDENTITY_ID\""
-    msg "${GREEN}${USER_ASSIGNED_MANAGED_IDENTITY_ID}"
     gh ${GH_FLAGS} secret set WDT_RUNTIMEPSW -b"${WDT_RUNTIMEPSW}"
     gh ${GH_FLAGS} secret set WLS_PSW -b"${WLS_PSW}"    
     gh ${GH_FLAGS} secret set WLS_USERNAME -b"${WLS_USERNAME}"
@@ -208,10 +181,6 @@ if [ $USE_GITHUB_CLI == false ]; then
   msg "${GREEN}${ORC_SSOPSW}"
   msg "${YELLOW}\"ORC_SSOUSER\""
   msg "${GREEN}${ORC_SSOUSER}"
-  msg "${YELLOW}\"SERVICE_PRINCIPAL\""
-  msg "${GREEN}${SERVICE_PRINCIPAL}"
-  msg "${YELLOW}\"USER_ASSIGNED_MANAGED_IDENTITY_ID\""
-  msg "${GREEN}${USER_ASSIGNED_MANAGED_IDENTITY_ID}"
   msg "${YELLOW}\"WDT_RUNTIMEPSW\""
   msg "${GREEN}${WDT_RUNTIMEPSW}"
   msg "${YELLOW}\"WLS_PSW\""

.github/workflows/teardownForWlsAks.sh

@@ -43,21 +43,17 @@ else
 fi
 
 SERVICE_PRINCIPAL_NAME=${DISAMBIG_PREFIX}sp
-USER_ASSIGNED_MANAGED_IDENTITY_NAME=${DISAMBIG_PREFIX}u
-
 # Execute commands
 msg "${GREEN}(1/4) Delete service principal ${SERVICE_PRINCIPAL_NAME}"
 SUBSCRIPTION_ID=$(az account show --query id --output tsv --only-show-errors)
-SP_OBJECT_ID_ARRAY=$(az ad sp list --display-name ${SERVICE_PRINCIPAL_NAME} --query "[].objectId") || true
+SP_OBJECT_ID_ARRAY=$(az ad sp list --display-name ${SERVICE_PRINCIPAL_NAME} --query "[0].id") || true
 # remove whitespace
 SP_OBJECT_ID_ARRAY=$(echo ${SP_OBJECT_ID_ARRAY} | xargs) || true
 SP_OBJECT_ID_ARRAY=${SP_OBJECT_ID_ARRAY//[/}
 SP_OBJECT_ID=${SP_OBJECT_ID_ARRAY//]/}
+az role assignment delete --yes --assignee ${SP_OBJECT_ID} || true
 az ad sp delete --id ${SP_OBJECT_ID} || true
 
-msg "${GREEN}(2/4) Delete User assigned managed identity ${USER_ASSIGNED_MANAGED_IDENTITY_NAME}"
-az group delete --yes --no-wait --name ${USER_ASSIGNED_MANAGED_IDENTITY_NAME} > /dev/null 2>&1 || true
-
 # Check GitHub CLI status
 msg "${GREEN}(3/4) Checking GitHub CLI status...${NOFORMAT}"
 USE_GITHUB_CLI=false
@@ -77,8 +73,6 @@ if $USE_GITHUB_CLI; then
     gh ${GH_FLAGS} secret remove DB_PASSWORD
     gh ${GH_FLAGS} secret remove ORC_SSOPSW
     gh ${GH_FLAGS} secret remove ORC_SSOUSER
-    gh ${GH_FLAGS} secret remove SERVICE_PRINCIPAL
-    gh ${GH_FLAGS} secret remove USER_ASSIGNED_MANAGED_IDENTITY_ID
     gh ${GH_FLAGS} secret remove WDT_RUNTIMEPSW
     gh ${GH_FLAGS} secret remove WLS_PSW
     gh ${GH_FLAGS} secret remove WLS_USERNAME
@@ -97,8 +91,6 @@ if [ $USE_GITHUB_CLI == false ]; then
   msg "${YELLOW}\"DB_PASSWORD\""
   msg "${YELLOW}\"ORC_SSOPSW\""
   msg "${YELLOW}\"ORC_SSOUSER\""
-  msg "${YELLOW}\"SERVICE_PRINCIPAL\""
-  msg "${YELLOW}\"USER_ASSIGNED_MANAGED_IDENTITY_ID\""
   msg "${YELLOW}\"WDT_RUNTIMEPSW\""
   msg "${YELLOW}\"WLS_PSW\""
   msg "${YELLOW}\"WLS_USERNAME\""

.github/workflows/testWlsAksWithDependencyCreation.yml

@@ -22,21 +22,19 @@ on:
 
 env:
     refArmttk: 500a3a612ef51d4421c114183f97b425c9bfaab8
-    refJavaee: f25ab89a2a8848da39b84e5d6c927f4c4cb47200
+    refJavaee: bad2965565e2e69318039bc15c2496844d55a59d
     azCliVersion: 2.30.0
     azureCredentials: ${{ secrets.AZURE_CREDENTIALS }}
     location: eastus
     resourceGroupForWlsAks: wlsd-aks-${{ github.run_id }}-${{ github.run_number }}
     dbAdminUser: weblogic
     dbPassword: ${{ secrets.DB_PASSWORD }}
     dbName: wlsdb${{ github.run_id }}${{ github.run_number }}
-    servicePrincipal: ${{ secrets.SERVICE_PRINCIPAL }}
     ocrSSOPSW: ${{ secrets.ORC_SSOPSW }}
     ocrSSOUser: ${{ secrets.ORC_SSOUSER }}
     wdtRuntimePassword: ${{ secrets.WDT_RUNTIMEPSW}}
     wlsUserName: ${{ secrets.WLS_USERNAME }}
     wlsPassword: ${{ secrets.WLS_PSW }}
-    userAssignedManagedIdentity: ${{ secrets.USER_ASSIGNED_MANAGED_IDENTITY_ID }}
     resourceGroupForDB: wlsd-db-${{ github.run_id }}-${{ github.run_number }}
     resourceGroupForStorageAccount: wlsd-sa-${{ github.run_id }}-${{ github.run_number }}
     storageAccountName: wlsdsa${{ github.run_id }}${{ github.run_number }}
@@ -256,18 +254,16 @@ jobs:
                 sed -i "s/#location#/${location}/g; \
                         s/#wlsUserName#/${wlsUserName}/g; \
                         s/#wlsPassword#/${wlsPassword}/g; \
-                        s/#userAssignedManagedIdentity#/${userAssignedManagedIdentity}/g; \
                         s/#ocrSSOPSW#/${ocrSSOPSW}/g; \
                         s/#ocrSSOUser#/${ocrSSOUser}/g; \
                         s/#appPackageUrls#/${cargoTrackerBlobUrl}/g; \
-                        s/#servicePrincipal#/${servicePrincipal}/g; \
                         s/#wdtRuntimePassword#/${wdtRuntimePassword}/g; \
                         s/#testbranchName#/${{ needs.preflight.outputs.testBranchNameForArtifactsLocation }}/g; \
                         s/#gitUserName#/${{ needs.preflight.outputs.gitUserNameForArtifactsLocation }}/g; \
                         s/#dbPassword#/${dbPassword}/g; \
                         s/#dbUser#/${dbAdminUser}@${dbName}/g; \
                         s/#dsConnectionURL#/jdbc:postgresql:\/\/${dbName}.postgres.database.azure.com:5432\/postgres/g" \
-                        weblogic-azure/weblogic-azure-aks/src/test/setupWlsAksParameters.json
+                        weblogic-azure/weblogic-azure-aks/src/test/setupWlsAksParameters.jsonc
             - name: Deploy WebLogic Server Cluster Domain offer
               id: deploy-wls-cluster
               uses: azure/CLI@v1
@@ -278,7 +274,7 @@ jobs:
                     --verbose \
                     --resource-group ${{ env.resourceGroupForWlsAks }} \
                     --name wls-on-aks \
-                    --parameters @weblogic-azure/weblogic-azure-aks/src/test/setupWlsAksParameters.json \
+                    --parameters @weblogic-azure/weblogic-azure-aks/src/test/setupWlsAksParameters.jsonc \
                     --template-file ${artifactName}/mainTemplate.json
             - name: Query Application Gateway URL
               run: |

.github/workflows/testWlsAksWithoutDependencyCreation.yml

@@ -37,19 +37,17 @@ on:
 
 env:
     refArmttk: 500a3a612ef51d4421c114183f97b425c9bfaab8
-    refJavaee: f25ab89a2a8848da39b84e5d6c927f4c4cb47200
+    refJavaee: bad2965565e2e69318039bc15c2496844d55a59d
     azCliVersion: 2.30.0
     azureCredentials: ${{ secrets.AZURE_CREDENTIALS }}
     location: eastus
     dbAdminUser: weblogic
     dbPassword: ${{ secrets.DB_PASSWORD }}
-    servicePrincipal: ${{ secrets.SERVICE_PRINCIPAL }}
     ocrSSOPSW: ${{ secrets.ORC_SSOPSW }}
     ocrSSOUser: ${{ secrets.ORC_SSOUSER }}
     wdtRuntimePassword: ${{ secrets.WDT_RUNTIMEPSW}}
     wlsUserName: ${{ secrets.WLS_USERNAME }}
     wlsPassword: ${{ secrets.WLS_PSW }}
-    userAssignedManagedIdentity: ${{ secrets.USER_ASSIGNED_MANAGED_IDENTITY_ID }}
 
 jobs:
     preflight:
@@ -214,18 +212,16 @@ jobs:
                 sed -i "s/#location#/${location}/g; \
                         s/#wlsUserName#/${wlsUserName}/g; \
                         s/#wlsPassword#/${wlsPassword}/g; \
-                        s/#userAssignedManagedIdentity#/${userAssignedManagedIdentity}/g; \
                         s/#ocrSSOPSW#/${ocrSSOPSW}/g; \
                         s/#ocrSSOUser#/${ocrSSOUser}/g; \
                         s/#appPackageUrls#/${cargoTrackerBlobUrl}/g; \
-                        s/#servicePrincipal#/${servicePrincipal}/g; \
                         s/#wdtRuntimePassword#/${wdtRuntimePassword}/g; \
                         s/#testbranchName#/${{ needs.preflight.outputs.testBranchNameForArtifactsLocation }}/g; \
                         s/#gitUserName#/${{ needs.preflight.outputs.gitUserNameForArtifactsLocation }}/g; \
                         s/#dbPassword#/${dbPassword}/g; \
                         s/#dbUser#/${dbAdminUser}@${{ needs.preflight.outputs.dbName }}/g; \
                         s/#dsConnectionURL#/jdbc:postgresql:\/\/${{ needs.preflight.outputs.dbName }}.postgres.database.azure.com:5432\/postgres/g" \
-                        weblogic-azure/weblogic-azure-aks/src/test/setupWlsAksParameters.json
+                        weblogic-azure/weblogic-azure-aks/src/test/setupWlsAksParameters.jsonc
             - name: Deploy WebLogic Server Cluster Domain offer
               id: deploy-wls-cluster
               uses: azure/CLI@v1
@@ -236,7 +232,7 @@ jobs:
                     --verbose \
                     --resource-group ${{ needs.preflight.outputs.resourceGroupForWlsAks }} \
                     --name wls-on-aks \
-                    --parameters @weblogic-azure/weblogic-azure-aks/src/test/setupWlsAksParameters.json \
+                    --parameters @weblogic-azure/weblogic-azure-aks/src/test/setupWlsAksParameters.jsonc \
                     --template-file ${artifactName}/mainTemplate.json
             - name: Query Application Gateway URL
               run: |

weblogic-azure-aks/pom.xml

@@ -17,7 +17,7 @@
 
   <groupId>com.oracle.weblogic.azure</groupId>
   <artifactId>wls-on-aks-azure-marketplace</artifactId>
-  <version>1.0.39</version>
+  <version>1.0.40</version>
 
   <parent>
     <groupId>com.microsoft.azure.iaas</groupId>