UAMI user experience improvement #177

galiacheng · 2022-07-19T02:40:09Z

Current offer requires customer to bring his own UAMI and Service Principal, which introduces extra effort before the deployment.

This pr is to improve the UAMI and SP experience by

Removing input for UAMI from basics blade and generating it automatically in the template.
Removing input for SP from networking blade and using Application Gateway Ingress Controller add-on

Besides, this pr enhances the offer with:

Supporting Azure CNI
Applying retry pattern for tools and files download

Test offer: Oracle WebLogic Server on the Azure Kubernetes Service

Follow up issue: #178

edburns · 2022-07-20T17:52:55Z

weblogic-azure-aks/src/main/bicep/mainTemplate.bicep

 var const_appGatewaySSLCertOptionHaveCert = 'haveCert'
 var const_appGatewaySSLCertOptionHaveKeyVault = 'haveKeyVault'
-var const_azureSubjectName = '${format('{0}.{1}.{2}', name_domainLabelforApplicationGateway, location, 'cloudapp.azure.com')}'
+var const_azcliVersion = '2.33.1'


Great job listing this as a top level constant and passing it down throughout the sub templates.

edburns · 2022-07-20T20:52:58Z

weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds_ensure_available_agic.bicep

+  identity: identity
+  properties: {
+    azCliVersion: azCliVersion
+    scriptContent: format('{0}\r\n\r\n{1}\r\n\r\n{2}',loadTextContent('../../../arm/scripts/common.sh'), loadTextContent('../../../arm/scripts/utility.sh'), loadTextContent('../../../arm/scripts/inline-scripts/enableAgic.sh'))


Clever. Is this something you think you should share with Alex Frankel?

edburns · 2022-07-20T22:58:32Z

weblogic-azure-aks/src/main/arm/scripts/createVMAndBuildImage.sh


 # Shell Global settings
-set -e #Exit immediately if a command exits with a non-zero status.
+set -Eeo pipefail #Exit immediately if a command exits with a non-zero status.


edburns · 2022-07-20T22:59:32Z

weblogic-azure-aks/src/main/arm/scripts/inline-scripts/enableAgic.sh

+}
+
+# Main script
+set -Eo pipefail


edburns

Shell scripts

.github/workflows/setupForWlsAks.sh
.github/workflows/teardownForWlsAks.sh

The workflow does not need to provide the UAMI or SP as inputs, so
it does not need to generate them. This simplifies the workflow significantly.

weblogic-azure-aks/src/main/arm/scripts/buildWLSDockerImage.sh
weblogic-azure-aks/src/main/arm/scripts/genImageModel.sh
weblogic-azure-aks/src/main/arm/scripts/setupWLSDomain.sh

Add retry to cURL invocations.

weblogic-azure-aks/src/main/arm/scripts/common.sh

Retry increases.

weblogic-azure-aks/src/main/arm/scripts/createAppGatewayIngress.sh

Account for passing of parameters.

weblogic-azure-aks/src/main/arm/scripts/createLbSvc.sh

Use environment variable naming style.

weblogic-azure-aks/src/main/arm/scripts/createVMAndBuildImage.sh

Add clean up of newly created resources required by the change to
handle UAMI and SP internal to the deployment.
Bash best practices.

weblogic-azure-aks/src/main/arm/scripts/inline-scripts/enableAgic.sh

New script to do the heavy lifting with the UAMI.

weblogic-azure-aks/src/main/arm/scripts/inline-scripts/validateParameters.sh

Remove repetitive declarations of several functions. They are
declared in utility.sh.
Remove declaration of validate_user_assigned_managed_identity and
validate_aks_network_plugin. They are unused.
Add retry to cURL invocations.

weblogic-azure-aks/src/main/arm/scripts/setupNetworking.sh

Use different technique for invoking scripts without passing
passwords in cleartext on command line.
Bash best practices.

weblogic-azure-aks/src/main/arm/scripts/utility.sh

utility_validate_status proper indenting.
Add retry capability to install_jdk.
Add install_docker, with retry capability.
Add retry capability to install_kubectl.
Add retry to cURL invocations.

Bicep files

weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-appgw-upload-trusted-root-certificate.bicep
weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-datasource-connection.bicep
weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-output-domain-configurations.bicep
weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-query-storage-account.bicep
weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-validate-parameters.bicep
weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds_query_available_private_ip_from_subnet.bicep
weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds_update-applications.bicep
weblogic-azure-aks/src/main/bicep/modules/_setupDBConnection.bicep
weblogic-azure-aks/src/main/bicep/modules/setupDBConnection.bicep
weblogic-azure-aks/src/main/bicep/modules/setupWebLogicCluster.bicep
weblogic-azure-aks/src/main/bicep/modules/updateWebLogicApplications.bicep
weblogic-azure-aks/src/main/bicep/modules/_azure-resoruces/_keyvault/_keyvaultWithNewCert.bicep
weblogic-azure-aks/src/main/bicep/modules/_azure-resoruces/_keyvaultForGateway.bicep
weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-create-wls-cluster.bicep
weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-datasource-connection.bicep

Avoid ttk failure regarding empty params.
Use azCliVersion from mainTemplate.bicep.

weblogic-azure-aks/src/main/bicep/mainTemplate.bicep

Remove UAMI parameter.
Remove Service Principal paremeter.
Numerous changes to implement feature.

weblogic-azure-aks/src/main/bicep/modules/_appGateway.bicep

Entirely new file, deploys app gateway without accepting UAMI as input.

weblogic-azure-aks/src/main/bicep/modules/_azure-resoruces/_aks.bicep

remove unused reference to aksClusterDefault.

weblogic-azure-aks/src/main/bicep/modules/_azure-resoruces/_appgateway.bicep

Called from src/main/bicep/modules/_appGateway.bicep to handle
different query cases necessary for making deployment decisions.

weblogic-azure-aks/src/main/bicep/modules/_azure-resoruces/_vnetAppGateway.bicep

Called from src/main/bicep/modules/_appGateway.bicep
Returns the vnet for the app gateway.

weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-create-networking.bicep

Avoid ttk failure regarding empty params.
Use azCliVersion from mainTemplate.bicep.
Invoke ds-networking-deployment.sh, passing env vars.

weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-validate-applications.bicep

Avoid ttk failure regarding empty params.
Use azCliVersion from mainTemplate.bicep.
Fix incorrect path to WLST script.

weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds_ensure_available_agic.bicep

New script to envoke enableAgic.sh.

weblogic-azure-aks/src/main/bicep/modules/_rolesAssignment/_agicRoleAssignment.bicep

Assign Resource Group Contributor role to User Assigned Managed Identity

weblogic-azure-aks/src/main/bicep/modules/_rolesAssignment/_roleAssignmentinSubscription.bicep

Assign subscription scope role to User Assigned Managed Identity

weblogic-azure-aks/src/main/bicep/modules/_uamiAndRoles.bicep

Invoke _roleAssignmentinSubscription.bicep

weblogic-azure-aks/src/main/bicep/modules/networking.bicep

Main bicep module for networking. This is where the hard work of
the entire networking tab happens.

JSON Config files

weblogic-azure-aks/src/test/setupWlsAksParameters.json

This file is used by CI/CD workflows. It allows the workflows to provide parameters when invoking the offer from the command line.
Remove parameters related to UAMI.

weblogic-azure-aks/src/main/arm/createUiDefinition.json

Repurpose existing info box on first pane. This info box was called
domainHomeSourceTypeExplainer and is now called
infoForBeforeDeployment. The text in the box has been expanded to
also clearly state what Azure RBAC roles are necessary in order to
successfully perform the deployment.
Remove the UAMI selector.
Temporarily hide the Configure frontend IP with private IP address
checkbox due to an existing Azure outage with an uncertain timeframe
for resolution. We will un-hide it when the outage is resolved.
Remove the service principal box in the App Gateway Ingress Controller section.
Necessary removals from the outputs section.

YML Config files

.github/workflows/testWlsAksWithDependencyCreation.yml
.github/workflows/testWlsAksWithoutDependencyCreation.yml

Remove service principal

… preconditions. Rather, they are dynamically created as needed, and cleaned up when done. .github/workflows/setupForWlsAks.sh .github/workflows/teardownForWlsAks.sh - The workflow does not need to provide the UAMI or SP as inputs, so it does not need to generate them. This simplifies the workflow significantly. weblogic-azure-aks/src/main/arm/scripts/buildWLSDockerImage.sh weblogic-azure-aks/src/main/arm/scripts/genImageModel.sh weblogic-azure-aks/src/main/arm/scripts/setupWLSDomain.sh - Add retry to cURL invocations. weblogic-azure-aks/src/main/arm/scripts/common.sh - Retry increases. weblogic-azure-aks/src/main/arm/scripts/createAppGatewayIngress.sh - Account for passing of parameters. weblogic-azure-aks/src/main/arm/scripts/createLbSvc.sh - Use environment variable naming style. weblogic-azure-aks/src/main/arm/scripts/createVMAndBuildImage.sh - Add clean up of newly created resources required by the change to handle UAMI and SP internal to the deployment. - Bash best practices. weblogic-azure-aks/src/main/arm/scripts/inline-scripts/enableAgic.sh - New script to do the heavy lifting with the UAMI. weblogic-azure-aks/src/main/arm/scripts/inline-scripts/validateParameters.sh - Remove repetitive declarations of several functions. They are declared in `utility.sh`. - Remove declaration of `validate_user_assigned_managed_identity` and `validate_aks_network_plugin`. They are unused. - Add retry to cURL invocations. weblogic-azure-aks/src/main/arm/scripts/setupNetworking.sh - Use different technique for invoking scripts without passing passwords in cleartext on command line. - Bash best practices. weblogic-azure-aks/src/main/arm/scripts/utility.sh - `utility_validate_status` proper indenting. - Add retry capability to `install_jdk`. - Add `install_docker`, with retry capability. - Add retry capability to `install_kubectl`. - Add retry to cURL invocations. weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-appgw-upload-trusted-root-certificate.bicep weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-datasource-connection.bicep weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-output-domain-configurations.bicep weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-query-storage-account.bicep weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-validate-parameters.bicep weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds_query_available_private_ip_from_subnet.bicep weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds_update-applications.bicep weblogic-azure-aks/src/main/bicep/modules/_setupDBConnection.bicep weblogic-azure-aks/src/main/bicep/modules/setupDBConnection.bicep weblogic-azure-aks/src/main/bicep/modules/setupWebLogicCluster.bicep weblogic-azure-aks/src/main/bicep/modules/updateWebLogicApplications.bicep weblogic-azure-aks/src/main/bicep/modules/_azure-resoruces/_keyvault/_keyvaultWithNewCert.bicep weblogic-azure-aks/src/main/bicep/modules/_azure-resoruces/_keyvaultForGateway.bicep weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-create-wls-cluster.bicep weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-datasource-connection.bicep - Avoid ttk failure regarding empty params. - Use `azCliVersion` from `mainTemplate.bicep`. weblogic-azure-aks/src/main/bicep/mainTemplate.bicep - Remove UAMI parameter. - Remove Service Principal paremeter. - Numerous changes to implement feature. weblogic-azure-aks/src/main/bicep/modules/_appGateway.bicep - Entirely new file, deploys app gateway without accepting UAMI as input. weblogic-azure-aks/src/main/bicep/modules/_azure-resoruces/_aks.bicep - remove unused reference to `aksClusterDefault`. weblogic-azure-aks/src/main/bicep/modules/_azure-resoruces/_appgateway.bicep - Called from `src/main/bicep/modules/_appGateway.bicep` to handle different query cases necessary for making deployment decisions. weblogic-azure-aks/src/main/bicep/modules/_azure-resoruces/_vnetAppGateway.bicep - Called from `src/main/bicep/modules/_appGateway.bicep` - Returns the vnet for the app gateway. weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-create-networking.bicep - Avoid ttk failure regarding empty params. - Use `azCliVersion` from `mainTemplate.bicep`. - Invoke `ds-networking-deployment.sh`, passing env vars. weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds-validate-applications.bicep - Avoid ttk failure regarding empty params. - Use `azCliVersion` from `mainTemplate.bicep`. - Fix incorrect path to WLST script. weblogic-azure-aks/src/main/bicep/modules/_deployment-scripts/_ds_ensure_available_agic.bicep - New script to envoke `enableAgic.sh`. weblogic-azure-aks/src/main/bicep/modules/_rolesAssignment/_agicRoleAssignment.bicep - Assign Resource Group Contributor role to User Assigned Managed Identity weblogic-azure-aks/src/main/bicep/modules/_rolesAssignment/_roleAssignmentinSubscription.bicep - Assign subscription scope role to User Assigned Managed Identity weblogic-azure-aks/src/main/bicep/modules/_uamiAndRoles.bicep - Invoke `_roleAssignmentinSubscription.bicep` weblogic-azure-aks/src/main/bicep/modules/networking.bicep - Main bicep module for networking. This is where the hard work of the entire networking tab happens. renamed: weblogic-azure-aks/src/test/setupWlsAksParameters.json -> weblogic-azure-aks/src/test/setupWlsAksParameters.jsonc According to Alex Frankel, > if it was only for someone maintaining the code in the future, why > not use a // style comment? You can use a .jsonc file which will > accept comments - This file is used by CI/CD workflows. It allows the workflows to provide parameters when invoking the offer from the command line. - Remove parameters related to UAMI. weblogic-azure-aks/src/main/arm/createUiDefinition.json - Repurpose existing info box on first pane. This info box was called `domainHomeSourceTypeExplainer` and is now called `infoForBeforeDeployment`. The text in the box has been expanded to also clearly state what Azure RBAC roles are necessary in order to successfully perform the deployment. - Remove the UAMI selector. - Temporarily hide the `Configure frontend IP with private IP address` checkbox due to an existing Azure outage with an uncertain timeframe for resolution. We will un-hide it when the outage is resolved. - Remove the service principal box in the App Gateway Ingress Controller section. - Necessary removals from the `outputs` section. .github/workflows/testWlsAksWithDependencyCreation.yml .github/workflows/testWlsAksWithoutDependencyCreation.yml - Remove service principal - Use passing arm-ttk version - Use .jsonc parameters file.

…ix to ttk version. modified: buildWlsAksArtifact.yml modified: testWlsAksWithDependencyCreation.yml modified: testWlsAksWithoutDependencyCreation.yml Signed-off-by: Ed Burns <edburns@microsoft.com>

galiacheng mentioned this pull request Jul 19, 2022

Assign User Access Administrator to az credential used in pipeline #178

Open

edburns reviewed Jul 20, 2022

View reviewed changes

weblogic-azure-aks/src/main/arm/scripts/inline-scripts/enableAgic.sh

}

# Main script

set -Eo pipefail

Copy link

Contributor

edburns Jul 20, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you.

edburns approved these changes Jul 20, 2022

View reviewed changes

edburns force-pushed the uami-improvement branch from 09c344a to 05c2739 Compare July 20, 2022 23:16

galiacheng force-pushed the uami-improvement branch from bf612ca to a6dd199 Compare July 21, 2022 07:31

edburns approved these changes Jul 21, 2022

View reviewed changes

edburns force-pushed the uami-improvement branch 2 times, most recently from c445b75 to cc82af3 Compare July 21, 2022 18:08

galiacheng and others added 2 commits July 22, 2022 14:48

On branch edburns-msft-1567401-test-wls-aks Fix incorrectly applied f…

ba21828

…ix to ttk version. modified: buildWlsAksArtifact.yml modified: testWlsAksWithDependencyCreation.yml modified: testWlsAksWithoutDependencyCreation.yml Signed-off-by: Ed Burns <edburns@microsoft.com>

edburns force-pushed the uami-improvement branch from 8cd72a8 to ba21828 Compare July 22, 2022 18:49

edburns approved these changes Jul 22, 2022

View reviewed changes

rjeberhard merged commit 3580664 into oracle:main Jul 22, 2022

galiacheng deleted the uami-improvement branch July 25, 2022 01:33

galiacheng mentioned this pull request Jul 25, 2022

remove input for UAMI and AGIC SP from aks user guide. oracle/weblogic-kubernetes-operator#3278

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

UAMI user experience improvement #177

UAMI user experience improvement #177

Uh oh!

galiacheng commented Jul 19, 2022 •

edited

Loading

Uh oh!

edburns Jul 20, 2022

Uh oh!

edburns Jul 20, 2022

Uh oh!

edburns Jul 20, 2022

Uh oh!

edburns Jul 20, 2022

Uh oh!

edburns left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

UAMI user experience improvement #177

UAMI user experience improvement #177

Uh oh!

Conversation

galiacheng commented Jul 19, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

edburns Jul 20, 2022

Choose a reason for hiding this comment

Uh oh!

edburns Jul 20, 2022

Choose a reason for hiding this comment

Uh oh!

edburns Jul 20, 2022

Choose a reason for hiding this comment

Uh oh!

edburns Jul 20, 2022

Choose a reason for hiding this comment

Uh oh!

edburns left a comment

Choose a reason for hiding this comment

Shell scripts

Bicep files

JSON Config files

YML Config files

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

galiacheng commented Jul 19, 2022 •

edited

Loading