FilesExpand file tree

main

/

configure_azure_setup.go

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

120 lines (107 loc) · 4.38 KB

main

/

configure_azure_setup.go

Copy path

Top

File metadata and controls

• Code
• Blame

120 lines (107 loc) · 4.38 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

package main

import (

"bufio"

"context"

"fmt"

"time"

"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armsubscriptions"

)

// runAzureSetupCommands guides the operator through the Azure setup wizard.

//

// Step 1 (az login): performed via the Azure CLI. "az login" launches an

// interactive browser-based OAuth flow that cannot be replicated through the

// SDK on behalf of a human operator who does not yet have a credential. This

// is the only CLI call retained in this wizard.

//

// Step 2 (list subscriptions): performed via the ARM Subscriptions SDK using

// the Azure CLI credential, which reuses the session that "az login" just

// established. Fails loud if the SDK cannot authenticate (no CLI fallback).

//

// Step 3 (create service principal): performed via the Microsoft Graph SDK

// (application + service principal + password credential) and armauthorization

// (resolve the "Reservations Administrator" role definition and assign it at

// subscription scope). This is the create-for-rbac equivalent and fails loud

// on any SDK error.

//

// It returns the created service principal's credentials (nil when Step 3 was

// skipped) so the caller can store them without echoing the secret.

func runAzureSetupCommands(ctx context.Context, reader *bufio.Reader) (*AzureCredentials, error) {

if err := azureStepLogin(reader); err != nil {

return nil, err

}

subscriptionID, err := azureStepListSubscriptions(ctx, reader)

if err != nil {

return nil, err

}

return azureStepCreateServicePrincipal(ctx, reader, subscriptionID)

}

// azureStepLogin prompts to run "az login".

func azureStepLogin(reader *bufio.Reader) error {

fmt.Println("Step 1: Azure Login")

fmt.Println("-------------------")

fmt.Println("This will open a browser window for Azure authentication.")

fmt.Println()

return promptAndRunExplicitCommand(reader, "Azure Login", "az login", "az", "login")

}

// listAzureSubscriptionsWithTimeout runs the SDK subscription listing under a

// bounded timeout so a hung ARM call cannot stall the wizard.

func listAzureSubscriptionsWithTimeout(ctx context.Context) error {

listCtx, cancel := context.WithTimeout(ctx, 30*time.Second)

defer cancel()

return listAzureSubscriptions(listCtx)

}

// azureStepListSubscriptions optionally lists subscriptions via SDK and prompts

// the operator to enter their subscription ID. The listing is behind a

// [R]un/[S]kip prompt so an operator who already knows their subscription ID

// can proceed even if the SDK listing would fail; when RUN it fails loud (no

// CLI fallback), instructing the operator to run "az login" first.

func azureStepListSubscriptions(ctx context.Context, reader *bufio.Reader) (string, error) {

fmt.Println()

fmt.Println("Step 2: Get Subscription ID")

fmt.Println("---------------------------")

run, err := promptRunOrSkipListing(reader, "the Azure subscription listing (via SDK)")

if err != nil {

return "", err

}

if run {

fmt.Println("Listing your Azure subscriptions via SDK (Azure CLI credential)...")

fmt.Println()

if err = listAzureSubscriptionsWithTimeout(ctx); err != nil {

return "", fmt.Errorf("failed to list Azure subscriptions via SDK: %w\n"+

"Ensure you are authenticated: run 'az login' (Step 1) before continuing", err)

}

fmt.Println()

}

fmt.Print("Enter your Subscription ID: ")

subscriptionID, err := readTrimmedLine(reader)

if err != nil {

return "", fmt.Errorf("failed to read subscription ID: %w", err)

}

if subscriptionID == "" {

return "", fmt.Errorf("subscription ID is required")

}

if err := validateAzureUUID(subscriptionID, "Subscription ID"); err != nil {

return "", err

}

return subscriptionID, nil

}

// resolveAzureTenantID looks up the tenant ID for the given subscription via

// the ARM Subscriptions SDK, using the Azure CLI ("az login") credential.

func resolveAzureTenantID(ctx context.Context, subscriptionID string) (string, error) {

cred, err := newAzureWizardCredential()

if err != nil {

return "", err

}

client, err := armsubscriptions.NewClient(cred, nil)

if err != nil {

return "", fmt.Errorf("failed to create subscriptions client: %w", err)

}

resp, err := client.Get(ctx, subscriptionID, nil)

if err != nil {

return "", fmt.Errorf("failed to get subscription %s: %w", subscriptionID, err)

}

if resp.TenantID == nil || *resp.TenantID == "" {

return "", fmt.Errorf("subscription %s returned no tenant ID", subscriptionID)

}

return *resp.TenantID, nil

}