implementation of MISE middleware

Azure · Jul 18, 2024 · 51130b5 · 51130b5
1 parent ce31826
commit 51130b5
Show file tree

Hide file tree

Showing 17 changed files with 903 additions and 24 deletions.
diff --git a/pkg/deploy/assets/rp-production-parameters.json b/pkg/deploy/assets/rp-production-parameters.json
@@ -75,6 +75,9 @@
         "fpServicePrincipalId": {
             "value": ""
         },
+        "fpTenantId": {
+            "value": ""
+        },
         "gatewayDomains": {
             "value": ""
         },
@@ -99,6 +102,21 @@
         "mdsdEnvironment": {
             "value": ""
         },
+        "miseAddress": {
+            "value": "http://localhost:5000"
+        },
+        "miseAllowedHosts": {
+            "value": "*"
+        },
+        "miseLogLevel": {
+            "value": "Information"
+        },
+        "miseValidAppIDs": {
+            "value": ""
+        },
+        "miseValidAudiences": {
+            "value": ""
+        },
         "nonZonalRegions": {
             "value": [
                 "eastasia",

diff --git a/pkg/deploy/assets/rp-production.json b/pkg/deploy/assets/rp-production.json
diff --git a/pkg/deploy/config.go b/pkg/deploy/config.go
@@ -63,6 +63,7 @@ type Configuration struct {
 	ExtraServiceKeyvaultAccessPolicies []interface{}          `json:"extraServiceKeyvaultAccessPolicies,omitempty" value:"required"`
 	FluentbitImage                     *string                `json:"fluentbitImage,omitempty" value:"required"`
 	FPClientID                         *string                `json:"fpClientId,omitempty" value:"required"`
+	FPTENANTID                         *string                `json:"fpTenantId,omitempty" value:"required"`
 	FPServerCertCommonName             *string                `json:"fpServerCertCommonName,omitempty"`
 	FPServicePrincipalID               *string                `json:"fpServicePrincipalId,omitempty" value:"required"`
 	GatewayDomains                     []string               `json:"gatewayDomains,omitempty"`
@@ -78,6 +79,11 @@ type Configuration struct {
 	KeyvaultPrefix                     *string                `json:"keyvaultPrefix,omitempty" value:"required"`
 	MDMFrontendURL                     *string                `json:"mdmFrontendUrl,omitempty" value:"required"`
 	MDSDEnvironment                    *string                `json:"mdsdEnvironment,omitempty" value:"required"`
+	MISELOGLEVEL                       *string                `json:"miseLogLevel,omitempty"`
+	MISEADDRESS                        *string                `json:"miseAddress,omitempty"`
+	MISEALLOWEDHOSTS                   *string                `json:"miseAllowedHosts,omitempty"`
+	MISEVALIDAUDIENCES                 []string               `json:"miseValidAudiences,omitempty"`
+	MISEVALIDAPPIDs                    []string               `json:"miseValidAppIDs,omitempty"`
 	NonZonalRegions                    []string               `json:"nonZonalRegions,omitempty"`
 	PortalAccessGroupIDs               []string               `json:"portalAccessGroupIds,omitempty" value:"required"`
 	PortalClientID                     *string                `json:"portalClientId,omitempty" value:"required"`

diff --git a/pkg/deploy/devconfig.go b/pkg/deploy/devconfig.go
@@ -146,6 +146,7 @@ func DevConfig(_env env.Core) (*Config, error) {
 			},
 			FluentbitImage:       to.StringPtr(version.FluentbitImage(os.Getenv("USER") + "aro." + _env.Environment().ContainerRegistryDNSSuffix)),
 			FPClientID:           to.StringPtr(os.Getenv("AZURE_FP_CLIENT_ID")),
+			FPTENANTID:           to.StringPtr(os.Getenv("AZURE_TENANT_ID")),
 			FPServicePrincipalID: to.StringPtr(os.Getenv("AZURE_FP_SERVICE_PRINCIPAL_ID")),
 			GatewayDomains: []string{
 				"eastus-shared.ppe.warm.ingest.monitor.core.windows.net",
@@ -167,6 +168,17 @@ func DevConfig(_env env.Core) (*Config, error) {
 			GlobalSubscriptionID:        to.StringPtr(_env.SubscriptionID()),
 			MDMFrontendURL:              to.StringPtr("https://global.ppe.microsoftmetrics.com/"),
 			MDSDEnvironment:             to.StringPtr(version.DevGenevaLoggingEnvironment),
+			MISELOGLEVEL:                to.StringPtr("Information"),
+			MISEADDRESS:                 to.StringPtr("http://localhost:5000"),
+			MISEALLOWEDHOSTS:            to.StringPtr("*"),
+			MISEVALIDAUDIENCES: []string{
+				"https://management.core.windows.net/",
+				_env.Environment().ResourceManagerEndpoint,
+			},
+			MISEVALIDAPPIDs: []string{
+				"2187cde1-7e28-4645-9104-19edfa500053",
+				"2187cde1-7e28-4645-9104-19edfa500052",
+			},
 			PortalAccessGroupIDs: []string{
 				os.Getenv("AZURE_PORTAL_ACCESS_GROUP_IDS"),
 			},
@@ -183,6 +195,7 @@ func DevConfig(_env env.Core) (*Config, error) {
 				"DisableReadinessDelay",
 				"EnableOCMEndpoints",
 				"RequireOIDCStorageWebEndpoint",
+				"EnableMISE",
 			},
 			// TODO update this to support FF
 			RPImagePrefix:                     to.StringPtr(os.Getenv("USER") + "aro.azurecr.io/aro"),

diff --git a/pkg/deploy/generator/resources_rp.go b/pkg/deploy/generator/resources_rp.go
@@ -376,6 +376,7 @@ func (g *generator) rpVMSS() *arm.Resource {
 		"databaseAccountName",
 		"fluentbitImage",
 		"fpClientId",
+		"fpTenantId",
 		"fpServicePrincipalId",
 		"gatewayDomains",
 		"gatewayResourceGroupName",
@@ -384,6 +385,9 @@ func (g *generator) rpVMSS() *arm.Resource {
 		"keyvaultPrefix",
 		"mdmFrontendUrl",
 		"mdsdEnvironment",
+		"miseLogLevel",
+		"miseAddress",
+		"miseAllowedHosts",
 		"portalAccessGroupIds",
 		"portalClientId",
 		"portalElevatedGroupIds",
@@ -409,6 +413,18 @@ func (g *generator) rpVMSS() *arm.Resource {
 		)
 	}
 
+	// convert array variables to string using ARM string() function to be passed via customScript later
+	for _, variable := range []string{
+		"miseValidAudiences",
+		"miseValidAppIDs",
+	} {
+		parts = append(parts,
+			fmt.Sprintf("'%s=$(base64 -d <<<'''", strings.ToUpper(variable)),
+			fmt.Sprintf("base64(string(parameters('%s')))", variable),
+			"''')\n'",
+		)
+	}
+
 	for _, variable := range []string{
 		"adminApiCaBundle",
 		"armApiCaBundle",
@@ -424,6 +440,14 @@ func (g *generator) rpVMSS() *arm.Resource {
 		"'MDMIMAGE=''"+version.MdmImage("")+"''\n'",
 	)
 
+	parts = append(parts,
+		"'OTELIMAGE=''"+version.OTelImage("")+"''\n'",
+	)
+
+	parts = append(parts,
+		"'MISEIMAGE=''"+version.MiseImage("")+"''\n'",
+	)
+
 	parts = append(parts,
 		"'LOCATION=$(base64 -d <<<'''",
 		"base64(resourceGroup().location)",