Lock prod resources (#1100)

* secrets * add resource-group to query * check if scope is right for role
equinor · Nov 22, 2023 · e2c5202 · e2c5202
1 parent 0d9db52
commit e2c5202
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 2 deletions.
diff --git a/.github/workflows/lock-resources.yml b/.github/workflows/lock-resources.yml
@@ -7,6 +7,7 @@ on:
 permissions:
   id-token: write
   contents: read
+
 jobs:
   lock-clusters-prod:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/scripts/check_resource_lock.sh b/.github/workflows/scripts/check_resource_lock.sh
@@ -37,7 +37,7 @@ SLACK_WEBHOOK_URL="$(az keyvault secret show \
     --name "${KV_SECRET_SLACK_WEBHOOK}" \
     --subscription "${AZ_SUBSCRIPTION_ID}" |
     jq -r .value)"
-CLUSTERS=$(az aks list --output json | jq '{k8s:[.[] | {name: .name, resourceGroup: .resourceGroup, id: .id}]}')
+CLUSTERS=$(az aks list --resource-group "${AZ_RESOURCE_GROUP_CLUSTERS}" --output json | jq '{k8s:[.[] | {name: .name, resourceGroup: .resourceGroup, id: .id}]}')
 
 createLock() {
     local NAME=$1

diff --git a/scripts/service-principals-and-aad-apps/lib_managed_identity.sh b/scripts/service-principals-and-aad-apps/lib_managed_identity.sh
@@ -128,7 +128,7 @@ function assign_role() {
         --assignee "${id}" \
         --subscription "${AZ_SUBSCRIPTION_ID}" \
         --all \
-        --query "[?roleDefinitionName=='${role_name}']" \
+        --query "[?roleDefinitionName=='${role_name}' && scope=='${scope}']" \
         --output tsv 2>/dev/null)"
 
     printf "Assigning \"%s\" to \"%s\"... " "${role_name}" "${id_name}"