Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[DO NOT MERGE] Az.StorageSync - Allow Migration with no servers #25957

Merged
merged 8 commits into from
Oct 8, 2024
Merged

[DO NOT MERGE] Az.StorageSync - Allow Migration with no servers #25957

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
ecdc436
Turn EnableMIChecking false in Az.StorageSync
ankushbindlish2 Aug 28, 2024
5d7ad84
Update ChangeLog.md
ankushbindlish2 Aug 28, 2024
f451d6b
Allow no servers scenario
ankushbindlish2 Aug 28, 2024
5d88119
Make GetMiConfigurationStatus fault tolerant and set to default values
ankushbindlish2 Sep 4, 2024
f30aa2a
Enable ApplicationId in RegisterServer
ankushbindlish2 Sep 4, 2024
1840745
merge
ankushbindlish2 Sep 4, 2024
513fd19
Optimize CEP provisioning for 2 min sleep
ankushbindlish2 Oct 4, 2024
a37a4e7
Set EnableMIChecking true
ankushbindlish2 Oct 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/StorageSync/StorageSync.Test/Common/MockSyncServerRegistrationClientBase.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ namespace Commands.StorageSync.Interop.Clients
/// <seealso cref="Commands.StorageSync.Interop.Interfaces.ISyncServerRegistration" />
public abstract class MockSyncServerRegistrationClientBase : ISyncServerRegistration
{
public bool EnableMIChecking { get; protected set; } = false; // enable it in v20 azure file sync agent
public bool EnableMIChecking { get; protected set; } = true;

/// <summary>
/// The m is disposed
Expand Down
2 changes: 2 additions & 0 deletions src/StorageSync/StorageSync/ChangeLog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,8 @@
- Additional information about change #1
-->
## Upcoming Release
* Fixed the bug in server registration
* Improved the error message for Set-AzStorageSyncServiceIdentity cmdlet

## Version 2.3.1
* Fixed the bug in server registration
Expand Down
6 changes: 3 additions & 3 deletions src/StorageSync/StorageSync/CloudEndpoint/NewCloudEndpointCommand.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -256,17 +256,17 @@ public override void ExecuteCmdlet()
{
// Identity , RoleDef, Scope
var scope = StorageAccountResourceId;
var identityRoleAssignmentForSAScope = StorageSyncClientWrapper.EnsureRoleAssignmentWithIdentity(storageAccountResourceIdentifier.Subscription,
StorageSyncClientWrapper.EnsureRoleAssignmentWithIdentity(storageAccountResourceIdentifier.Subscription,
storageSyncService.Identity.PrincipalId.Value,
Common.StorageSyncClientWrapper.StorageAccountContributorRoleDefinitionId,
scope);

scope = $"{StorageAccountResourceId}/fileServices/default/fileshares/{AzureFileShareName}";
var identityRoleAssignmentForFilsShareScope = StorageSyncClientWrapper.EnsureRoleAssignmentWithIdentity(storageAccountResourceIdentifier.Subscription,
(var identityRoleAssignmentForFilsShareScope , bool alreadyExists) = StorageSyncClientWrapper.EnsureRoleAssignmentWithIdentity(storageAccountResourceIdentifier.Subscription,
storageSyncService.Identity.PrincipalId.Value,
Common.StorageSyncClientWrapper.StorageFileDataPrivilegedContributorRoleDefinitionId,
scope);
shouldSleep = true;
shouldSleep = !alreadyExists;
}

Target = string.Join("/", resourceGroupName, storageSyncServiceName, syncGroupName, Name);
Expand Down
4 changes: 2 additions & 2 deletions src/StorageSync/StorageSync/CloudEndpoint/SetCloudEndpointPermissionCommand.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,13 +161,13 @@ public override void ExecuteCmdlet()
var storageAccountResourceIdentifier = new ResourceIdentifier(cloudEndpoint.StorageAccountResourceId);
// Identity , RoleDef, Scope
var scope = cloudEndpoint.StorageAccountResourceId;
var identityRoleAssignmentForSAScope = StorageSyncClientWrapper.EnsureRoleAssignmentWithIdentity(storageAccountResourceIdentifier.Subscription,
StorageSyncClientWrapper.EnsureRoleAssignmentWithIdentity(storageAccountResourceIdentifier.Subscription,
storageSyncService.Identity.PrincipalId.Value,
Common.StorageSyncClientWrapper.StorageAccountContributorRoleDefinitionId,
scope);

scope = $"{cloudEndpoint.StorageAccountResourceId}/fileServices/default/fileshares/{cloudEndpoint.AzureFileShareName}";
var identityRoleAssignmentForFilsShareScope = StorageSyncClientWrapper.EnsureRoleAssignmentWithIdentity(storageAccountResourceIdentifier.Subscription,
StorageSyncClientWrapper.EnsureRoleAssignmentWithIdentity(storageAccountResourceIdentifier.Subscription,
storageSyncService.Identity.PrincipalId.Value,
Common.StorageSyncClientWrapper.StorageFileDataPrivilegedContributorRoleDefinitionId,
scope);
Expand Down
16 changes: 9 additions & 7 deletions src/StorageSync/StorageSync/Common/StorageSyncClientWrapper.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -393,7 +393,7 @@ public bool DeleteRoleAssignmentWithIdentity(string storageAccountSubscriptionId
/// <param name="roleDefinitionId">Role definition id</param>
/// <param name="scope">Scope</param>
/// <returns>Role Assignment</returns>
public RoleAssignment EnsureRoleAssignmentWithIdentity(string storageAccountSubscriptionId, Guid principalId, string roleDefinitionId, string scope)
public (RoleAssignment,bool) EnsureRoleAssignmentWithIdentity(string storageAccountSubscriptionId, Guid principalId, string roleDefinitionId, string scope)
{
if(principalId == Guid.Empty)
{
Expand All @@ -413,13 +413,13 @@ public RoleAssignment EnsureRoleAssignmentWithIdentity(string storageAccountSubs
var resourceIdentifier = new ResourceIdentifier(scope);
string roleDefinitionScope = $"/subscriptions/{storageAccountSubscriptionId}";
RoleDefinition roleDefinition = AuthorizationManagementClient.RoleDefinitions.Get(roleDefinitionScope, roleDefinitionId);
VerboseLogger.Invoke($"Creating role assignment for Identity {principalId} RoleDef:{roleDefinition.Name} ({roleDefinition.RoleName}) and Scope: {scope}");
VerboseLogger.Invoke($"Creating role assignment for Identity {principalId} RoleDef:{roleDefinition.Name} ({roleDefinition.RoleName}) and Scope: {scope}");

var serverPrincipalId = principalId.ToString();


var resourceType = string.Empty;
if(!string.IsNullOrEmpty(resourceIdentifier.ParentResource))
if (!string.IsNullOrEmpty(resourceIdentifier.ParentResource))
{
resourceType = $"{resourceIdentifier.ParentResource}/";
}
Expand All @@ -438,7 +438,7 @@ public RoleAssignment EnsureRoleAssignmentWithIdentity(string storageAccountSubs
Guid roleAssignmentId = StorageSyncResourceManager.GetGuid();
RoleAssignment roleAssignment = roleAssignments.FirstOrDefault(r => r.PrincipalId == serverPrincipalId &&
string.Equals(r.RoleDefinitionId, roleDefinition.Id, StringComparison.OrdinalIgnoreCase));

bool alreadyExists;
if (roleAssignment == null)
{
VerboseLogger.Invoke(StorageSyncResources.CreateRoleAssignmentMessage);
Expand All @@ -450,15 +450,17 @@ public RoleAssignment EnsureRoleAssignmentWithIdentity(string storageAccountSubs
roleAssignment = AuthorizationManagementClient.RoleAssignments.Create(roleAssignmentScope, roleAssignmentId.ToString(), createParameters);
StorageSyncResourceManager.Wait();
VerboseLogger.Invoke($"Successfully created role assignment {roleAssignment.Id}");
alreadyExists = false;
}
else
{
VerboseLogger.Invoke($"Role assignment already exists {roleAssignment.Id}");
alreadyExists = true;
}

return roleAssignment;
return (roleAssignment, alreadyExists);
}
catch(Exception ex)
catch (Exception ex)
{
VerboseLogger.Invoke($"Failed to create role assignment with exception {ex.Message}. Please create role assignment using troubleshooting documents.");
throw;
Expand Down
2 changes: 1 addition & 1 deletion src/StorageSync/StorageSync/Interfaces/IStorageSyncClientWrapper.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,7 +103,7 @@ public interface IStorageSyncClientWrapper
/// <param name="roleDefinitionId">Role definition id</param>
/// <param name="scope">Scope</param>
/// <returns>Role Assignment</returns>
RoleAssignment EnsureRoleAssignmentWithIdentity(string storageAccountSubscriptionId, Guid principalId, string roleDefinitionId, string scope);
(RoleAssignment, bool) EnsureRoleAssignmentWithIdentity(string storageAccountSubscriptionId, Guid principalId, string roleDefinitionId, string scope);

/// <summary>
/// This function will try to delete role assignment if it exists.
Expand Down
11 changes: 3 additions & 8 deletions src/StorageSync/StorageSync/Interop/ManagedIdentity/ServerManagedIdentityProvider.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ public class ServerManagedIdentityProvider : IServerManagedIdentityProvider , ID

public ServerManagedIdentityProvider(Action<string, EventLevel> traceLog = null)
{
EnableMIChecking = false;
EnableMIChecking = true;
this.TraceLog = new Action<string, EventLevel>((message, e) => {
if (traceLog != null)
{
Expand All @@ -42,12 +42,6 @@ public ServerManagedIdentityProvider(Action<string, EventLevel> traceLog = null)
public LocalServerType GetServerType(IEcsManagement ecsManagement)
{
TraceLog($"{nameof(EnableMIChecking)} is {EnableMIChecking}.", EventLevel.Informational);

// TODO: this should be removed once MI is fully functional
if (!EnableMIChecking)
{
return LocalServerType.HybridServer;
}
ManagedIdentityConfigurationInfo serverInfo = GetManagedIdentityConfigurationStatus(ecsManagement);
return serverInfo.ServerType;
}
Expand Down Expand Up @@ -135,7 +129,8 @@ private ManagedIdentityConfigurationInfo GetManagedIdentityConfigurationStatus(I
catch (Exception ex)
{
TraceLog(ex.ToString(), EventLevel.Error);
throw;
//throw;
serverInfo = new ManagedIdentityConfigurationInfo(LocalServerType.HybridServer, RegisteredServerAuthType.Certificate);
}

return serverInfo;
Expand Down
3 changes: 1 addition & 2 deletions src/StorageSync/StorageSync/RegisteredServer/RegisterServerCommand.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -227,8 +227,7 @@ private RegisteredServer CreateRegisteredResourceInCloud(string resourceGroupNam
ClusterId = serverRegistrationData.ClusterId.ToString(),
ClusterName = serverRegistrationData.ClusterName,
AgentVersion = serverRegistrationData.AgentVersion,
//ApplicationId = serverRegistrationData.ApplicationId.HasValue ? serverRegistrationData.ApplicationId.Value.ToString() : null,
ApplicationId = Guid.Empty.ToString(),
ApplicationId = serverRegistrationData.ApplicationId.HasValue ? serverRegistrationData.ApplicationId.Value.ToString() : Guid.Empty.ToString(),
ServerCertificate = serverRegistrationData.ServerCertificate != null ? Convert.ToBase64String(serverRegistrationData.ServerCertificate) : null,
ServerOSVersion = serverRegistrationData.ServerOSVersion,
ServerRole = serverRegistrationData.ServerRole.ToString(),
Expand Down
2 changes: 1 addition & 1 deletion src/StorageSync/StorageSync/ServerEndpoint/NewServerEndpointCommand.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -319,7 +319,7 @@ public override void ExecuteCmdlet()
}
var storageAccountResourceIdentifier = new ResourceIdentifier(cloudEndpoint.StorageAccountResourceId);
var scope = $"{cloudEndpoint.StorageAccountResourceId}/fileServices/default/fileshares/{cloudEndpoint.AzureFileShareName}";
var identityRoleAssignmentForFilsShareScope = StorageSyncClientWrapper.EnsureRoleAssignmentWithIdentity(storageAccountResourceIdentifier.Subscription,
StorageSyncClientWrapper.EnsureRoleAssignmentWithIdentity(storageAccountResourceIdentifier.Subscription,
serverIdentityGuid,
Common.StorageSyncClientWrapper.StorageFileDataPrivilegedContributorRoleDefinitionId,
scope);
Expand Down
2 changes: 1 addition & 1 deletion src/StorageSync/StorageSync/ServerEndpoint/SetServerEndpointCommandPermission.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,7 +232,7 @@ public override void ExecuteCmdlet()
}
var storageAccountResourceIdentifier = new ResourceIdentifier(cloudEndpoint.StorageAccountResourceId);
var scope = $"{cloudEndpoint.StorageAccountResourceId}/fileServices/default/fileshares/{cloudEndpoint.AzureFileShareName}";
var identityRoleAssignmentForFilsShareScope = StorageSyncClientWrapper.EnsureRoleAssignmentWithIdentity(storageAccountResourceIdentifier.Subscription,
StorageSyncClientWrapper.EnsureRoleAssignmentWithIdentity(storageAccountResourceIdentifier.Subscription,
serverIdentityGuid,
Common.StorageSyncClientWrapper.StorageFileDataPrivilegedContributorRoleDefinitionId,
scope);
Expand Down
11 changes: 3 additions & 8 deletions src/StorageSync/StorageSync/StorageSyncService/SetStorageSyncServiceIdentityCommand.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,11 +187,6 @@ public override void ExecuteCmdlet()
}
}

if(candidateServersLookup.Count == 0)
{
throw new PSArgumentException("No server found which can be configured to use a managed identity.");
}

StorageSyncClientWrapper.VerboseLogger.Invoke($"Found {candidateServersLookup.Count} servers out of {registeredServers.Count(s => s.ServerRole != ServerRoleType.ClusterName.ToString())} total servers to migrate");

// 2. Set System Assigned managed identity to Storage Sync service
Expand Down Expand Up @@ -239,13 +234,13 @@ public override void ExecuteCmdlet()

// Identity , RoleDef, Scope
var scope = cloudEndpoint.StorageAccountResourceId;
var identityRoleAssignmentForSAScope = StorageSyncClientWrapper.EnsureRoleAssignmentWithIdentity(storageAccountResourceIdentifier.Subscription,
StorageSyncClientWrapper.EnsureRoleAssignmentWithIdentity(storageAccountResourceIdentifier.Subscription,
storageSyncService.Identity.PrincipalId.Value,
Common.StorageSyncClientWrapper.StorageAccountContributorRoleDefinitionId,
scope);

scope = $"{cloudEndpoint.StorageAccountResourceId}/fileServices/default/fileshares/{cloudEndpoint.AzureFileShareName}";
var identityRoleAssignmentForFilsShareScope = StorageSyncClientWrapper.EnsureRoleAssignmentWithIdentity(storageAccountResourceIdentifier.Subscription,
StorageSyncClientWrapper.EnsureRoleAssignmentWithIdentity(storageAccountResourceIdentifier.Subscription,
storageSyncService.Identity.PrincipalId.Value,
Common.StorageSyncClientWrapper.StorageFileDataPrivilegedContributorRoleDefinitionId,
scope);
Expand Down Expand Up @@ -279,7 +274,7 @@ public override void ExecuteCmdlet()
}
// Identity , RoleDef, Scope
scope = $"{cloudEndpoint.StorageAccountResourceId}/fileServices/default/fileshares/{cloudEndpoint.AzureFileShareName}";
identityRoleAssignmentForFilsShareScope = StorageSyncClientWrapper.EnsureRoleAssignmentWithIdentity(storageAccountResourceIdentifier.Subscription,
StorageSyncClientWrapper.EnsureRoleAssignmentWithIdentity(storageAccountResourceIdentifier.Subscription,
applicationGuid,
Common.StorageSyncClientWrapper.StorageFileDataPrivilegedContributorRoleDefinitionId,
scope);
Expand Down