Managed identity

examples/managed_identity/config.json

@@ -0,0 +1,55 @@
+{
+  "location": "variables.location",
+  "resource_group": "variables.resource_group",
+  "install_from": "headnode",
+  "admin_user": "hpcadmin",
+  "variables": {
+    "image": "OpenLogic:CentOS:7.6:latest",
+    "vm_type": "Standard_D4s_v3",
+    "location": "<NOT-SET>",
+    "resource_group": "<NOT-SET>"
+  },
+  "vnet": {
+    "name": "hpcvnet",
+    "address_prefix": "10.2.0.0/20",
+    "subnets": {
+      "hpc": "10.2.0.0/22"
+    }
+  },
+  "resources": {
+    "headnode": {
+      "type": "vm",
+      "public_ip": "true",
+      "vm_type": "Standard_D4s_v3",
+      "image": "variables.image",
+      "accelerated_networking": "true",
+      "managed_identity": {
+          "role": "contributor",
+          "scope": "resource_group"
+      }, 
+      "subnet": "hpc",
+      "tags": [
+        "disable-selinux",
+        "cndefault",
+        "azcli"
+        ]
+   }
+  },
+  "install": [
+     {
+       "script": "disable-selinux.sh",
+       "tag": "disable-selinux",
+       "sudo": true
+     },
+     {
+       "script": "cndefault.sh",
+       "tag": "cndefault",
+       "sudo": true
+     },
+     {
+       "script": "install-azcli.sh",
+       "tag": "azcli",
+       "sudo": true
+     }
+  ]
+}

examples/managed_identity/readme.md

@@ -0,0 +1,5 @@
+== Managed Identity
+
+This config file sets up a headnode that has a managed identity configured, which has contributer access to the resource group.
+With the install az-cli, it can create and delete resources without requiring additional authentication/authorization.
+To use the az cli, start by log in using "az login -i".

pyazhpc/arm.py

@@ -394,6 +394,7 @@ def _add_vm(self, cfg, r):
         rstoragesku = res.get("storage_sku", "StandardSSD_LRS")
         rstoragecache = res.get("storage_cache", "ReadWrite")
         rtags = res.get("resource_tags", {})
+        rmanagedidentity = res.get("managed_identity", None)
         loc = cfg["location"]
         ravset = res.get("availability_set", False)
         adminuser = cfg["admin_user"]
@@ -573,6 +574,44 @@ def _add_vm(self, cfg, r):
                     "id": f"[resourceId('Microsoft.Compute/availabilitySets','{rorig}')]"
                 }
 
+            if rmanagedidentity is not None:
+                vmres["identity"] = {
+                    "type": "SystemAssigned"
+                }
+
+                role_lookup = {
+                    "reader": "[resourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                    "contributor": "[resourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                    "owner": "[resourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]"
+                }
+                role = rmanagedidentity.get("role", "reader")
+                if role not in role_lookup:
+                    log.error(f"{role} is an invalid role for a managed identity (options are: {', '.join(role_lookup.keys())})")
+                    sys.exit(1)
+
+                scope_lookup = {
+                    "resource_group": "[resourceGroup().id]",
+                    "subscription": "[subscription().subscriptionId]"
+                }
+                scope = rmanagedidentity.get("scope", "resource_group")
+                if scope not in scope_lookup:
+                    log.error(f"{scope} is an invalid scope for a managed identity (options are: {', '.join(scope_lookup.keys())})")
+                    sys.exit(1)
+
+                self.resources.append({
+                    "apiVersion": "2017-09-01",
+                    "type": "Microsoft.Authorization/roleAssignments",
+                    "name": f"[guid(subscription().subscriptionId, resourceGroup().id, '{r}')]",
+                    "properties": {
+                        "roleDefinitionId": role_lookup[role],
+                        "principalId": f"[reference('{r}', '2017-12-01', 'Full').identity.principalId]",
+                        "scope": scope_lookup[scope]
+                    },
+                    "dependsOn": [
+                        f"[resourceId('Microsoft.Compute/virtualMachines/', '{r}')]"
+                    ]
+                })
+
             self.resources.append(vmres)
 
     def _add_vmss(self, cfg, r):