Skip to content

Commit 8683052

Browse files
leggetterleggetter
authored
Merge pull request #457 from hookdeck/chore/azure-script-updates
chore(azure): add diagnostics-clean script and enhance diagnostics.sh…
2 parents 3ba0d61 + b3b469b commit 8683052

File tree

4 files changed

+158
-8
lines changed

4 files changed

+158
-8
lines changed

‎examples/azure/dependencies.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ if ! az redis show --name "$REDIS_NAME" --resource-group "$RESOURCE_GROUP" &>/de
9494
--location "$LOCATION" \
9595
--sku Basic \
9696
--vm-size c0
97-
--enable-non-ssl-port # Comment out or remove if you only want SSL
97+
--enable-non-ssl-port \ # Comment out or remove if you only want SSL
9898
else
9999
echo "✅ Redis instance already exists"
100100
fi

‎examples/azure/diagnostics-clean.sh‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
#!/bin/bash
2+
3+
set -euo pipefail
4+
5+
# Argument parsing
6+
RUN_LOCAL=false
7+
RUN_AZURE=false
8+
9+
if [ "$#" -eq 0 ]; then
10+
RUN_LOCAL=true
11+
RUN_AZURE=true
12+
else
13+
while [[ "$#" -gt 0 ]]; do
14+
case $1 in
15+
--local)
16+
RUN_LOCAL=true
17+
shift
18+
;;
19+
--azure)
20+
RUN_AZURE=true
21+
shift
22+
;;
23+
*)
24+
shift
25+
;;
26+
esac
27+
done
28+
fi
29+
30+
# Environment files
31+
ENV_FILES=(".env.outpost" ".env.runtime")
32+
33+
# Check and load environment files
34+
for ENV_FILE in "${ENV_FILES[@]}"; do
35+
if [ ! -f "$ENV_FILE" ]; then
36+
echo "❌ $ENV_FILE not found. Please run your deploy script first."
37+
exit 1
38+
fi
39+
echo "📄 Loading environment variables from $ENV_FILE..."
40+
set -a; source "$ENV_FILE"; set +a
41+
done
42+
43+
# Required variables
44+
REQUIRED_VARS=(
45+
API_KEY
46+
RESOURCE_GROUP
47+
)
48+
49+
echo "🔍 Validating required environment variables..."
50+
for VAR in "${REQUIRED_VARS[@]}"; do
51+
if [ -z "${!VAR:-}" ]; then
52+
echo "❌ Missing: $VAR"
53+
exit 1
54+
fi
55+
done
56+
echo "✅ All required env vars are set."
57+
58+
# Reusable Cleanup Function
59+
run_cleanup() {
60+
local base_url=$1
61+
local env_name=$2
62+
echo "🧹 Cleaning up $env_name environment at $base_url..."
63+
TENANT_ID="diagnostics-tenant-x"
64+
65+
echo " (Fetching destinations for tenant: $TENANT_ID...)"
66+
DESTINATION_IDS=$(curl -sf -X GET "$base_url/api/v1/$TENANT_ID/destinations" \
67+
-H "Authorization: Bearer $API_KEY" | jq -r '.[].id')
68+
69+
if [ -z "$DESTINATION_IDS" ]; then
70+
echo " -> No destinations found for tenant $TENANT_ID."
71+
else
72+
for DEST_ID in $DESTINATION_IDS; do
73+
echo " (Deleting destination: $DEST_ID...)"
74+
if ! curl -sf -X DELETE "$base_url/api/v1/$TENANT_ID/destinations/$DEST_ID" -H "Authorization: Bearer $API_KEY" >/dev/null; then
75+
echo " -> ❌ Failed to delete destination $DEST_ID."
76+
else
77+
echo " -> ✅ Destination $DEST_ID deleted."
78+
fi
79+
done
80+
fi
81+
82+
echo " (Deleting tenant: $TENANT_ID...)"
83+
if ! curl -sf -X DELETE "$base_url/api/v1/$TENANT_ID" -H "Authorization: Bearer $API_KEY" >/dev/null; then
84+
echo " -> ❌ Failed to delete tenant $TENANT_ID."
85+
else
86+
echo " -> ✅ Tenant $TENANT_ID deleted."
87+
fi
88+
}
89+
90+
# Local Cleanup
91+
if [ "$RUN_LOCAL" = true ]; then
92+
echo "-------------------------------------"
93+
echo "🧹 Running LOCAL Cleanup..."
94+
echo "-------------------------------------"
95+
run_cleanup "http://localhost:3333" "local"
96+
fi
97+
98+
# Azure Cleanup
99+
if [ "$RUN_AZURE" = true ]; then
100+
echo "-------------------------------------"
101+
echo "☁️ Running AZURE Cleanup..."
102+
echo "-------------------------------------"
103+
104+
if ! command -v az &> /dev/null; then
105+
echo " -> ❌ Azure CLI 'az' is not installed. Skipping Azure cleanup."
106+
else
107+
AZURE_CONTAINER_APP_NAME="outpost-api"
108+
echo " (Fetching Azure Container App URL for '$AZURE_CONTAINER_APP_NAME'...)"
109+
AZURE_URL=$(az containerapp show --name "$AZURE_CONTAINER_APP_NAME" --resource-group "$RESOURCE_GROUP" --query "properties.configuration.ingress.fqdn" -o tsv)
110+
if [ -z "$AZURE_URL" ]; then
111+
echo " -> ❌ Could not fetch Azure Container App URL for '$AZURE_CONTAINER_APP_NAME'. Check your Azure login and configuration."
112+
else
113+
run_cleanup "https://$AZURE_URL" "azure"
114+
fi
115+
fi
116+
fi
117+
118+
echo "✅ Cleanup complete."

‎examples/azure/diagnostics.sh‎

Lines changed: 36 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -120,25 +120,54 @@ echo "🔐 Testing Azure Service Bus permissions..."
120120
if ! command -v jq &> /dev/null; then
121121
echo " -> ❌ jq is not installed, which is required for this check. Skipping permissions test."
122122
else
123-
SCOPE="/subscriptions/$AZURE_SERVICEBUS_SUBSCRIPTION_ID/resourceGroups/$AZURE_SERVICEBUS_RESOURCE_GROUP/providers/Microsoft.ServiceBus/namespaces/$AZURE_SERVICEBUS_NAMESPACE"
123+
# Define the two scopes we will check against
124+
NAMESPACE_SCOPE="/subscriptions/$AZURE_SERVICEBUS_SUBSCRIPTION_ID/resourceGroups/$AZURE_SERVICEBUS_RESOURCE_GROUP/providers/Microsoft.ServiceBus/namespaces/$AZURE_SERVICEBUS_NAMESPACE"
125+
TOPIC_SCOPE="$NAMESPACE_SCOPE/topics/$AZURE_SERVICEBUS_DELIVERY_TOPIC"
124126

125127
echo " (Getting Service Principal Object ID...)"
126128
# Note: This command relies on the user being logged into the az CLI
127129
SP_OBJECT_ID=$(az ad sp show --id "$AZURE_SERVICEBUS_CLIENT_ID" --query "id" -o tsv)
130+
128131
if [ -z "$SP_OBJECT_ID" ]; then
129132
echo " -> ❌ Could not retrieve Service Principal Object ID. Please check your Azure login and that the SP exists."
130133
else
134+
permission_found=false
135+
# Function to check for a specific role assignment at a specific scope
131136
check_role() {
132137
local role_name=$1
133-
echo " (Checking for role: '$role_name')..."
134-
if az role assignment list --assignee "$SP_OBJECT_ID" --scope "$SCOPE" --query "contains([].roleDefinitionName, '$role_name')" | grep -q "true"; then
135-
echo " -> ✅ Service principal has the required '$role_name' role."
138+
local scope=$2
139+
local scope_name=$3 # A friendly name for the scope for logging
140+
141+
echo " (Checking for role: '$role_name' at $scope_name scope...)"
142+
if az role assignment list --assignee "$SP_OBJECT_ID" --scope "$scope" --query "contains([].roleDefinitionName, '$role_name')" | grep -q "true"; then
143+
echo " -> ✅ Service principal has the required '$role_name' role at the $scope_name scope."
144+
permission_found=true
136145
else
137-
echo " -> ❌ Service principal does NOT have the required '$role_name' role."
138-
echo " To fix, run: az role assignment create --assignee \"$SP_OBJECT_ID\" --role \"$role_name\" --scope \"$SCOPE\""
146+
echo " -> No '$role_name' role found at $scope_name scope."
139147
fi
140148
}
141-
check_role "Azure Service Bus Data Owner"
149+
150+
# 1. Check for Data Owner at the Namespace level (highest privilege)
151+
check_role "Azure Service Bus Data Owner" "$NAMESPACE_SCOPE" "Namespace"
152+
153+
# 2. Check for Data Sender at the Namespace level
154+
check_role "Azure Service Bus Data Sender" "$NAMESPACE_SCOPE" "Namespace"
155+
156+
# 3. Check for Data Sender at the Topic level (most specific)
157+
check_role "Azure Service Bus Data Sender" "$TOPIC_SCOPE" "Topic"
158+
159+
# If none of the checks passed, show a final error
160+
if [ "$permission_found" = false ]; then
161+
echo ""
162+
echo " -> ❌ PERMISSION FAILURE: The Service Principal does NOT have the required permissions to publish to topic '$AZURE_SERVICEBUS_DELIVERY_TOPIC'."
163+
echo " To fix, grant the 'Azure Service Bus Data Sender' role at either the Namespace or the specific Topic scope."
164+
echo " (Alternatively, 'Azure Service Bus Data Owner' at the Namespace level also works)."
165+
echo " Run one of the following commands:"
166+
echo " Namespace Level: az role assignment create --assignee \"$SP_OBJECT_ID\" --role \"Azure Service Bus Data Sender\" --scope \"$NAMESPACE_SCOPE\""
167+
echo " Topic Level: az role assignment create --assignee \"$SP_OBJECT_ID\" --role \"Azure Service Bus Data Sender\" --scope \"$TOPIC_SCOPE\""
168+
else
169+
echo " -> ✅ Permissions are sufficient for publishing."
170+
fi
142171
fi
143172
fi
144173

‎examples/azure/local-deploy.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,9 @@ API_KEY="$API_KEY_VALUE"
5858
API_JWT_SECRET="$API_JWT_SECRET_VALUE"
5959
AES_ENCRYPTION_SECRET="$AES_ENCRYPTION_SECRET_VALUE"
6060
61+
# Not required, but recommended
62+
# TOPICS=diagnostics.test,order.created,order.updated,order.deleted
63+
6164
# Required for Postgres logging
6265
POSTGRES_URL=$POSTGRES_URL
6366

0 commit comments

Comments
 (0)