github.com/openshift/installer@v1.4.17/pkg/asset/cluster/azure/azure.go

// Package azure extracts AZURE metadata from install configurations.
package azure

import (
	"context"
	"fmt"
	"time"

	"github.com/Azure/azure-sdk-for-go/profiles/2018-03-01/resources/mgmt/resources"
	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
	"github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork"
	"github.com/Azure/go-autorest/autorest/to"
	"github.com/sirupsen/logrus"

	"github.com/openshift/installer/pkg/asset/installconfig"
	icazure "github.com/openshift/installer/pkg/asset/installconfig/azure"
	"github.com/openshift/installer/pkg/types"
	"github.com/openshift/installer/pkg/types/azure"
)

// Metadata converts an install configuration to Azure metadata.
func Metadata(config *types.InstallConfig) *azure.Metadata {
	return &azure.Metadata{
		ARMEndpoint:                 config.Platform.Azure.ARMEndpoint,
		CloudName:                   config.Platform.Azure.CloudName,
		Region:                      config.Platform.Azure.Region,
		ResourceGroupName:           config.Azure.ResourceGroupName,
		BaseDomainResourceGroupName: config.Azure.BaseDomainResourceGroupName,
	}
}

// PreTerraform performs any infrastructure initialization which must
// happen before Terraform creates the remaining infrastructure.
func PreTerraform(ctx context.Context, clusterID string, installConfig *installconfig.InstallConfig) error {
	session, err := installConfig.Azure.Session()
	if err != nil {
		return fmt.Errorf("failed to get session: %w", err)
	}

	if err := tagResourceGroup(ctx, clusterID, installConfig, session); err != nil {
		return err
	}

	// removing shared tags relies on an api that isn't available
	// on azure stack hub, so we do not tag them as to not leak
	// the tags. see pkg/destroy/azure/azure.go for more.
	if installConfig.Azure.CloudName != azure.StackCloud {
		err = tagVNet(ctx, clusterID, installConfig, session)
	}
	return err
}

func tagVNet(ctx context.Context, clusterID string, installConfig *installconfig.InstallConfig, session *icazure.Session) error {
	if len(installConfig.Config.Azure.VirtualNetwork) == 0 {
		return nil
	}

	resourceGroupName := installConfig.Config.Azure.NetworkResourceGroupName
	clientOpts := &arm.ClientOptions{
		ClientOptions: azcore.ClientOptions{
			Cloud: session.CloudConfig,
		},
	}

	vnetClient, err := armnetwork.NewVirtualNetworksClient(session.Credentials.SubscriptionID, session.TokenCreds, clientOpts)
	if err != nil {
		return fmt.Errorf("failed to get the virtual network client: %w", err)
	}

	vnetResp, err := vnetClient.Get(ctx, resourceGroupName, installConfig.Config.Azure.VirtualNetwork, nil)
	if err != nil {
		return fmt.Errorf("failed to get the virtual network %q: %w", installConfig.Config.Azure.VirtualNetwork, err)
	}
	vnet := vnetResp.VirtualNetwork
	if vnet.Tags == nil {
		vnet.Tags = map[string]*string{}
	}
	tagKey, tagValue := sharedTag(clusterID)
	vnet.Tags[tagKey] = tagValue

	tags := armnetwork.TagsObject{
		Tags: vnet.Tags,
	}

	logrus.Debugf("Tagging vnet %s with %s: %s", installConfig.Config.Azure.VirtualNetwork, tagKey, *tagValue)

	if _, err := vnetClient.UpdateTags(
		ctx, resourceGroupName, installConfig.Config.Azure.VirtualNetwork, tags, nil,
	); err != nil {
		return fmt.Errorf("failed to update virtual network tags: %w", err)
	}

	return nil
}

func tagResourceGroup(ctx context.Context, clusterID string, installConfig *installconfig.InstallConfig, session *icazure.Session) error {
	if len(installConfig.Config.Azure.ResourceGroupName) == 0 {
		return nil
	}

	client := resources.NewGroupsClientWithBaseURI(session.Environment.ResourceManagerEndpoint, session.Credentials.SubscriptionID)
	client.Authorizer = session.Authorizer
	ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
	defer cancel()

	group, err := client.Get(ctx, installConfig.Config.Azure.ResourceGroupName)
	if err != nil {
		return fmt.Errorf("failed to get the resource group: %w", err)
	}

	if group.Tags == nil {
		group.Tags = map[string]*string{}
	}

	// The cluster resource group when created by the installer is tagged with `kubernetes.io_cluster_<infraID>=owned` tag.
	// This tag is used to clean up the service principles generated by cred-minter and also to mark that the resource group is owned by
	// this specific cluster.
	//
	// Since user provided resource group still is owned by the cluster, we must tag this resource group similarly. Since terraform cannot
	// update the tags for an existing resource group, we have to fall back the pattern of `PreTerraform` previously used by AWS for pre-existing subnets.
	//
	// We read existing tags from the resource group and add `kubernetes.io_cluster_<infraID>=owned` to it when sending an update for the resource group.
	tagKey, tagValue := ownedTag(clusterID)
	group.Tags[tagKey] = tagValue
	logrus.Debugf("Tagging resource group %s with %s: %s", installConfig.Config.Azure.ResourceGroupName, tagKey, *tagValue)

	// Save metadata needed to destroy cluster into tags
	config := installConfig.Config.Azure
	group.Tags[azure.TagMetadataRegion] = to.StringPtr(config.Region)
	if len(config.BaseDomainResourceGroupName) > 0 {
		group.Tags[azure.TagMetadataBaseDomainRG] = to.StringPtr(config.BaseDomainResourceGroupName)
	}
	if len(config.NetworkResourceGroupName) > 0 {
		group.Tags[azure.TagMetadataNetworkRG] = to.StringPtr(config.NetworkResourceGroupName)
	}

	_, err = client.Update(ctx, installConfig.Config.Azure.ResourceGroupName, resources.GroupPatchable{
		Tags: group.Tags,
	})
	if err != nil {
		return fmt.Errorf("failed to tag the resource group %q: %w", installConfig.Config.Azure.ResourceGroupName, err)
	}
	return nil
}

func sharedTag(clusterID string) (string, *string) {
	return fmt.Sprintf("kubernetes.io_cluster.%s", clusterID), to.StringPtr("shared")
}

func ownedTag(clusterID string) (string, *string) {
	return fmt.Sprintf("kubernetes.io_cluster.%s", clusterID), to.StringPtr("owned")
}