search

Esri / arcgis-gitops

GitHub Actions workflows for ArcGIS Enterprise deployment and operation
Apache License 2.0
6 stars 1 forks source link

Disable public endpoints of Azure storage accounts #135

Open pbobov opened 6 days ago

pbobov commented 6 days ago

ArcGIS Enterprise on Kubernetes now uses private endpoints to access blob stores (see #133), therefore the public endpoints can be disabled.

Disabling the public endpoints for the storage accounts is tricky, because this blocks access to the endpoints for Terraform from GitHub Actions runners. In particular, Terraform cannot create blob containers once the network access to the blob store endpoint is blocked.

Possible workarounds:

  1. Configure firewalls for the storage accounts with exceptions for the GitHub Actions IP addresses. This is not an ideal solution because this allows access to the storage accounts to any GitHub Actions workflow.
  2. Create blob containers in ArcGIS Enterprise Admin CLI pod running in AKS cluster before creating an organization and registering backup stores. This requires granting the AKS cluster identity permissions to create blob containers and makes ArcGIS Enterprise Admin CLI dependent on Azure SDK for Python. Ideally, all the Azure infrastructure management should by done by Terraform.
  3. Hack the Terraform modules to enable public network access to the storage account before creating/describing the blob containers and disable it after the container are created. This hack could have unpredictable side effects.
  4. Ask users to disable public network access manually. That will make subsequent Terraform executions fail when Terraform tries to retrieve state of the blob containers.