This PR fixes a few minor errors in scripts

samples/key-vault-csi-driver/user-assigned-managed-identity/02-create-key-vault-and-secrets.sh

@@ -42,6 +42,7 @@ if [[ $? != 0 ]]; then
 		--enabled-for-deployment \
 		--enabled-for-disk-encryption \
 		--enabled-for-template-deployment \
+		--enable-rbac-authorization true \
 		--sku $KEY_VAULT_SKU 1>/dev/null
 
 	if [[ $? == 0 ]]; then

samples/key-vault-csi-driver/user-assigned-managed-identity/03-create-role-assignment.sh

@@ -1,4 +1,4 @@
-#/bin/bash
+#!/bin/bash
 
 # Variables
 source ./00-variables.sh
@@ -52,8 +52,8 @@ fi
 # Get the name of the Azure Key Vault Secrets Provider identity from the resourceId
 KV_IDENTITY_NAME=$(basename $KV_IDENTITY_RESOURCE_ID)
 
-# Assign the Key Vault Administrator role to the managed identity on the node resource group
-ROLE="Key Vault Administrator"
+# Assign the Key Vault Secrets User role to the managed identity on the key vault
+ROLE="Key Vault Secrets User"
 MANAGED_IDENTITY_NAME="$KV_IDENTITY_NAME"
 PRINCIPAL_ID="$KV_IDENTITY_OBJECT_ID"
 SCOPE_ID="$KEY_VAULT_ID"

samples/key-vault-csi-driver/user-assigned-managed-identity/04-create-secret-provider-class.sh

@@ -1,4 +1,4 @@
-#/bin/bash
+#!/bin/bash
 
 # For more information, see:
 # https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver

samples/key-vault-csi-driver/user-assigned-managed-identity/05-create-demo-pod.sh

@@ -1,4 +1,4 @@
-#/bin/bash
+#!/bin/bash
 
 # For more information, see:
 # https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver

samples/key-vault-csi-driver/user-assigned-managed-identity/06-list-secrets.sh

@@ -19,5 +19,5 @@ FILES=$(kubectl exec $POD -n $NAMESPACE -- ls /mnt/secrets)
 for FILE in ${FILES[@]}
 do
     echo "Retrieving [$FILE] secret from [$KEY_VAULT_NAME] key vault..."
-    kubectl exec $POD --stdin --tty -n $NAMESPACE -- cat /mnt/secrets/$FILE;echo;sleep 1
+    kubectl exec "$POD" -n "$NAMESPACE" -- cat "/mnt/secrets/$FILE";echo;sleep 1
 done 

samples/key-vault-csi-driver/workload-identity/02-create-key-vault-and-secrets.sh

@@ -42,6 +42,7 @@ if [[ $? != 0 ]]; then
     --enabled-for-deployment \
     --enabled-for-disk-encryption \
     --enabled-for-template-deployment \
+    --enable-rbac-authorization true \
     --sku $KEY_VAULT_SKU 1>/dev/null
 
   if [[ $? == 0 ]]; then

samples/key-vault-csi-driver/workload-identity/03-create-managed-identity.sh

@@ -1,4 +1,4 @@
-#/bin/bash
+#!/bin/bash
 
 # Variables
 source ./00-variables.sh
@@ -98,9 +98,8 @@ else
   exit
 fi
 
-# Assign the Key Vault Administrator role to the managed identity on the node resource group
-ROLE="Key Vault Administrator"
-PRINCIPAL_ID="$PRINCIPAL_ID"
+# Assign the Key Vault Secrets User role to the managed identity on the key vault
+ROLE="Key Vault Secrets User"
 SCOPE_ID="$KEY_VAULT_ID"
 SCOPE_NAME="$KEY_VAULT_NAME"
 SCOPE_TYPE="key vault"
@@ -204,6 +203,10 @@ if [[ $? != 0 ]]; then
   # Show OIDC Issuer URL
   if [[ -n $AKS_OIDC_ISSUER_URL ]]; then
     echo "The OIDC Issuer URL of the [$AKS_NAME] cluster is [$AKS_OIDC_ISSUER_URL]"
+  else
+    echo "Failed to retrieve the OIDC Issuer URL of the [$AKS_NAME] cluster"
+    echo "Make sure the cluster was created with the OIDC issuer enabled (az aks update --enable-oidc-issuer)"
+    exit 1
   fi
 
   echo "Creating [$FEDERATED_IDENTITY_NAME] federated identity credential in the [$AKS_RESOURCE_GROUP_NAME] resource group..."

samples/key-vault-csi-driver/workload-identity/04-create-secret-provider-class.sh

@@ -1,4 +1,4 @@
-#/bin/bash
+#!/bin/bash
 
 # For more information, see:
 # https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver

samples/key-vault-csi-driver/workload-identity/05-create-demo-pod.sh

@@ -1,4 +1,4 @@
-#/bin/bash
+#!/bin/bash
 
 # For more information, see:
 # https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver

samples/key-vault-csi-driver/workload-identity/06-list-secrets.sh

@@ -19,5 +19,5 @@ FILES=$(kubectl exec $POD -n $NAMESPACE -- ls /mnt/secrets)
 for FILE in ${FILES[@]}
 do
     echo "Retrieving [$FILE] secret from [$KEY_VAULT_NAME] key vault..."
-    kubectl exec $POD --stdin --tty -n $NAMESPACE -- cat /mnt/secrets/$FILE;echo;sleep 1
+    kubectl exec "$POD" -n "$NAMESPACE" -- cat "/mnt/secrets/$FILE";echo;sleep 1
 done 

samples/web-app-postgresql-flexible-server/scripts/01-deploy-resources.sh

@@ -92,24 +92,24 @@ fi
 echo "Ensuring firewall rule [$FIREWALL_RULE_NAME] exists on PostgreSQL flexible server [$PG_SERVER_NAME]..."
 az postgres flexible-server firewall-rule create \
 	--resource-group "$RESOURCE_GROUP_NAME" \
-	--server-name "$PG_SERVER_NAME" \
-	--name "$FIREWALL_RULE_NAME" \
+	--name "$PG_SERVER_NAME" \
+	--rule-name "$FIREWALL_RULE_NAME" \
 	--start-ip-address 0.0.0.0 \
 	--end-ip-address 255.255.255.255 \
 	--only-show-errors 1>/dev/null
 
 # Create the PostgreSQL database
 echo "Checking if PostgreSQL database [$PG_DATABASE_NAME] exists..."
 az postgres flexible-server db show \
-	--name "$PG_DATABASE_NAME" \
+	--database-name "$PG_DATABASE_NAME" \
 	--server-name "$PG_SERVER_NAME" \
 	--resource-group "$RESOURCE_GROUP_NAME" \
 	--only-show-errors &>/dev/null
 
 if [[ $? != 0 ]]; then
 	echo "Creating PostgreSQL database [$PG_DATABASE_NAME]..."
 	az postgres flexible-server db create \
-		--name "$PG_DATABASE_NAME" \
+		--database-name "$PG_DATABASE_NAME" \
 		--server-name "$PG_SERVER_NAME" \
 		--resource-group "$RESOURCE_GROUP_NAME" \
 		--charset UTF8 \

scripts/01-user-assigned-managed-identity.sh

@@ -749,6 +749,85 @@ else
 	fi
 fi
 
+# Retrieve the objectId of the Azure Key Vault Secrets Provider identity
+kv_secret_provider_managed_identity_object_id=$(az aks show \
+	--resource-group $resource_group_name \
+	--name $aks_cluster_name \
+	--query addonProfiles.azureKeyvaultSecretsProvider.identity.objectId \
+	--output tsv \
+	--only-show-errors 2>/dev/null)
+
+if [[ -n $kv_secret_provider_managed_identity_object_id ]]; then
+	echo "Successfully retrieved the objectId for the Azure Key Vault Secrets Provider identity in the [$aks_cluster_name] AKS cluster"
+else
+	echo "Failed to retrieve the objectId for the Azure Key Vault Secrets Provider identity in the [$aks_cluster_name] AKS cluster"
+	exit
+fi
+
+# Retrieve the resourceId of the Azure Key Vault Secrets Provider identity
+kv_secret_provider_managed_identity_resource_id=$(az aks show \
+	--resource-group $resource_group_name \
+	--name $aks_cluster_name \
+	--query addonProfiles.azureKeyvaultSecretsProvider.identity.resourceId \
+	--output tsv \
+	--only-show-errors 2>/dev/null)
+
+if [[ -n $kv_secret_provider_managed_identity_resource_id ]]; then
+	echo "Successfully retrieved the resourceId for the Azure Key Vault Secrets Provider identity in the [$aks_cluster_name] AKS cluster"
+else
+	echo "Failed to retrieve the resourceId for the Azure Key Vault Secrets Provider identity in the [$aks_cluster_name] AKS cluster"
+	exit
+fi
+
+# Get the name of the Azure Key Vault Secrets Provider identity from the resourceId
+kv_secret_provider_managed_identity_name=$(basename $kv_secret_provider_managed_identity_resource_id)
+
+# Assign the Key Vault Administrator role to the managed identity on the node resource group
+role="Key Vault Administrator"
+managed_identity_name="$kv_secret_provider_managed_identity_name"
+principal_id="$kv_secret_provider_managed_identity_object_id"
+scope_id="$key_vault_id"
+scope_name="$key_vault_name"
+scope_type="key vault"
+echo "Checking if the [$managed_identity_name] managed identity has the [$role] role assignment on the [$scope_name] $scope_type..."
+current=$(az role assignment list \
+	--assignee "$principal_id" \
+	--scope "$scope_id" \
+	--query "[?roleDefinitionName=='$role'].roleDefinitionName" \
+	--output tsv 2>/dev/null)
+
+if [[ $current == "$role" ]]; then
+	echo "Managed identity [$managed_identity_name] already has the [$role] role assignment on the [$scope_name] $scope_type"
+else
+	echo "Managed identity [$managed_identity_name] does not have the [$role] role assignment on the [$scope_name] $scope_type"
+	echo "Creating role assignment: assigning [$role] role to managed identity [$managed_identity_name] on the [$scope_name] $scope_type..."
+	ATTEMPT=1
+	while [ $ATTEMPT -le $RETRY_COUNT ]; do
+		echo "Attempt $ATTEMPT of $RETRY_COUNT to assign role..."
+		az role assignment create \
+			--assignee "$principal_id" \
+			--role "$role" \
+			--scope "$scope_id" 1>/dev/null
+
+		if [[ $? == 0 ]]; then
+			break
+		else
+			if [ $ATTEMPT -lt $RETRY_COUNT ]; then
+				echo "Role assignment failed. Waiting [$SLEEP] seconds before retry..."
+				sleep $SLEEP
+			fi
+			ATTEMPT=$((ATTEMPT + 1))
+		fi
+	done
+
+	if [[ $? == 0 ]]; then
+		echo "Successfully assigned [$role] role to managed identity [$managed_identity_name] on the [$scope_name] $scope_type"
+	else
+		echo "Failed to assign [$role] role to managed identity [$managed_identity_name] on the [$scope_name] $scope_type"
+		exit 1
+	fi
+fi
+
 # Use the following command to configure kubectl to connect to the new Kubernetes cluster
 echo "Getting access credentials configure kubectl to connect to the [$aks_cluster_name] AKS cluster..."
 az aks get-credentials \