Private networking fixes

src/deploy-cromwell-on-azure/Deployer.cs

@@ -405,6 +405,11 @@ await Task.Run(async () =>
                             await AssignVmAsContributorToStorageAccountAsync(managedIdentity, storageAccount);
                             await AssignVmAsDataReaderToStorageAccountAsync(managedIdentity, storageAccount);
                             await AssignManagedIdOperatorToResourceAsync(managedIdentity, resourceGroup);
+
+                            if (!string.IsNullOrWhiteSpace(configuration.BatchNodesSubnetId))
+                            {
+                                await AssignMIAsNetworkContributorToResourceAsync(managedIdentity, resourceGroup);
+                            }
                         });
 
                         if (configuration.CrossSubscriptionAKSDeployment.GetValueOrDefault())
@@ -1003,6 +1008,21 @@ private Task AssignManagedIdOperatorToResourceAsync(IIdentity managedIdentity, I
                         .CreateAsync(cts.Token)));
         }
 
+        private Task AssignMIAsNetworkContributorToResourceAsync(IIdentity managedIdentity, IResource resource)
+        {
+            // https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#network-contributor
+            var roleDefinitionId = $"/subscriptions/{configuration.SubscriptionId}/providers/Microsoft.Authorization/roleDefinitions/4d97b98b-1d4f-4787-a291-c67834d212e7";
+            return Execute(
+                $"Assigning Network Contributor role for the managed id to resource group scope...",
+                () => roleAssignmentHashConflictRetryPolicy.ExecuteAsync(
+                    () => azureSubscriptionClient.AccessManagement.RoleAssignments
+                        .Define(Guid.NewGuid().ToString())
+                        .ForObjectId(managedIdentity.PrincipalId)
+                        .WithRoleDefinition(roleDefinitionId)
+                        .WithResourceScope(resource)
+                        .CreateAsync(cts.Token)));
+        }
+
         private Task AssignVmAsDataReaderToStorageAccountAsync(IIdentity managedIdentity, IStorageAccount storageAccount)
         {
             // https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#storage-blob-data-reader

src/deploy-cromwell-on-azure/samples/docker-dockerfile

@@ -0,0 +1,5 @@
+FROM docker.io/library/docker:latest
+
+ENV DEBIAN_FRONTEND=noninteractive
+RUN apk add grep
+RUN apk add bash