ARO-10633 | Add ARM Helper Indentity supporting properties

Signed-off-by: Chetan Giradkar <[email protected]>
Azure · Nov 25, 2024 · da084e7 · da084e7
1 parent 9232253
commit da084e7
Show file tree

Hide file tree

Showing 3 changed files with 48 additions and 1 deletion.
diff --git a/cluster-service/Makefile b/cluster-service/Makefile
@@ -11,6 +11,8 @@ deploy: deploy-namespace-template deploy-istio-configurations-template ${DB_SECR
 	OIDC_ISSUER_BASE_ENDPOINT=$(shell az storage account show -n ${OIDC_STORAGE_ACCOUNT} -g ${RESOURCEGROUP} --query primaryEndpoints.web -o tsv) && \
 	OCP_ACR_URL=$(shell az acr show -n ${OCP_ACR_NAME} --query loginServer -o tsv) && \
 	OCP_ACR_RESOURCE_ID=$(shell az acr show -n ${OCP_ACR_NAME} --query id -o tsv) && \
+	AZURE_ARM_HELPER_IDENTITY_CLIENT_ID=$(shell az ad app list --display-name aro-dev-arm-helper --query '[*]'.appId -o tsv) && \
+	AZURE_ARM_HELPER_MOCK_FPA_PRINCIPAL_ID=$(shell az ad sp list --display-name aro-dev-first-party --query "[*].id" -o tsv) && \
 	oc process --local -f deploy/openshift-templates/arohcp-service-template.yml \
 	  -p AZURE_CS_MI_CLIENT_ID=$${AZURE_CS_MI_CLIENT_ID} \
 	  -p TENANT_ID=$${TENANT_ID} \
@@ -27,7 +29,11 @@ deploy: deploy-namespace-template deploy-istio-configurations-template ${DB_SECR
 	  -p DATABASE_DISABLE_TLS=${DATABASE_DISABLE_TLS} \
 	  -p OIDC_ISSUER_BASE_URL=$${OIDC_ISSUER_BASE_ENDPOINT} \
 	  -p OIDC_ISSUER_BLOB_SERVICE_URL=$${OIDC_BLOB_SERVICE_ENDPOINT} \
-	  -p DATABASE_AUTH_METHOD=${DATABASE_AUTH_METHOD} | oc apply -f -
+	  -p DATABASE_AUTH_METHOD=${DATABASE_AUTH_METHOD} \
+	  -p AZURE_ARM_HELPER_IDENTITY_CLIENT_ID=${AZURE_ARM_HELPER_IDENTITY_CLIENT_ID} \
+	  -p AZURE_ARM_HELPER_IDENTITY_CERT_NAME=${MOCK_FPA_CERT_NAME} \
+	  -p AZURE_ARM_HELPER_MOCK_FPA_PRINCIPAL_ID=${AZURE_ARM_HELPER_MOCK_FPA_PRINCIPAL_ID} \
+	  | oc apply -f -
 
 deploy-namespace-template:
 	ISTO_VERSION=$(shell az aks show -n ${AKS_NAME} -g ${RESOURCEGROUP} --query serviceMeshProfile.istio.revisions[-1] -o tsv) && \

diff --git a/cluster-service/config.tmpl.mk b/cluster-service/config.tmpl.mk
@@ -11,6 +11,7 @@ ACR_NAME ?= {{ .svcAcrName }}
 OCP_ACR_NAME ?= {{ .ocpAcrName }}
 AZURE_FIRST_PARTY_APPLICATION_CLIENT_ID ?= {{ .firstPartyAppClientId }}
 FPA_CERT_NAME ?= firstPartyCert
+MOCK_FPA_CERT_NAME ?= armHelperCert
 ZONE_NAME ?= {{ .regionalDNSSubdomain }}.{{ .baseDnsZoneName }}
 
 DATABASE_DISABLE_TLS ?= {{ not .clusterService.postgres.deploy }}

diff --git a/cluster-service/deploy/openshift-templates/arohcp-service-template.yml b/cluster-service/deploy/openshift-templates/arohcp-service-template.yml
@@ -252,6 +252,14 @@ parameters:
   value: ""
 - name: OIDC_ISSUER_BASE_URL
   description: "OIDC base issuer URL, e.g. https://<storage-account>.z1.web.core.windows.net/"
+- name: AZURE_ARM_HELPER_IDENTITY_CLIENT_ID
+  description: The client id of the service principal that represents the ARM Helper Identity.
+  value: ""
+- name: AZURE_ARM_HELPER_IDENTITY_CERT_NAME
+  description: The name of the secret that contains the ARM Helper Indentity certificate bundle.
+  value: ""
+- name: AZURE_ARM_HELPER_MOCK_FPA_PRINCIPAL_ID
+  description: The principal id of the service principal that represents the ARM Helper Identity
   value: ""
 
 objects:
@@ -276,6 +284,26 @@ objects:
       usePodIdentity: "false"
     provider: azure
 
+- apiVersion: secrets-store.csi.x-k8s.io/v1
+  kind: SecretProviderClass
+  metadata:
+    name: arm-identity
+    namespace: ${NAMESPACE}
+  spec:
+    parameters:
+      clientID: ${AZURE_CS_MI_CLIENT_ID}
+      cloudName: AzurePublicCloud
+      keyvaultName: ${SERVICE_KEYVAULT_NAME}
+      objects: |-
+        array:
+          - |
+            objectName: ${AZURE_ARM_HELPER_IDENTITY_CERT_NAME}
+            objectType: secret
+            objectAlias: armHelperIndentityCertificateBundle
+      tenantId: ${TENANT_ID}
+      usePodIdentity: "false"
+    provider: azure
+
 - apiVersion: v1
   kind: ConfigMap
   metadata:
@@ -566,6 +594,12 @@ objects:
         - name: azure-credentials
           secret:
             secretName: azure-credentials
+        - name: arm-identity
+          csi:
+            driver: secrets-store.csi.k8s.io
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: arm-identity
         - name: keyvault
           csi:
             driver: secrets-store.csi.k8s.io
@@ -635,6 +669,9 @@ objects:
           - name: azure-operators-managed-identities-config
             mountPath: /configs/azure-operators-managed-identities-config.yaml
             subPath: azure-operators-managed-identities-config.yaml
+          - name: arm-identity
+            mountPath: /secrets/arm-identity
+            readOnly: true
           env:
           - name: NAMESPACE
             valueFrom:
@@ -687,6 +724,9 @@ objects:
           - --azure-first-party-application-certificate-bundle-path=/secrets/keyvault/firstPartyApplicationCertificateBundle
           - --azure-runtime-config-path=/configs/azure-runtime-config/config.json
           - --azure-operators-managed-identities-config-path=/configs/azure-operators-managed-identities-config.yaml
+          - --azure-arm-helper-identity-certificate-bundle-path=/secrets/arm-identity/armHelperIndentityCertificateBundle
+          - --azure-arm-helper-identity-client-id=${AZURE_ARM_HELPER_IDENTITY_CLIENT_ID}
+          - --azure-arm-helper-mock-fpa-principal-id=${AZURE_ARM_HELPER_MOCK_FPA_PRINCIPAL_ID}
           livenessProbe:
             httpGet:
               path: /api/clusters_mgmt/v1