From da084e7f000a712b5da5b39ae7fcf5bb723c9ebc Mon Sep 17 00:00:00 2001 From: Chetan Giradkar Date: Fri, 4 Oct 2024 11:25:05 +0100 Subject: [PATCH] ARO-10633 | Add ARM Helper Indentity supporting properties Signed-off-by: Chetan Giradkar --- cluster-service/Makefile | 8 +++- cluster-service/config.tmpl.mk | 1 + .../arohcp-service-template.yml | 40 +++++++++++++++++++ 3 files changed, 48 insertions(+), 1 deletion(-) diff --git a/cluster-service/Makefile b/cluster-service/Makefile index 71fa9febe..9faf88d77 100644 --- a/cluster-service/Makefile +++ b/cluster-service/Makefile @@ -11,6 +11,8 @@ deploy: deploy-namespace-template deploy-istio-configurations-template ${DB_SECR OIDC_ISSUER_BASE_ENDPOINT=$(shell az storage account show -n ${OIDC_STORAGE_ACCOUNT} -g ${RESOURCEGROUP} --query primaryEndpoints.web -o tsv) && \ OCP_ACR_URL=$(shell az acr show -n ${OCP_ACR_NAME} --query loginServer -o tsv) && \ OCP_ACR_RESOURCE_ID=$(shell az acr show -n ${OCP_ACR_NAME} --query id -o tsv) && \ + AZURE_ARM_HELPER_IDENTITY_CLIENT_ID=$(shell az ad app list --display-name aro-dev-arm-helper --query '[*]'.appId -o tsv) && \ + AZURE_ARM_HELPER_MOCK_FPA_PRINCIPAL_ID=$(shell az ad sp list --display-name aro-dev-first-party --query "[*].id" -o tsv) && \ oc process --local -f deploy/openshift-templates/arohcp-service-template.yml \ -p AZURE_CS_MI_CLIENT_ID=$${AZURE_CS_MI_CLIENT_ID} \ -p TENANT_ID=$${TENANT_ID} \ @@ -27,7 +29,11 @@ deploy: deploy-namespace-template deploy-istio-configurations-template ${DB_SECR -p DATABASE_DISABLE_TLS=${DATABASE_DISABLE_TLS} \ -p OIDC_ISSUER_BASE_URL=$${OIDC_ISSUER_BASE_ENDPOINT} \ -p OIDC_ISSUER_BLOB_SERVICE_URL=$${OIDC_BLOB_SERVICE_ENDPOINT} \ - -p DATABASE_AUTH_METHOD=${DATABASE_AUTH_METHOD} | oc apply -f - + -p DATABASE_AUTH_METHOD=${DATABASE_AUTH_METHOD} \ + -p AZURE_ARM_HELPER_IDENTITY_CLIENT_ID=${AZURE_ARM_HELPER_IDENTITY_CLIENT_ID} \ + -p AZURE_ARM_HELPER_IDENTITY_CERT_NAME=${MOCK_FPA_CERT_NAME} \ + -p AZURE_ARM_HELPER_MOCK_FPA_PRINCIPAL_ID=${AZURE_ARM_HELPER_MOCK_FPA_PRINCIPAL_ID} \ + | oc apply -f - deploy-namespace-template: ISTO_VERSION=$(shell az aks show -n ${AKS_NAME} -g ${RESOURCEGROUP} --query serviceMeshProfile.istio.revisions[-1] -o tsv) && \ diff --git a/cluster-service/config.tmpl.mk b/cluster-service/config.tmpl.mk index dc21ee8e1..ecea53f22 100644 --- a/cluster-service/config.tmpl.mk +++ b/cluster-service/config.tmpl.mk @@ -11,6 +11,7 @@ ACR_NAME ?= {{ .svcAcrName }} OCP_ACR_NAME ?= {{ .ocpAcrName }} AZURE_FIRST_PARTY_APPLICATION_CLIENT_ID ?= {{ .firstPartyAppClientId }} FPA_CERT_NAME ?= firstPartyCert +MOCK_FPA_CERT_NAME ?= armHelperCert ZONE_NAME ?= {{ .regionalDNSSubdomain }}.{{ .baseDnsZoneName }} DATABASE_DISABLE_TLS ?= {{ not .clusterService.postgres.deploy }} diff --git a/cluster-service/deploy/openshift-templates/arohcp-service-template.yml b/cluster-service/deploy/openshift-templates/arohcp-service-template.yml index a3c0e9025..e6621c0db 100644 --- a/cluster-service/deploy/openshift-templates/arohcp-service-template.yml +++ b/cluster-service/deploy/openshift-templates/arohcp-service-template.yml @@ -252,6 +252,14 @@ parameters: value: "" - name: OIDC_ISSUER_BASE_URL description: "OIDC base issuer URL, e.g. https://.z1.web.core.windows.net/" +- name: AZURE_ARM_HELPER_IDENTITY_CLIENT_ID + description: The client id of the service principal that represents the ARM Helper Identity. + value: "" +- name: AZURE_ARM_HELPER_IDENTITY_CERT_NAME + description: The name of the secret that contains the ARM Helper Indentity certificate bundle. + value: "" +- name: AZURE_ARM_HELPER_MOCK_FPA_PRINCIPAL_ID + description: The principal id of the service principal that represents the ARM Helper Identity value: "" objects: @@ -276,6 +284,26 @@ objects: usePodIdentity: "false" provider: azure +- apiVersion: secrets-store.csi.x-k8s.io/v1 + kind: SecretProviderClass + metadata: + name: arm-identity + namespace: ${NAMESPACE} + spec: + parameters: + clientID: ${AZURE_CS_MI_CLIENT_ID} + cloudName: AzurePublicCloud + keyvaultName: ${SERVICE_KEYVAULT_NAME} + objects: |- + array: + - | + objectName: ${AZURE_ARM_HELPER_IDENTITY_CERT_NAME} + objectType: secret + objectAlias: armHelperIndentityCertificateBundle + tenantId: ${TENANT_ID} + usePodIdentity: "false" + provider: azure + - apiVersion: v1 kind: ConfigMap metadata: @@ -566,6 +594,12 @@ objects: - name: azure-credentials secret: secretName: azure-credentials + - name: arm-identity + csi: + driver: secrets-store.csi.k8s.io + readOnly: true + volumeAttributes: + secretProviderClass: arm-identity - name: keyvault csi: driver: secrets-store.csi.k8s.io @@ -635,6 +669,9 @@ objects: - name: azure-operators-managed-identities-config mountPath: /configs/azure-operators-managed-identities-config.yaml subPath: azure-operators-managed-identities-config.yaml + - name: arm-identity + mountPath: /secrets/arm-identity + readOnly: true env: - name: NAMESPACE valueFrom: @@ -687,6 +724,9 @@ objects: - --azure-first-party-application-certificate-bundle-path=/secrets/keyvault/firstPartyApplicationCertificateBundle - --azure-runtime-config-path=/configs/azure-runtime-config/config.json - --azure-operators-managed-identities-config-path=/configs/azure-operators-managed-identities-config.yaml + - --azure-arm-helper-identity-certificate-bundle-path=/secrets/arm-identity/armHelperIndentityCertificateBundle + - --azure-arm-helper-identity-client-id=${AZURE_ARM_HELPER_IDENTITY_CLIENT_ID} + - --azure-arm-helper-mock-fpa-principal-id=${AZURE_ARM_HELPER_MOCK_FPA_PRINCIPAL_ID} livenessProbe: httpGet: path: /api/clusters_mgmt/v1