Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Receive mock managed identities rp identity in CS #899

Merged
merged 1 commit into from
Nov 28, 2024
Merged

Receive mock managed identities rp identity in CS #899

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions cluster-service/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,9 @@ deploy: deploy-namespace-template deploy-istio-configurations-template ${DB_SECR
-p DATABASE_DISABLE_TLS=${DATABASE_DISABLE_TLS} \
-p OIDC_ISSUER_BASE_URL=$${OIDC_ISSUER_BASE_ENDPOINT} \
-p OIDC_ISSUER_BLOB_SERVICE_URL=$${OIDC_BLOB_SERVICE_ENDPOINT} \
-p AZURE_MI_MOCK_SERVICE_PRINCIPAL_PRINCIPAL_ID=${AZURE_MI_MOCK_SERVICE_PRINCIPAL_PRINCIPAL_ID} \
-p AZURE_MI_MOCK_SERVICE_PRINCIPAL_CLIENT_ID=${AZURE_MI_MOCK_SERVICE_PRINCIPAL_CLIENT_ID} \
-p AZURE_MI_MOCK_SERVICE_PRINCIPAL_CERT_NAME=${MI_MOCK_SERVICE_PRINCIPAL_CERT_NAME} \
-p DATABASE_AUTH_METHOD=${DATABASE_AUTH_METHOD} | oc apply -f -

deploy-namespace-template:
Expand Down
3 changes: 3 additions & 0 deletions cluster-service/config.tmpl.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,9 @@ ACR_NAME ?= {{ .svcAcrName }}
OCP_ACR_NAME ?= {{ .ocpAcrName }}
AZURE_FIRST_PARTY_APPLICATION_CLIENT_ID ?= {{ .firstPartyAppClientId }}
FPA_CERT_NAME ?= firstPartyCert
AZURE_MI_MOCK_SERVICE_PRINCIPAL_PRINCIPAL_ID ?= {{ .miMockPrincipalId }}
AZURE_MI_MOCK_SERVICE_PRINCIPAL_CLIENT_ID ?= {{ .miMockClientId }}
MI_MOCK_SERVICE_PRINCIPAL_CERT_NAME ?= msiMockCert
ZONE_NAME ?= {{ .regionalDNSSubdomain }}.{{ .baseDnsZoneName }}

DATABASE_DISABLE_TLS ?= {{ not .clusterService.postgres.deploy }}
Expand Down
15 changes: 15 additions & 0 deletions cluster-service/deploy/openshift-templates/arohcp-service-template.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -253,6 +253,14 @@ parameters:
- name: OIDC_ISSUER_BASE_URL
description: "OIDC base issuer URL, e.g. https://<storage-account>.z1.web.core.windows.net/"
value: ""
- name: AZURE_MI_MOCK_SERVICE_PRINCIPAL_CERT_NAME
description: The name of the secret that contains the mock managed identities certificate bundle.
- name: AZURE_MI_MOCK_SERVICE_PRINCIPAL_CLIENT_ID
description: The client id of the mock managed identities service principal.
value: ""
- name: AZURE_MI_MOCK_SERVICE_PRINCIPAL_PRINCIPAL_ID
description: The princiap id of the mock managed identities service principal.
value: ""

objects:

Expand All @@ -272,6 +280,10 @@ objects:
objectName: ${FPA_CERT_NAME}
objectType: secret
objectAlias: firstPartyApplicationCertificateBundle
- |
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we want to approach it having a single SecretProviderClass with N secrets or N SecretProviderClass ? I see different approaches depending on the MR.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Both approaches are valid but I opted for this because I see no difference in terms of configuration between the SecretProviderClass I needed for this purpose and the firstPartyApp one. I'll defer this question to @janboll @geoberle on how they see it.

objectName: ${AZURE_MI_MOCK_SERVICE_PRINCIPAL_CERT_NAME}
objectType: secret
objectAlias: mockMiServicePrincipalCertificateBundle
tenantId: ${TENANT_ID}
usePodIdentity: "false"
provider: azure
Expand Down Expand Up @@ -690,6 +702,9 @@ objects:
- --azure-first-party-application-certificate-bundle-path=/secrets/keyvault/firstPartyApplicationCertificateBundle
- --azure-runtime-config-path=/configs/azure-runtime-config/config.json
- --azure-operators-managed-identities-config-path=/configs/azure-operators-managed-identities-config.yaml
- --azure-mi-mock-service-principal-certificate-bundle-path=/secrets/keyvault/mockMiServicePrincipalCertificateBundle
- --azure-mi-mock-service-principal-client-id=${AZURE_MI_MOCK_SERVICE_PRINCIPAL_CLIENT_ID}
- --azure-mi-mock-service-principal-principal-id=${AZURE_MI_MOCK_SERVICE_PRINCIPAL_PRINCIPAL_ID}
livenessProbe:
httpGet:
path: /api/clusters_mgmt/v1
Expand Down
7 changes: 6 additions & 1 deletion config/config.msft.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,7 +126,7 @@ clouds:
maestro:
imageTag: ea066c250a002f0cc458711945165591bc9f6d3f
clusterService:
imageTag: aac7623
imageTag: ecd15ad
imageRepo: app-sre/uhc-clusters-service
hypershiftOperator:
imageTag: 9aca808
Expand Down Expand Up @@ -178,6 +178,11 @@ clouds:
# 1P app
firstPartyAppClientId: '??? the one used by CS to do first party stuff ???'

# Mock Managed Identities Service Princiapl.
# This is a stub identity to be used by CS in environments where the MI (formerly MSI) RP isn't available.
miMockClientId: ''
miMockPrincipalId: ''

# disable KV softdelete for easy cleanup and recreate in INT
cxKeyVault:
softDelete: false
Expand Down
6 changes: 6 additions & 0 deletions config/config.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,12 @@
"firstPartyAppClientId": {
"type": "string"
},
"miMockClientId": {
"type": "string"
},
"miMockPrincipalId": {
"type": "string"
},
"frontend": {
"type": "object",
"properties": {
Expand Down
5 changes: 4 additions & 1 deletion config/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,14 +119,17 @@ clouds:
baseDnsZoneName: 'hcp.osadev.cloud'
# 1P app
firstPartyAppClientId: 57e54810-3138-4f38-bd3b-29cb33f4c358
# Mock Managed Identities Service Princiapl
miMockClientId: 4daa4e3b-abc1-4f9c-812c-77bd37e06741
miMockPrincipalId: a03f690c-4b2e-4eef-841e-f1904efe0e37
# Maestro
maestro:
postgres:
deploy: false
imageTag: ea066c250a002f0cc458711945165591bc9f6d3f
# Cluster Service
clusterService:
imageTag: aac7623
imageTag: ecd15ad
imageRepo: app-sre/uhc-clusters-service
# Hypershift Operator
hypershiftOperator:
Expand Down
4 changes: 3 additions & 1 deletion config/public-cloud-cs-pr.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
"clusterService": {
"acrRG": "global",
"imageRepo": "app-sre/uhc-clusters-service",
"imageTag": "aac7623",
"imageTag": "ecd15ad",
"postgres": {
"deploy": true,
"minTLSVersion": "TLSV1.2",
Expand Down Expand Up @@ -101,6 +101,8 @@
"private": false,
"softDelete": false
},
"miMockClientId": "4daa4e3b-abc1-4f9c-812c-77bd37e06741",
"miMockPrincipalId": "a03f690c-4b2e-4eef-841e-f1904efe0e37",
"monitoring": {
"grafanaAdminGroupPrincipalId": "6b6d3adf-8476-4727-9812-20ffdef2b85c",
"grafanaName": "arohcp-cspr",
Expand Down
4 changes: 3 additions & 1 deletion config/public-cloud-dev.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
"clusterService": {
"acrRG": "global",
"imageRepo": "app-sre/uhc-clusters-service",
"imageTag": "aac7623",
"imageTag": "ecd15ad",
"postgres": {
"deploy": true,
"minTLSVersion": "TLSV1.2",
Expand Down Expand Up @@ -101,6 +101,8 @@
"private": false,
"softDelete": false
},
"miMockClientId": "4daa4e3b-abc1-4f9c-812c-77bd37e06741",
"miMockPrincipalId": "a03f690c-4b2e-4eef-841e-f1904efe0e37",
"monitoring": {
"grafanaAdminGroupPrincipalId": "6b6d3adf-8476-4727-9812-20ffdef2b85c",
"grafanaName": "arohcp-dev",
Expand Down
4 changes: 3 additions & 1 deletion config/public-cloud-msft-int.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
"clusterService": {
"acrRG": "westus3-shared-resources",
"imageRepo": "app-sre/uhc-clusters-service",
"imageTag": "aac7623",
"imageTag": "ecd15ad",
"postgres": {
"deploy": true,
"minTLSVersion": "TLSV1.2",
Expand Down Expand Up @@ -101,6 +101,8 @@
"private": false,
"softDelete": false
},
"miMockClientId": "",
"miMockPrincipalId": "",
"monitoring": {
"grafanaAdminGroupPrincipalId": "??? the one to be used as Grafana Admin in grafana.bicep ???",
"grafanaName": "arohcp-int",
Expand Down
4 changes: 3 additions & 1 deletion config/public-cloud-personal-dev.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
"clusterService": {
"acrRG": "global",
"imageRepo": "app-sre/uhc-clusters-service",
"imageTag": "aac7623",
"imageTag": "ecd15ad",
"postgres": {
"deploy": false,
"minTLSVersion": "TLSV1.2",
Expand Down Expand Up @@ -101,6 +101,8 @@
"private": false,
"softDelete": false
},
"miMockClientId": "4daa4e3b-abc1-4f9c-812c-77bd37e06741",
"miMockPrincipalId": "a03f690c-4b2e-4eef-841e-f1904efe0e37",
"monitoring": {
"grafanaAdminGroupPrincipalId": "6b6d3adf-8476-4727-9812-20ffdef2b85c",
"grafanaName": "arohcp-usw3tst",
Expand Down
Loading