Enable Azure RBAC changes

DFE-Digital · Jan 30, 2024 · c488fff · c488fff
1 parent d87aa14
commit c488fff
Show file tree

Hide file tree

Showing 4 changed files with 19 additions and 4 deletions.
diff --git a/.github/actions/deploy/action.yml b/.github/actions/deploy/action.yml
@@ -80,7 +80,7 @@ runs:
           ${{ env.key_vault_app_secret_name }}
           ${{ env.key_vault_infra_secret_name }}
 
-    - uses: DFE-Digital/github-actions/set-arm-environment-variables@master
+    - uses: DFE-Digital/github-actions/set-kubelogin-environment@master
       with:
         azure-credentials: ${{ inputs.azure-credentials }}
 
@@ -110,7 +110,7 @@ runs:
     - name: K8 setup
       shell: bash
       run: |
-        az aks get-credentials -g ${{ env.cluster_rg }} -n ${{ env.cluster_name }}
+        make ${{ inputs.environment }} get-cluster-credentials  cluster_rg=${{ env.cluster_rg }} cluster_name=${{ env.cluster_name }}
         make install-konduit
 
     - name: Generate example data

diff --git a/.github/workflows/delete-review-app.yml b/.github/workflows/delete-review-app.yml
@@ -45,7 +45,7 @@ jobs:
         with:
           terraform_version: ${{ env.TERRAFORM_VERSION }}
 
-      - uses: DFE-Digital/github-actions/set-arm-environment-variables@master
+      - uses: DFE-Digital/github-actions/set-kubelogin-environment@master
         if: env.TF_STATE_EXISTS == 'true'
         with:
           azure-credentials: ${{ secrets.AZURE_CREDENTIALS_REVIEW }}

diff --git a/Makefile b/Makefile
@@ -2,6 +2,8 @@ TERRAFILE_VERSION=0.8
 ARM_TEMPLATE_TAG=1.1.0
 RG_TAGS={"Product" : "Database of Qualified Teachers"}
 SERVICE_SHORT=ccbl
+cluster_rg=""
+cluster_name=""
 
 .PHONY: install-konduit
 install-konduit: ## Install the konduit script, for accessing backend services
@@ -100,7 +102,12 @@ print-infra-secrets: read-tf-config install-fetch-config set-azure-account
 	bin/fetch_config.rb -s azure-key-vault-secret:${key_vault_name}/${key_vault_infra_secret_name} -f yaml
 
 get-cluster-credentials: read-cluster-config set-azure-account ## make <config> get-cluster-credentials [ENVIRONMENT=<clusterX>]
-	az aks get-credentials --overwrite-existing -g ${AZURE_RESOURCE_PREFIX}-tsc-${CLUSTER_SHORT}-rg -n ${AZURE_RESOURCE_PREFIX}-tsc-${CLUSTER}-aks
+ifeq ($(GITHUB_ACTIONS),)
+	$(eval export cluster_rg= ${AZURE_RESOURCE_PREFIX}-tsc-${CLUSTER_SHORT}-rg)
+	$(eval export cluster_name= ${AZURE_RESOURCE_PREFIX}-tsc-${CLUSTER}-aks)
+endif
+	az aks get-credentials --overwrite-existing -g ${cluster_rg} -n ${cluster_name}
+	kubelogin convert-kubeconfig -l $(if ${GITHUB_ACTIONS},spn,azurecli)
 
 set-what-if:
 	$(eval WHAT_IF=--what-if)

diff --git a/terraform/aks/providers.tf b/terraform/aks/providers.tf
@@ -13,6 +13,14 @@ provider "kubernetes" {
   client_certificate     = module.cluster_data.kubernetes_client_certificate
   client_key             = module.cluster_data.kubernetes_client_key
   cluster_ca_certificate = module.cluster_data.kubernetes_cluster_ca_certificate
+    dynamic "exec" {
+    for_each = module.cluster_data.azure_RBAC_enabled ? [1] : []
+    content {
+      api_version = "client.authentication.k8s.io/v1beta1"
+      command     = "kubelogin"
+      args        = module.cluster_data.kubelogin_args
+    }
+  }
 }
 
 provider "statuscake" {