Add userassignedidentity for EncryptionWithExternalKms (#4089)

Azure · Oct 22, 2018 · 6e195e9 · 6e195e9
1 parent 1f21059
commit 6e195e9
Show file tree

Hide file tree

Showing 4 changed files with 21 additions and 3 deletions.
diff --git a/parts/k8s/kubernetesagentresourcesvmas.t b/parts/k8s/kubernetesagentresourcesvmas.t
@@ -174,7 +174,7 @@
       "identity": {
         "type": "userAssigned",
         "userAssignedIdentities": {
-          "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities/', variables('userAssignedID'))]":{}
+          "[variables('userAssignedIDReference')]":{}
         }
       },
       {{else}}

diff --git a/parts/k8s/kubernetesagentresourcesvmss.t b/parts/k8s/kubernetesagentresourcesvmss.t
@@ -35,7 +35,7 @@
     "identity": {
       "type": "userAssigned",
       "userAssignedIdentities": {
-        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities/', variables('userAssignedID'))]":{}
+        "[variables('userAssignedIDReference')]":{}
       }
     },
     {{else}}

diff --git a/parts/k8s/kubernetesmasterresources.t b/parts/k8s/kubernetesmasterresources.t
@@ -640,6 +640,9 @@
        {{ if UseManagedIdentity}}
        "dependsOn": 
        [
+       {{if UserAssignedIDEnabled}}
+       "[variables('userAssignedIDReference')]"
+       {{else}}
           {{$max := .MasterProfile.Count}}
           {{$c := subtract $max 1}}
           {{range $i := loop 0 $max}}
@@ -653,6 +656,7 @@
                 {{end}}
             {{end}}
           {{end}}
+        {{end}}
         ],
        {{end}}
        "properties": {
@@ -661,6 +665,18 @@
          "enabledForTemplateDeployment": "false",
          "tenantId": "[variables('tenantID')]",
  {{if UseManagedIdentity}}
+    {{if UserAssignedIDEnabled}}
+        "accessPolicies": 
+        [
+          {
+            "tenantId": "[variables('tenantID')]",
+            "objectId": "[reference(variables('userAssignedIDReference'), variables('apiVersionManagedIdentity')).principalId]",
+            "permissions": {
+              "keys": ["create", "encrypt", "decrypt", "get", "list"]
+            }
+          }
+        ],
+    {{else}}
         "accessPolicies":
         [
           {{$max := .MasterProfile.Count}}
@@ -699,6 +715,7 @@
             {{end}}
           {{end}}
          ],
+    {{end}}
  {{else}}
           "accessPolicies": [
             {
@@ -745,7 +762,7 @@
       "identity": {
         "type": "userAssigned",
         "userAssignedIdentities": {
-          "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities/', variables('userAssignedID'))]":{}
+          "[variables('userAssignedIDReference')]":{}
         }
       },
       {{else}}

diff --git a/parts/k8s/kubernetesmastervars.t b/parts/k8s/kubernetesmastervars.t
@@ -68,6 +68,7 @@
     "useManagedIdentityExtension": "{{ UseManagedIdentity }}",
     "userAssignedID": "{{UserAssignedID}}",
     "userAssignedClientID": "{{UserAssignedClientID}}",
+    "userAssignedIDReference": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities/', variables('userAssignedID'))]",
     "useInstanceMetadata": "{{ UseInstanceMetadata }}",
     "loadBalancerSku": "{{ LoadBalancerSku }}",
     "excludeMasterFromStandardLB": "{{ ExcludeMasterFromStandardLB }}",