Merge pull request #2132 from Infisical/daniel/operator-azure-fix

feat(k8-operator): customizable azure auth resource url
Infisical · Jul 16, 2024 · df3a87f · df3a87f
2 parents 9b0b14b + 6ceeccf
commit df3a87f
Show file tree

Hide file tree

Showing 10 changed files with 15 additions and 74 deletions.
diff --git a/docs/integrations/platforms/kubernetes.mdx b/docs/integrations/platforms/kubernetes.mdx
@@ -122,6 +122,7 @@ spec:
         # Azure Auth
         azureAuth:
             identityId: <your-machine-identity-id>
+            resource: https://management.azure.com/&client_id=CLIENT_ID # (Optional) This is the Azure resource that you want to access. For example, "https://management.azure.com/". If no value is provided, it will default to "https://management.azure.com/"
 
             # secretsScope is identical to the secrets scope in the universalAuth field in this sample.
             secretsScope:

diff --git a/helm-charts/secrets-operator/Chart.yaml b/helm-charts/secrets-operator/Chart.yaml
@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v0.6.4
+version: v0.6.5
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v0.6.4"
+appVersion: "v0.6.5"
diff --git a/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml
@@ -64,6 +64,8 @@ spec:
                     properties:
                       identityId:
                         type: string
+                      resource:
+                        type: string
                       secretsScope:
                         properties:
                           envSlug:

diff --git a/helm-charts/secrets-operator/values.yaml b/helm-charts/secrets-operator/values.yaml
@@ -32,7 +32,7 @@ controllerManager:
         - ALL
     image:
       repository: infisical/kubernetes-operator
-      tag: v0.6.4
+      tag: v0.6.5
     resources:
       limits:
         cpu: 500m

diff --git a/k8-operator/api/v1alpha1/infisicalsecret_types.go b/k8-operator/api/v1alpha1/infisicalsecret_types.go
@@ -58,6 +58,8 @@ type AWSIamAuthDetails struct {
 type AzureAuthDetails struct {
 	// +kubebuilder:validation:Required
 	IdentityID string `json:"identityId"`
+	// +kubebuilder:validation:Optional
+	Resource string `json:"resource"`
 
 	// +kubebuilder:validation:Required
 	SecretsScope MachineIdentityScopeInWorkspace `json:"secretsScope"`

diff --git a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml
@@ -64,6 +64,8 @@ spec:
                     properties:
                       identityId:
                         type: string
+                      resource:
+                        type: string
                       secretsScope:
                         properties:
                           envSlug:

diff --git a/k8-operator/config/samples/sample.yaml b/k8-operator/config/samples/sample.yaml
@@ -60,6 +60,7 @@ spec:
         # Azure Auth
         azureAuth:
             identityId: <your-machine-identity-id>
+            resource: https://management.azure.com/&client_id=your_client_id # This field is optional, and will default to "https://management.azure.com/" if nothing is provided. 
 
             # secretsScope is identical to the secrets scope in the universalAuth field in this sample.
             secretsScope:

diff --git a/k8-operator/controllers/infisicalsecret_auth.go b/k8-operator/controllers/infisicalsecret_auth.go
@@ -109,7 +109,7 @@ func (r *InfisicalSecretReconciler) handleAzureAuth(ctx context.Context, infisic
 		return AuthenticationDetails{}, ErrAuthNotApplicable
 	}
 
-	_, err := infisicalClient.Auth().AzureAuthLogin(azureAuthSpec.IdentityID)
+	_, err := infisicalClient.Auth().AzureAuthLogin(azureAuthSpec.IdentityID, azureAuthSpec.Resource) // If resource is empty(""), it will default to "https://management.azure.com/" in the SDK.
 	if err != nil {
 		return AuthenticationDetails{}, fmt.Errorf("unable to login with Azure auth [err=%s]", err)
 	}

diff --git a/k8-operator/go.mod b/k8-operator/go.mod
@@ -3,7 +3,7 @@ module github.com/Infisical/infisical/k8-operator
 go 1.21
 
 require (
-	github.com/infisical/go-sdk v0.2.1
+	github.com/infisical/go-sdk v0.3.2
 	github.com/onsi/ginkgo/v2 v2.6.0
 	github.com/onsi/gomega v1.24.1
 	k8s.io/apimachinery v0.26.1

diff --git a/k8-operator/go.sum b/k8-operator/go.sum