Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for user assigned identities in AKS #8737

Merged
merged 15 commits into from
Jan 18, 2021
Merged

Add support for user assigned identities in AKS #8737

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
c25db9c
Add support for user assigned identities
flo-02-mu Oct 3, 2020
89f2cda
Add documentation for user assigned identity
flo-02-mu Oct 3, 2020
0f9130d
Update vendor modules
flo-02-mu Oct 3, 2020
22bd025
Merge branch 'master' into 7979-aks-user-assigned-identities
flo-02-mu Nov 5, 2020
ea42116
Resolve merge conflict
flo-02-mu Nov 5, 2020
6bc6470
Ensure conditionally required identity fields are valid
timja Jan 5, 2021
d52d23d
Merge pull request #1 from timja/7979-aks-user-assigned-identities
flo-02-mu Jan 5, 2021
4beafb5
Merge branch 'master' into 7979-aks-user-assigned-identities-merge-wi…
timja Jan 12, 2021
8e698d4
Parse ID
timja Jan 13, 2021
d2b053a
Merge branch 'master' into 7979-aks-user-assigned-identities-merge-wi…
timja Jan 13, 2021
19f3db5
Merge pull request #2 from timja/7979-aks-user-assigned-identities-me…
flo-02-mu Jan 13, 2021
d124bde
Merge branch 'master' into 7979-aks-user-assigned-identities
flo-02-mu Jan 13, 2021
6409745
Remove duplicate import
flo-02-mu Jan 13, 2021
7734cfd
Handle panic and interpolation isse
timja Jan 14, 2021
bcdd700
Merge remote-tracking branch 'upstream/master' into 7979-aks-user-ass…
flo-02-mu Jan 14, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions azurerm/internal/services/containers/kubernetes_cluster_data_source.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -265,6 +265,10 @@ func dataSourceArmKubernetesCluster() *schema.Resource {
Type: schema.TypeString,
Computed: true,
},
"user_assigned_identity_id": {
Type: schema.TypeString,
Computed: true,
},
"principal_id": {
Type: schema.TypeString,
Computed: true,
Expand Down Expand Up @@ -1098,6 +1102,15 @@ func flattenKubernetesClusterDataSourceManagedClusterIdentity(input *containerse
identity["tenant_id"] = *input.TenantID
}

identity["user_assigned_identity_id"] = ""
if input.UserAssignedIdentities != nil {
keys := []string{}
for key := range input.UserAssignedIdentities {
keys = append(keys, key)
tombuildsstuff marked this conversation as resolved.
Show resolved Hide resolved
}
identity["user_assigned_identity_id"] = keys[0]
}

identity["type"] = string(input.Type)

return []interface{}{identity}
Expand Down
25 changes: 25 additions & 0 deletions azurerm/internal/services/containers/kubernetes_cluster_resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,8 +179,13 @@ func resourceArmKubernetesCluster() *schema.Resource {
ForceNew: true,
ValidateFunc: validation.StringInSlice([]string{
string(containerservice.ResourceIdentityTypeSystemAssigned),
string(containerservice.ResourceIdentityTypeUserAssigned),
}, false),
},
"user_assigned_identity_id": {
Type: schema.TypeString,
Optional: true,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

there doesn't appear to be any validation for this actually being set,
I was able to submit this without and terraform started applying, I got this error back from the API:

Error: creating Managed Kubernetes Cluster "ss-demo-01-aks" (Resource Group "ss-demo-01-rg"): containerservice.ManagedClustersClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="LinkedInvalidPropertyId" Message="Property id '' at path '' is invalid. Expect fully qualified resource Id that start with '/subscriptions/{subscriptionId}' or '/providers/{resourceProviderNamespace}/'."

  on .terraform/modules/kubernetes/12-kubernetes-cluster.tf line 5, in resource "azurerm_kubernetes_cluster" "kubernetes_cluster":
   5: resource "azurerm_kubernetes_cluster" "kubernetes_cluster" {

I've created a PR for this here: flo-02-mu#1

after my change you get:

Error: when `identity.type` is UserAssigned then `user_assigned_identity_id` must be set

  on .terraform/modules/kubernetes/12-kubernetes-cluster.tf line 5, in resource "azurerm_kubernetes_cluster" "kubernetes_cluster":
   5: resource "azurerm_kubernetes_cluster" "kubernetes_cluster" {

},
"principal_id": {
Type: schema.TypeString,
Computed: true,
Expand Down Expand Up @@ -1711,6 +1716,17 @@ func expandKubernetesClusterManagedClusterIdentity(input []interface{}) *contain

values := input[0].(map[string]interface{})

if containerservice.ResourceIdentityType(values["type"].(string)) == containerservice.ResourceIdentityTypeUserAssigned {
userAssignedIdentities := map[string]*containerservice.ManagedClusterIdentityUserAssignedIdentitiesValue{
values["user_assigned_identity_id"].(string): {},
}

return &containerservice.ManagedClusterIdentity{
Type: containerservice.ResourceIdentityType(values["type"].(string)),
UserAssignedIdentities: userAssignedIdentities,
}
}

return &containerservice.ManagedClusterIdentity{
Type: containerservice.ResourceIdentityType(values["type"].(string)),
}
Expand Down Expand Up @@ -1874,6 +1890,15 @@ func flattenKubernetesClusterManagedClusterIdentity(input *containerservice.Mana
identity["tenant_id"] = *input.TenantID
}

identity["user_assigned_identity_id"] = ""
if input.UserAssignedIdentities != nil {
keys := []string{}
for key := range input.UserAssignedIdentities {
keys = append(keys, key)
tombuildsstuff marked this conversation as resolved.
Show resolved Hide resolved
}
identity["user_assigned_identity_id"] = keys[0]
}

identity["type"] = string(input.Type)

return []interface{}{identity}
Expand Down
17 changes: 17 additions & 0 deletions azurerm/internal/services/containers/kubernetes_cluster_validate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,23 @@ func validateKubernetesCluster(d *schema.ResourceData, cluster *containerservice
}
}

// ensure conditionally-required identity values are valid
if v, exists := d.GetOk("identity"); exists {
rawIdentity := v.([]interface{})

if len(rawIdentity) != 0 {
identity := rawIdentity[0].(map[string]interface{})

if identityType := identity["type"].(string); identityType == string(containerservice.ResourceIdentityTypeUserAssigned) {
userAssignedIdentityId := identity["user_assigned_identity_id"].(string)

if userAssignedIdentityId == "" {
return fmt.Errorf("when `identity.type` is UserAssigned then `user_assigned_identity_id` must be set")
}
}
}
}
tombuildsstuff marked this conversation as resolved.
Show resolved Hide resolved

// @tombuildsstuff: As of 2020-03-30 it's no longer possible to create a cluster using a Service Principal
// for authentication (albeit this worked on 2020-03-27 via API version 2019-10-01 :shrug:). However it's
// possible to rotate the Service Principal for an existing Cluster - so this needs to be supported via
Expand Down
65 changes: 65 additions & 0 deletions azurerm/internal/services/containers/tests/kubernetes_cluster_auth_resource_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ import (
var kubernetesAuthTests = map[string]func(t *testing.T){
"apiServerAuthorizedIPRanges": testAccAzureRMKubernetesCluster_apiServerAuthorizedIPRanges,
"managedClusterIdentity": testAccAzureRMKubernetesCluster_managedClusterIdentity,
"userAssignedIdentity": testAccAzureRMKubernetesCluster_userAssignedIdentity,
"roleBasedAccessControl": testAccAzureRMKubernetesCluster_roleBasedAccessControl,
"AAD": testAccAzureRMKubernetesCluster_roleBasedAccessControlAAD,
"AADUpdateToManaged": testAccAzureRMKubernetesCluster_roleBasedAccessControlAADUpdateToManaged,
Expand Down Expand Up @@ -61,6 +62,11 @@ func TestAccAzureRMKubernetesCluster_managedClusterIdentity(t *testing.T) {
testAccAzureRMKubernetesCluster_managedClusterIdentity(t)
}

func TestAccAzureRMKubernetesCluster_userAssignedIdentity(t *testing.T) {
checkIfShouldRunTestsIndividually(t)
testAccAzureRMKubernetesCluster_userAssignedIdentity(t)
}

func testAccAzureRMKubernetesCluster_managedClusterIdentity(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_kubernetes_cluster", "test")

Expand All @@ -85,6 +91,27 @@ func testAccAzureRMKubernetesCluster_managedClusterIdentity(t *testing.T) {
})
}

func testAccAzureRMKubernetesCluster_userAssignedIdentity(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_kubernetes_cluster", "test")

resource.ParallelTest(t, resource.TestCase{
PreCheck: func() { acceptance.PreCheck(t) },
Providers: acceptance.SupportedProviders,
CheckDestroy: testCheckAzureRMKubernetesClusterDestroy,
Steps: []resource.TestStep{
{
Config: testAccAzureRMKubernetesCluster_userAssignedIdentityConfig(data),
Check: resource.ComposeTestCheckFunc(
testCheckAzureRMKubernetesClusterExists(data.ResourceName),
resource.TestCheckResourceAttr(data.ResourceName, "identity.0.type", "UserAssigned"),
resource.TestCheckResourceAttrSet(data.ResourceName, "identity.0.user_assigned_identity_id"),
),
},
data.ImportStep(),
},
})
}

func TestAccAzureRMKubernetesCluster_roleBasedAccessControl(t *testing.T) {
checkIfShouldRunTestsIndividually(t)
testAccAzureRMKubernetesCluster_roleBasedAccessControl(t)
Expand Down Expand Up @@ -479,6 +506,44 @@ resource "azurerm_kubernetes_cluster" "test" {
`, data.RandomInteger, data.Locations.Primary, data.RandomInteger, data.RandomInteger)
}

func testAccAzureRMKubernetesCluster_userAssignedIdentityConfig(data acceptance.TestData) string {
return fmt.Sprintf(`
provider "azurerm" {
features {}
}

resource "azurerm_resource_group" "test" {
name = "acctestRG-aks-%d"
location = "%s"
}

resource "azurerm_user_assigned_identity" "test" {
resource_group_name = azurerm_resource_group.test.name
location = azurerm_resource_group.test.location
name = "test_identity"
}

resource "azurerm_kubernetes_cluster" "test" {
name = "acctestaks%d"
location = azurerm_resource_group.test.location
resource_group_name = azurerm_resource_group.test.name
dns_prefix = "acctestaks%d"

default_node_pool {
name = "default"
node_count = 1
vm_size = "Standard_DS2_v2"
}

identity {
type = "UserAssigned"
user_assigned_identity_id = azurerm_user_assigned_identity.test.id
}

}
`, data.RandomInteger, data.Locations.Primary, data.RandomInteger, data.RandomInteger)
}

func testAccAzureRMKubernetesCluster_roleBasedAccessControlConfig(data acceptance.TestData) string {
return fmt.Sprintf(`
provider "azurerm" {
Expand Down
3 changes: 2 additions & 1 deletion website/docs/r/kubernetes_cluster.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -277,7 +277,8 @@ A `http_application_routing` block supports the following:

A `identity` block supports the following:

* `type` - The type of identity used for the managed cluster. At this time the only supported value is `SystemAssigned`.
* `type` - The type of identity used for the managed cluster. Possible values are `SystemAssigned` and `UserAssigned`. If `UserAssigned` is set, a `user_assigned_identity_id` must be set as well.
* `user_assigned_identity_id` - (Optional) The ID of a user assigned identity.

---

Expand Down