-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(aks): Split workload identity into init and configuration (#345)
* kubernetes_workload_identity_init starts * kubernetes_workload_identity_configuration * minor fix * fix outputs * fix docs * removed variables not needed * pre-commit fixs
- Loading branch information
1 parent
2334835
commit 73602bc
Showing
12 changed files
with
195 additions
and
43 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
File renamed without changes
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
18 changes: 9 additions & 9 deletions
18
kubernetes_workload_identity/outputs.tf → ...orkload_identity_configuration/outputs.tf
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
14 changes: 2 additions & 12 deletions
14
kubernetes_workload_identity/variables.tf → ...kload_identity_configuration/variables.tf
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| # Kubernetes Workload Identity init | ||
|
|
||
| Module that allows the creation of a workload identity. | ||
|
|
||
| To enable workload identity this others resources are created: | ||
|
|
||
| * User managed identity | ||
| * lock (this allow to avoid to delete the managed identity and change the client used by apps) | ||
|
|
||
| ## How to use it | ||
|
|
||
| ```hcl | ||
| module "workload_identity" { | ||
| source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//kubernetes_workload_identity_init?ref=<your version>" | ||
| workload_name_prefix = var.domain | ||
| workload_identity_resource_group_name = data.azurerm_kubernetes_cluster.aks.resource_group_name | ||
| workload_identity_location = var.location | ||
| } | ||
| ``` | ||
|
|
||
| <!-- markdownlint-disable --> | ||
| <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK --> | ||
| ## Requirements | ||
|
|
||
| | Name | Version | | ||
| |------|---------| | ||
| | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.0 | | ||
| | <a name="requirement_azurerm"></a> [azurerm](#requirement\_azurerm) | ~>3.110 | | ||
| | <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | ~> 2.30.0 | | ||
| | <a name="requirement_null"></a> [null](#requirement\_null) | ~> 3.2 | | ||
|
|
||
| ## Modules | ||
|
|
||
| No modules. | ||
|
|
||
| ## Resources | ||
|
|
||
| | Name | Type | | ||
| |------|------| | ||
| | [azurerm_management_lock.managed_identity_lock](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/management_lock) | resource | | ||
| | [azurerm_user_assigned_identity.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/user_assigned_identity) | resource | | ||
|
|
||
| ## Inputs | ||
|
|
||
| | Name | Description | Type | Default | Required | | ||
| |------|-------------|------|---------|:--------:| | ||
| | <a name="input_enable_lock"></a> [enable\_lock](#input\_enable\_lock) | Allow to enable of disable lock for managed identity | `bool` | `true` | no | | ||
| | <a name="input_workload_identity_full_name"></a> [workload\_identity\_full\_name](#input\_workload\_identity\_full\_name) | (Optional) The full name for the user assigned identity and Workload identity. Changing this forces a new identity to be created. | `string` | `null` | no | | ||
| | <a name="input_workload_identity_location"></a> [workload\_identity\_location](#input\_workload\_identity\_location) | (Required) The Azure Region where the User Assigned Identity should exist. Changing this forces a new User Assigned Identity to be created. | `string` | n/a | yes | | ||
| | <a name="input_workload_identity_resource_group_name"></a> [workload\_identity\_resource\_group\_name](#input\_workload\_identity\_resource\_group\_name) | (Required) Specifies the name of the Resource Group within which this User Assigned Identity should exist. Changing this forces a new User Assigned Identity to be created. | `string` | n/a | yes | | ||
| | <a name="input_workload_name_prefix"></a> [workload\_name\_prefix](#input\_workload\_name\_prefix) | (Required) The name prefix of the user assigned identity and Workload identity. Changing this forces a new identity to be created. | `string` | n/a | yes | | ||
|
|
||
| ## Outputs | ||
|
|
||
| | Name | Description | | ||
| |------|-------------| | ||
| | <a name="output_user_assigned_identity_client_id"></a> [user\_assigned\_identity\_client\_id](#output\_user\_assigned\_identity\_client\_id) | n/a | | ||
| | <a name="output_user_assigned_identity_id"></a> [user\_assigned\_identity\_id](#output\_user\_assigned\_identity\_id) | n/a | | ||
| | <a name="output_user_assigned_identity_name"></a> [user\_assigned\_identity\_name](#output\_user\_assigned\_identity\_name) | n/a | | ||
| | <a name="output_user_assigned_identity_principal_id"></a> [user\_assigned\_identity\_principal\_id](#output\_user\_assigned\_identity\_principal\_id) | n/a | | ||
| | <a name="output_user_assigned_identity_resource_group_name"></a> [user\_assigned\_identity\_resource\_group\_name](#output\_user\_assigned\_identity\_resource\_group\_name) | n/a | | ||
| | <a name="output_workload_identity_client_id"></a> [workload\_identity\_client\_id](#output\_workload\_identity\_client\_id) | n/a | | ||
| | <a name="output_workload_identity_principal_id"></a> [workload\_identity\_principal\_id](#output\_workload\_identity\_principal\_id) | n/a | | ||
| <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK --> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| resource "azurerm_user_assigned_identity" "this" { | ||
| name = local.workload_identity_name | ||
|
|
||
| resource_group_name = var.workload_identity_resource_group_name | ||
| location = var.workload_identity_location | ||
| } | ||
|
|
||
| resource "azurerm_management_lock" "managed_identity_lock" { | ||
| count = var.enable_lock ? 1 : 0 | ||
|
|
||
| name = local.workload_identity_name | ||
| scope = azurerm_user_assigned_identity.this.id | ||
| lock_level = "CanNotDelete" | ||
| notes = "Locked because it's needed by terraform" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| output "user_assigned_identity_id" { | ||
| value = azurerm_user_assigned_identity.this.id | ||
| } | ||
|
|
||
| output "user_assigned_identity_name" { | ||
| value = azurerm_user_assigned_identity.this.name | ||
| } | ||
|
|
||
| output "user_assigned_identity_resource_group_name" { | ||
| value = azurerm_user_assigned_identity.this.resource_group_name | ||
| } | ||
|
|
||
| output "user_assigned_identity_principal_id" { | ||
| value = azurerm_user_assigned_identity.this.principal_id | ||
| } | ||
|
|
||
| output "user_assigned_identity_client_id" { | ||
| value = azurerm_user_assigned_identity.this.client_id | ||
| } | ||
|
|
||
| output "workload_identity_client_id" { | ||
| value = azurerm_user_assigned_identity.this.client_id | ||
| } | ||
|
|
||
| output "workload_identity_principal_id" { | ||
| value = azurerm_user_assigned_identity.this.principal_id | ||
| } | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| locals { | ||
| workload_identity_name = var.workload_identity_full_name != null ? var.workload_identity_full_name : "${var.workload_name_prefix}-workload-identity" | ||
| } | ||
|
|
||
| variable "workload_name_prefix" { | ||
| type = string | ||
| description = "(Required) The name prefix of the user assigned identity and Workload identity. Changing this forces a new identity to be created." | ||
| } | ||
|
|
||
| variable "workload_identity_full_name" { | ||
| type = string | ||
| description = "(Optional) The full name for the user assigned identity and Workload identity. Changing this forces a new identity to be created." | ||
| default = null | ||
| } | ||
|
|
||
| variable "workload_identity_resource_group_name" { | ||
| type = string | ||
| description = "(Required) Specifies the name of the Resource Group within which this User Assigned Identity should exist. Changing this forces a new User Assigned Identity to be created." | ||
| } | ||
|
|
||
| variable "workload_identity_location" { | ||
| type = string | ||
| description = "(Required) The Azure Region where the User Assigned Identity should exist. Changing this forces a new User Assigned Identity to be created." | ||
| } | ||
|
|
||
| variable "enable_lock" { | ||
| type = bool | ||
| description = "Allow to enable of disable lock for managed identity" | ||
| default = true | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| terraform { | ||
| required_version = ">= 1.5.0" | ||
|
|
||
| required_providers { | ||
| azurerm = { | ||
| source = "hashicorp/azurerm" | ||
| version = "~>3.110" | ||
| } | ||
| null = { | ||
| source = "hashicorp/null" | ||
| version = "~> 3.2" | ||
| } | ||
| kubernetes = { | ||
| source = "hashicorp/kubernetes" | ||
| version = "~> 2.30.0" | ||
| } | ||
| } | ||
| } |