Skip to content

Commit 44f1d35

Browse files
bennervbennerv
authored
Merge pull request #1011 from Azure/skuznets/acrpull
ARO-9420: *: add acrpull controller, binding
2 parents 0541955 + ec8553a commit 44f1d35

File tree

6 files changed

+92
-21
lines changed

6 files changed

+92
-21
lines changed

‎dev-infrastructure/Makefile

Lines changed: 12 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -27,23 +27,18 @@ list:
2727
@grep '^[^#[:space:]].*:' Makefile
2828
.PHONY: list
2929

30-
fmt:
31-
set -e; \
32-
FILES="$$(find . -type f -name "*.bicep*" ! -name "*.tmpl.bicepparam")"; \
33-
for file in $$FILES; do \
34-
echo "az bicep format --file $${file}"; \
35-
az bicep format --file $$file; \
36-
done
37-
.PHONY: fmt
38-
39-
lint:
40-
set -e; \
41-
FILES="$$(find . -type f -name "*.bicep*" ! -name "*.tmpl.bicepparam")"; \
42-
for file in $$FILES; do \
43-
echo "az bicep lint --file $${file}"; \
44-
az bicep lint --file $$file; \
45-
done
46-
.PHONY: lint
30+
modules := $(wildcard ./templates/*.bicep)
31+
parameters := $(filter-out $(wildcard ./templates/*.tmpl.bicepparam),$(wildcard ./templates/*.bicepparam))
32+
33+
fmt: $(modules:.bicep=.bicep.fmt) $(parameters:.bicepparam=.biceparam.fmt)
34+
35+
lint: $(modules:.bicep=.bicep.lint) $(parameters:.bicepparam=.biceparam.lint)
36+
37+
%.bicep.fmt %.bicepparam.fmt:
38+
az bicep format --file $(basename $@)
39+
40+
%.bicep.lint %.bicepparam.lint:
41+
az bicep lint --file $(basename $@)
4742

4843
feature-registration: # hardcoded to eastus as this is a subscription deployment, not a resource group
4944
@az deployment sub create \

‎dev-infrastructure/modules/aks-cluster-base.bicep

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -469,6 +469,42 @@ resource uami_fedcred 'Microsoft.ManagedIdentity/userAssignedIdentities/federate
469469
}
470470
]
471471

472+
//
473+
// A C R P U L L C O N T R O L L E R
474+
//
475+
476+
resource pullerIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
477+
location: location
478+
name: 'image-puller'
479+
}
480+
481+
module acrPullerRoles 'acr/acr-permissions.bicep' = [
482+
for (_, i) in acrPullResourceGroups: {
483+
name: guid(acrRg[i].id, aksCluster.id, acrPullRoleDefinitionId, 'puller-identity')
484+
scope: acrRg[i]
485+
params: {
486+
principalId: pullerIdentity.properties.principalId
487+
acrResourceGroupid: acrRg[i].id
488+
}
489+
}
490+
]
491+
492+
@batchSize(1)
493+
resource puller_fedcred 'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials@2023-01-31' = [
494+
for i in range(0, length(workloadIdentities)): {
495+
parent: pullerIdentity
496+
name: '${workloadIdentities[i].value.uamiName}-${location}-puller-fedcred'
497+
properties: {
498+
audiences: [
499+
'api://AzureCRTokenExchange'
500+
]
501+
issuer: aksCluster.properties.oidcIssuerProfile.issuerURL
502+
subject: 'system:serviceaccount:${workloadIdentities[i].value.namespace}:${workloadIdentities[i].value.serviceAccountName}'
503+
}
504+
}
505+
]
506+
507+
472508
// grant aroDevopsMsi the aksClusterAdmin role on the aksCluster so it can
473509
// deploy services to the cluster
474510
resource aroDevopsMSIClusterAdmin 'Microsoft.Authorization/roleAssignments@2022-04-01' = {

‎frontend/Makefile

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,9 @@ HELM_CMD ?= helm upgrade --install
55
ifndef COMMIT
66
COMMIT := $(shell git rev-parse --short=7 HEAD)
77
endif
8-
ARO_HCP_BASE_IMAGE ?= ${ARO_HCP_IMAGE_ACR}.azurecr.io
9-
ARO_HCP_FRONTEND_IMAGE ?= $(ARO_HCP_BASE_IMAGE)/arohcpfrontend:$(COMMIT)
8+
ARO_HCP_IMAGE_REGISTRY ?= ${ARO_HCP_IMAGE_ACR}.azurecr.io
9+
ARO_HCP_IMAGE_REPOSITORY ?= arohcpfrontend
10+
ARO_HCP_FRONTEND_IMAGE ?= $(ARO_HCP_IMAGE_REGISTRY)/$(ARO_HCP_IMAGE_REPOSITORY):$(COMMIT)
1011

1112
.DEFAULT_GOAL := frontend
1213

@@ -44,11 +45,23 @@ deploy:
4445
FRONTEND_MI_CLIENT_ID=$$(az identity show \
4546
-g ${RESOURCEGROUP} \
4647
-n frontend \
47-
--query clientId -o tsv); \
48+
--query clientId -o tsv) && \
49+
FRONTEND_MI_TENANT_ID=$$(az identity show \
50+
-g ${RESOURCEGROUP} \
51+
-n frontend \
52+
--query tenantId -o tsv) &&\
53+
IMAGE_PULLER_MI_CLIENT_ID=$$(az identity show \
54+
-g ${RESOURCEGROUP} \
55+
-n image-puller \
56+
--query clientId -o tsv) && \
57+
IMAGE_PULLER_MI_TENANT_ID=$$(az identity show \
58+
-g ${RESOURCEGROUP} \
59+
-n image-puller \
60+
--query tenantId -o tsv) && \
4861
SECRET_STORE_MI_CLIENT_ID=$$(az aks show --resource-group ${RESOURCEGROUP} \
4962
--name ${AKS_NAME} \
5063
--query addonProfiles.azureKeyvaultSecretsProvider.identity.clientId \
51-
--output tsv); \
64+
--output tsv) && \
5265
DB_URL=$$(az cosmosdb show -n ${DB_NAME} -g ${RESOURCEGROUP} --query documentEndpoint -o tsv) && \
5366
TENANT_ID=$(shell az account show --query tenantId --output tsv) && \
5467
kubectl create namespace aro-hcp --dry-run=client -o json | kubectl apply -f - && \
@@ -63,9 +76,14 @@ deploy:
6376
--set credsKeyVault.name=${SERVICE_KEY_VAULT} \
6477
--set credsKeyVault.secret=${CERTIFICATE_NAME} \
6578
--set serviceAccount.workloadIdentityClientId="$${FRONTEND_MI_CLIENT_ID}" \
79+
--set serviceAccount.workloadIdentityTenantId="$${FRONTEND_MI_TENANT_ID}" \
80+
--set pullBinding.workloadIdentityClientId="$${IMAGE_PULLER_MI_CLIENT_ID}" \
81+
--set pullBinding.workloadIdentityTenantId="$${IMAGE_PULLER_MI_TENANT_ID}" \
6682
--set configMap.currentVersion=${ARO_HCP_FRONTEND_IMAGE} \
6783
--set configMap.location=${LOCATION} \
6884
--set deployment.imageName=${ARO_HCP_FRONTEND_IMAGE} \
85+
--set pullBinding.registry=${ARO_HCP_IMAGE_REGISTRY} \
86+
--set pullBinding.scope=repository:${ARO_HCP_IMAGE_REPOSITORY}:pull \
6987
--namespace aro-hcp
7088
.PHONY: deploy
7189

‎frontend/deploy/helm/frontend/templates/acrpullbinding.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: acrpull.microsoft.com/v1beta2
2+
kind: AcrPullBinding
3+
metadata:
4+
name: pull-binding
5+
spec:
6+
acr:
7+
environment: PublicCloud
8+
server: {{ .Values.pullBinding.registry }}
9+
scope: {{ .Values.pullBinding.scope }}
10+
auth:
11+
workloadIdentity:
12+
serviceAccountRef: frontend
13+
clientID: {{ .Values.pullBinding.workloadIdentityClientId }}
14+
tenantID: {{ .Values.pullBinding.workloadIdentityTenantId }}
15+
serviceAccountName: frontend

‎frontend/deploy/helm/frontend/templates/serviceaccount.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,5 @@ kind: ServiceAccount
33
metadata:
44
annotations:
55
azure.workload.identity/client-id: '{{ .Values.serviceAccount.workloadIdentityClientId }}'
6+
azure.workload.identity/tenant-id: '{{ .Values.serviceAccount.workloadIdentityTenantId }}'
67
name: frontend

‎frontend/deploy/helm/frontend/values.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,9 @@ deployment:
1414
imageName: ""
1515
serviceAccount:
1616
workloadIdentityClientId: ""
17+
workloadIdentityTenantId: ""
18+
pullBinding:
19+
registry: ""
20+
scope: ""
21+
workloadIdentityClientId: ""
22+
workloadIdentityTenantId: ""

0 commit comments

Comments
 (0)