Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-05-15 04:32:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

cli: use uami for in-cluter authentication (#1820)

Browse source
This commit is contained in:
3u13r 2023-05-26 11:45:03 +02:00 • committed by GitHub
parent 9502bc8ff4
commit 661f084ffa
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
13 changed files with 65 additions and 117 deletions
Download patch file Download diff file Expand all files Collapse all files

28
cli/internal/terraform/terraform/iam/azure/main.tf
View file

@ -68,31 +68,3 @@ resource "azurerm_role_assignment" "uami_owner_role" {
role_definition_name = "Owner"
principal_id = azurerm_user_assigned_identity.identity_uami.principal_id
}
# the app registration, application secrets
# and role assignments below will be removed in the future
# TODO(malt3): remove app registration as planned by AB#2961
# Create application registration
resource "azuread_application" "base_application" {
display_name = "${var.resource_group_name}-application"
owners = [data.azuread_client_config.current.object_id]
}
resource "azuread_service_principal" "application_principal" {
application_id = azuread_application.base_application.application_id
app_role_assignment_required = false
owners = [data.azuread_client_config.current.object_id]
}
# Set identity as base resource group owner
resource "azurerm_role_assignment" "app_registration_owner_role" {
scope = azurerm_resource_group.base_resource_group.id
role_definition_name = "Owner"
principal_id = azuread_service_principal.application_principal.object_id
}
# Create application secret (password)
resource "azuread_application_password" "base_application_secret" {
application_object_id = azuread_application.base_application.object_id
}

9
cli/internal/terraform/terraform/iam/azure/outputs.tf
View file

@ -6,15 +6,6 @@ output "tenant_id" {
value = data.azurerm_subscription.current.tenant_id
}
output "application_id" {
value = azuread_application.base_application.application_id
}
output "uami_id" {
value = azurerm_user_assigned_identity.identity_uami.id
}
output "application_client_secret_value" {
value = azuread_application_password.base_application_secret.value
sensitive = true
}