Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-05-04 15:25:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

bootstrapper: make Azure auth method configurable on cluster init (#1346)

Browse source 
* bootstrapper: make Azure auth method configurable on cluster init
* azure: convert uami resource ID to clientID


Co-authored-by: 3u13r <lc@edgeless.systems>
This commit is contained in:
Malte Poll 2023-04-03 15:01:25 +02:00 • committed by GitHub
parent 5cb1899c27
commit d15968bed7
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
14 changed files with 307 additions and 209 deletions
Download patch file Download diff file Expand all files Collapse all files

103
internal/cloud/azureshared/appcredentials_test.go
View file

@ -21,6 +21,20 @@ func TestMain(m *testing.M) {
func TestApplicationCredentialsFromURI(t *testing.T) {
creds := ApplicationCredentials{
TenantID: "tenant-id",
AppClientID: "client-id",
ClientSecretValue: "client-secret",
Location: "location",
UamiResourceID: "subscriptions/9b352db0-82af-408c-a02c-36fbffbf7015/resourceGroups/resourceGroupName/providers/Microsoft.ManagedIdentity/userAssignedIdentities/UAMIName",
PreferredAuthMethod: AuthMethodServicePrincipal,
}
credsWithoutSecret := ApplicationCredentials{
TenantID: "tenant-id",
Location: "location",
UamiResourceID: "subscriptions/9b352db0-82af-408c-a02c-36fbffbf7015/resourceGroups/resourceGroupName/providers/Microsoft.ManagedIdentity/userAssignedIdentities/UAMIName",
PreferredAuthMethod: AuthMethodUserAssignedIdentity,
}
credsWithoutPreferrredAuthMethod := ApplicationCredentials{
TenantID: "tenant-id",
AppClientID: "client-id",
ClientSecretValue: "client-secret",
@ -32,9 +46,17 @@ func TestApplicationCredentialsFromURI(t *testing.T) {
wantErr bool
}{
"getApplicationCredentials works": {
cloudServiceAccountURI: "serviceaccount://azure?tenant_id=tenant-id&client_id=client-id&client_secret=client-secret&location=location",
cloudServiceAccountURI: "serviceaccount://azure?tenant_id=tenant-id&client_id=client-id&client_secret=client-secret&location=location&preferred_auth_method=serviceprincipal&uami_resource_id=subscriptions%2F9b352db0-82af-408c-a02c-36fbffbf7015%2FresourceGroups%2FresourceGroupName%2Fproviders%2FMicrosoft.ManagedIdentity%2FuserAssignedIdentities%2FUAMIName",
wantCreds: creds,
},
"can parse URI without app registration / secret": {
cloudServiceAccountURI: "serviceaccount://azure?tenant_id=tenant-id&location=location&preferred_auth_method=userassignedidentity&uami_resource_id=subscriptions%2F9b352db0-82af-408c-a02c-36fbffbf7015%2FresourceGroups%2FresourceGroupName%2Fproviders%2FMicrosoft.ManagedIdentity%2FuserAssignedIdentities%2FUAMIName",
wantCreds: credsWithoutSecret,
},
"can parse URI without preferred auth method": {
cloudServiceAccountURI: "serviceaccount://azure?tenant_id=tenant-id&client_id=client-id&client_secret=client-secret&location=location",
wantCreds: credsWithoutPreferrredAuthMethod,
},
"invalid URI fails": {
cloudServiceAccountURI: "\x00",
wantErr: true,
@ -66,25 +88,66 @@ func TestApplicationCredentialsFromURI(t *testing.T) {
}
func TestToCloudServiceAccountURI(t *testing.T) {
assert := assert.New(t)
require := require.New(t)
key := ApplicationCredentials{
TenantID: "tenant-id",
AppClientID: "client-id",
ClientSecretValue: "client-secret",
Location: "location",
testCases := map[string]struct {
credentials ApplicationCredentials
wantURLValues url.Values
}{
"client id and secret without preferred auth method": {
credentials: ApplicationCredentials{
TenantID: "tenant-id",
AppClientID: "client-id",
ClientSecretValue: "client-secret",
Location: "location",
},
wantURLValues: url.Values{
"tenant_id": []string{"tenant-id"},
"client_id": []string{"client-id"},
"client_secret": []string{"client-secret"},
"location": []string{"location"},
},
},
"client id and secret with preferred auth method": {
credentials: ApplicationCredentials{
TenantID: "tenant-id",
AppClientID: "client-id",
ClientSecretValue: "client-secret",
Location: "location",
PreferredAuthMethod: AuthMethodServicePrincipal,
},
wantURLValues: url.Values{
"tenant_id": []string{"tenant-id"},
"client_id": []string{"client-id"},
"client_secret": []string{"client-secret"},
"location": []string{"location"},
"preferred_auth_method": []string{"ServicePrincipal"},
},
},
"only preferred auth method": {
credentials: ApplicationCredentials{
TenantID: "tenant-id",
Location: "location",
PreferredAuthMethod: AuthMethodUserAssignedIdentity,
},
wantURLValues: url.Values{
"tenant_id": []string{"tenant-id"},
"location": []string{"location"},
"preferred_auth_method": []string{"UserAssignedIdentity"},
},
},
}
cloudServiceAccountURI := key.ToCloudServiceAccountURI()
uri, err := url.Parse(cloudServiceAccountURI)
require.NoError(err)
query := uri.Query()
assert.Equal("serviceaccount", uri.Scheme)
assert.Equal("azure", uri.Host)
assert.Equal(url.Values{
"tenant_id": []string{"tenant-id"},
"client_id": []string{"client-id"},
"client_secret": []string{"client-secret"},
"location": []string{"location"},
}, query)
for name, tc := range testCases {
t.Run(name, func(t *testing.T) {
assert := assert.New(t)
require := require.New(t)
cloudServiceAccountURI := tc.credentials.ToCloudServiceAccountURI()
uri, err := url.Parse(cloudServiceAccountURI)
require.NoError(err)
query := uri.Query()
assert.Equal("serviceaccount", uri.Scheme)
assert.Equal("azure", uri.Host)
assert.Equal(tc.wantURLValues, query)
})
}
}