-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request humanitec-architecture#12 from htc-demo-00-azure/c…
…luster-issuer feat: output aks_cluster_issuer_url
- Loading branch information
Showing
15 changed files
with
708 additions
and
27 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| # output "aks_cluster_issuer_url" { | ||
| # description = "Issuer URL for the OpenID Connect discovery endpoint" | ||
| # value = module.base.aks_oidc_issuer_url | ||
| # } | ||
| # | ||
| # output "user_assigned_identity" { | ||
| # value = azurerm_user_assigned_identity.operator | ||
| # } | ||
| # output "tenant_id" { | ||
| # value = data.azurerm_subscription.current.tenant_id | ||
| # } | ||
| # | ||
| # output "client_id" { | ||
| # value = azuread_service_principal.humanitec_orchestrator_vault.client_id | ||
| # } | ||
| # output "secret_value" { | ||
| # value = nonsensitive(azuread_service_principal_password.humanitec_orchestrator_vault.value) | ||
| # } | ||
| # | ||
| # output "humanitec_orchestrator_application" { | ||
| # value = azuread_application.humanitec_orchestrator | ||
| # } | ||
| # |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| resource "azurerm_storage_account" "storage_account_humanitec" { | ||
| name = "humanitecplatformprod" | ||
| resource_group_name = module.base.az_resource_group_name | ||
| location = module.base.az_resource_group_location | ||
| account_tier = "Standard" # Adjust tier and replication type as needed | ||
| account_replication_type = "LRS" | ||
| } | ||
|
|
||
| # Create Storage Container | ||
| resource "azurerm_storage_container" "shared_container" { | ||
| name = "shared" | ||
| storage_account_name = azurerm_storage_account.storage_account_humanitec.name | ||
| } | ||
|
|
||
|
|
||
| resource "humanitec_resource_definition" "shared-storage" { | ||
| driver_type = "humanitec/echo" | ||
| id = "shared-storage" | ||
| name = "shared-storage" | ||
| type = "azure-blob" | ||
|
|
||
| driver_inputs = { | ||
| values_string = jsonencode({ | ||
| "account" = azurerm_storage_account.storage_account_humanitec.name, | ||
| "container" = azurerm_storage_container.shared_container.name, | ||
| "location" = module.base.az_resource_group_location | ||
| }) | ||
| } | ||
|
|
||
| } | ||
|
|
||
|
|
||
| resource "humanitec_resource_definition_criteria" "shared-storage" { | ||
| resource_definition_id = humanitec_resource_definition.shared-storage.id | ||
| } | ||
|
|
174 changes: 174 additions & 0 deletions
174
examples/with-backstage/poc-humanitec-vault-confidential.tf
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,174 @@ | ||
| # | ||
| # Connect humanitec with condifdential secrets stored in Azure Key Vault | ||
| # Humanitec Orchestrator should not have access to the vault in any ways, just the kubernetes operator should but as RO | ||
| # | ||
|
|
||
| resource "azurerm_key_vault" "humanitec_poc_confidential" { | ||
| name = var.vault_name_confidential | ||
| location = module.base.az_resource_group_location | ||
| resource_group_name = data.azurerm_resource_group.main.name | ||
|
|
||
| tenant_id = data.azurerm_subscription.current.tenant_id | ||
|
|
||
| sku_name = "premium" | ||
| soft_delete_retention_days = 7 | ||
| enable_rbac_authorization = true | ||
|
|
||
| } | ||
|
|
||
| # Create a role assignment for the current user | ||
| resource "azurerm_role_assignment" "self-confidential" { | ||
| scope = azurerm_key_vault.humanitec_poc_confidential.id | ||
| principal_id = data.azurerm_client_config.current.object_id | ||
| role_definition_name = "Key Vault Administrator" | ||
| } | ||
|
|
||
|
|
||
| # | ||
| # Humanitec Operator should have RO access to the confidential vault | ||
| # | ||
|
|
||
| # Asign a role to the managed identity used by Humanitec Operator | ||
| resource "azurerm_role_assignment" "vault-confidential-confidential-ro" { | ||
| scope = azurerm_key_vault.humanitec_poc_confidential.id | ||
| role_definition_name = data.azurerm_role_definition.kv-secret-ro.name | ||
| principal_id = azurerm_user_assigned_identity.operator.principal_id | ||
| } | ||
|
|
||
|
|
||
| # Register the secret store confidential with the Operator | ||
|
|
||
| resource "kubernetes_manifest" "register_operator_secret_store_confidential" { | ||
| manifest = { | ||
| apiVersion = "humanitec.io/v1alpha1" | ||
| kind = "SecretStore" | ||
| metadata = { | ||
| name = var.secret_store_confidential_id | ||
| namespace = var.humanitec_operator_namespace | ||
| labels = { | ||
| "app.humanitec.io/default-store" = "false" | ||
| } | ||
| } | ||
| spec = { | ||
| azurekv = { | ||
| url = azurerm_key_vault.humanitec_poc_confidential.vault_uri | ||
| tenantID = data.azurerm_client_config.current.tenant_id | ||
| auth : {} | ||
| } | ||
| } | ||
| } | ||
| depends_on = [helm_release.humanitec_operator] | ||
|
|
||
| } | ||
|
|
||
|
|
||
| # | ||
| # TODO: Ask Humanitec SME does the orchestrator need to have access to the vault even as RO? | ||
| # If we are just using references only the k8s should have access the Humanitec Orchestrator shouldn't | ||
|
|
||
| resource "azurerm_role_assignment" "humanitec_orchestrator_vault_confidential" { | ||
| count = var.enable_orchestrator_access_confidential ? 1 : 0 | ||
|
|
||
| scope = azurerm_key_vault.humanitec_poc_confidential.id | ||
| role_definition_name = data.azurerm_role_definition.kv-secret-ro.name | ||
| principal_id = azuread_service_principal.humanitec_orchestrator_vault.id | ||
|
|
||
| depends_on = [azurerm_key_vault.humanitec_poc_confidential] | ||
| } | ||
|
|
||
| # Register the secret store with the Platform Orchestrator | ||
|
|
||
| resource "humanitec_secretstore" "humanitec_orchestrator_officer_confidential" { | ||
| id = "azurepoc-confidential" | ||
| # primary = true | ||
| azurekv = { | ||
| url = azurerm_key_vault.humanitec_poc_confidential.vault_uri | ||
| tenant_id = data.azurerm_client_config.current.tenant_id | ||
| auth = { | ||
| client_id = azuread_service_principal.humanitec_orchestrator_vault.client_id | ||
| client_secret = azuread_service_principal_password.humanitec_orchestrator_vault.value | ||
| } | ||
| } | ||
|
|
||
| depends_on = [azurerm_key_vault.humanitec_poc_confidential] | ||
| } | ||
|
|
||
| # create secret in the vault | ||
| resource "azurerm_key_vault_secret" "master_secret_confidential" { | ||
| name = "master-secret" | ||
| value = "secret-password-confidential-001" | ||
| key_vault_id = azurerm_key_vault.humanitec_poc_confidential.id | ||
| } | ||
|
|
||
|
|
||
| resource "azurerm_key_vault_secret" "mysql_username_confidential" { | ||
| name = "central-mysql-username" | ||
| value = "username-central-confidential-azure" | ||
| key_vault_id = azurerm_key_vault.humanitec_poc_confidential.id | ||
| } | ||
|
|
||
| resource "azurerm_key_vault_secret" "mysql_password_confidential" { | ||
| name = "central-mysql-password" | ||
| value = "password-central-confidential-azure" | ||
| key_vault_id = azurerm_key_vault.humanitec_poc_confidential.id | ||
| } | ||
|
|
||
| # Create a resource in humanitec this should be used only in production | ||
| resource "humanitec_resource_definition" "mysql-confidential" { | ||
| id = "mysql-confidential" | ||
| name = "central-confidential" | ||
| type = "mysql" | ||
| driver_type = "humanitec/echo" | ||
|
|
||
| driver_inputs = { | ||
| values_string = jsonencode({ | ||
| name = "central-db1" | ||
| host = "central.mysql.database.confidential.myapp.thoughtworks.com" | ||
| user = azurerm_key_vault_secret.mysql_username_confidential.name | ||
| port = 3306 | ||
| }) | ||
| secret_refs = jsonencode({ | ||
| username = { | ||
| store = humanitec_secretstore.humanitec_orchestrator_officer_confidential.id | ||
| ref = azurerm_key_vault_secret.mysql_username_confidential.name | ||
| } | ||
| password = { | ||
| store = humanitec_secretstore.humanitec_orchestrator_officer_confidential.id | ||
| ref = azurerm_key_vault_secret.mysql_password_confidential.name | ||
| } | ||
| }) | ||
| } | ||
|
|
||
| depends_on = [humanitec_secretstore.humanitec_orchestrator_officer_confidential] | ||
|
|
||
| } | ||
|
|
||
| resource "humanitec_resource_definition_criteria" "mysql-confidential" { | ||
| resource_definition_id = humanitec_resource_definition.mysql-confidential.id | ||
| env_type = "production" | ||
| env_id = "production" | ||
| } | ||
|
|
||
| # | ||
| # Create shared secret in the vault | ||
| # | ||
| resource "azurerm_key_vault_secret" "client_api_token_confidential" { | ||
| name = "client-api-token" | ||
| value = uuid() | ||
| key_vault_id = azurerm_key_vault.humanitec_poc_confidential.id | ||
| } | ||
|
|
||
|
|
||
| # Create reference to the secret stored in kv | ||
| # resource "humanitec_value" "poc_shared_secret_confidential" { | ||
| # app_id = humanitec_application.demo_app.id | ||
| # key = "client-api-token" | ||
| # description = "client api token - shared secret created in Terraform " | ||
| # is_secret = true | ||
| # secret_ref = { | ||
| # store = humanitec_secretstore.humanitec_orchestration_officer_confidential.id | ||
| # ref = azurerm_key_vault_secret.client_api_token_confidential.name | ||
| # } | ||
| # } | ||
|
|
||
|
|
Oops, something went wrong.