Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

r\iothub: Support managed service identity #14354

Merged
merged 2 commits into from
Dec 20, 2021

Conversation

myc2h6o
Copy link
Contributor

@myc2h6o myc2h6o commented Nov 26, 2021

Fix #9139
This is required when Iot Hub needs to talk to other resources on a private v-net. Support for AuthenticatinType in routing, file upload, device import/export will be added in following prs
Test result:
image

@myc2h6o myc2h6o changed the title r\iothub: Support managed identity r\iothub: Support managed service identity Nov 26, 2021
Copy link
Contributor

@tombuildsstuff tombuildsstuff left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hi @myc2h6o

Thanks for this PR.

I've taken a look through and left some comments inline, but if we can fix those up then we can take another look.

Thanks!

Comment on lines 1318 to 1462
var identityIds map[string]*devices.ArmUserIdentity
if len(config.UserAssignedIdentityIds) != 0 {
identityIds = map[string]*devices.ArmUserIdentity{}
for _, id := range config.UserAssignedIdentityIds {
identityIds[id] = &devices.ArmUserIdentity{}
}
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this'll ensure these are always removed:

Suggested change
var identityIds map[string]*devices.ArmUserIdentity
if len(config.UserAssignedIdentityIds) != 0 {
identityIds = map[string]*devices.ArmUserIdentity{}
for _, id := range config.UserAssignedIdentityIds {
identityIds[id] = &devices.ArmUserIdentity{}
}
}
identityIds = make(map[string]*devices.ArmUserIdentity, 0)
for _, id := range config.UserAssignedIdentityIds {
identityIds[id] = &devices.ArmUserIdentity{}
}

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have updated the code, but I didn't fully understand the comment, is it related to the garbage collection mechanism?

And I found that identityIds has to be nil for a SystemAssigned identity. An error will be thrown if an empty map is given. So I've updated the code to first create the ArmUserIdentity without identityIds and set it only when provided. Please check if it looks good.


* `identity_ids` - (Optional) A list of User Managed Identity ID's which should be assigned to the Iot Hub.

~> **NOTE:** This is required when `type` is set to `UserAssigned`.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is also required when it's set to SystemAssigned/UserAssigned:

Suggested change
~> **NOTE:** This is required when `type` is set to `UserAssigned`.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated

@myc2h6o
Copy link
Contributor Author

myc2h6o commented Dec 1, 2021

@tombuildsstuff thanks for reviewing the change. I've updated the code, please take another look.

@myc2h6o
Copy link
Contributor Author

myc2h6o commented Dec 17, 2021

Rebased to latest main to resolve conflict

@myc2h6o
Copy link
Contributor Author

myc2h6o commented Dec 17, 2021

Hi @tombuildsstuff I saw you added new identity types in the linked pr, I've updated this change to use the new commonschema.SystemAssignedUserAssignedIdentity() similar to #14007, please check if this looks good.

Copy link
Collaborator

@katbyte katbyte left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @myc2h6o - LGTM 💎

Copy link
Contributor

@tombuildsstuff tombuildsstuff left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM - thanks for pushing those changes @myc2h6o

@tombuildsstuff tombuildsstuff removed their assignment Dec 20, 2021
@tombuildsstuff tombuildsstuff added this to the v2.91.0 milestone Dec 20, 2021
@tombuildsstuff
Copy link
Contributor

Tests pass:

Screenshot 2021-12-20 at 11 22 06

@tombuildsstuff tombuildsstuff merged commit 190c4e0 into hashicorp:main Dec 20, 2021
tombuildsstuff added a commit that referenced this pull request Dec 20, 2021
tombuildsstuff added a commit that referenced this pull request Dec 20, 2021
@myc2h6o myc2h6o deleted the iothub_identity branch December 20, 2021 12:41
@github-actions
Copy link

github-actions bot commented Jan 7, 2022

This functionality has been released in v2.91.0 of the Terraform Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

@github-actions
Copy link

github-actions bot commented Feb 7, 2022

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Feb 7, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Support for IoTHub Managed Service Identity for Endpoints
4 participants