Adding support for AzureAD auth to AKS via RBAC

azurerm/data_source_kubernetes_cluster.go

@@ -38,6 +38,11 @@ func dataSourceArmKubernetesCluster() *schema.Resource {
 				Computed: true,
 			},
 
+			"enable_rbac": {
+				Type:     schema.TypeBool,
+				Computed: true,
+			},
+
 			"node_resource_group": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -171,6 +176,35 @@ func dataSourceArmKubernetesCluster() *schema.Resource {
 				},
 			},
 
+			"aad_profile": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"server_app_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+
+						"server_app_secret": {
+							Type:      schema.TypeString,
+							Computed:  true,
+							Sensitive: true,
+						},
+
+						"client_app_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+
+						"tenant_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
+
 			"network_profile": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -285,6 +319,7 @@ func dataSourceArmKubernetesClusterRead(d *schema.ResourceData, meta interface{}
 		d.Set("dns_prefix", props.DNSPrefix)
 		d.Set("fqdn", props.Fqdn)
 		d.Set("kubernetes_version", props.KubernetesVersion)
+		d.Set("enable_rbac", props.EnableRBAC)
 		d.Set("node_resource_group", props.NodeResourceGroup)
 
 		linuxProfile := flattenKubernetesClusterDataSourceLinuxProfile(props.LinuxProfile)
@@ -311,6 +346,11 @@ func dataSourceArmKubernetesClusterRead(d *schema.ResourceData, meta interface{}
 		if err := d.Set("service_principal", servicePrincipal); err != nil {
 			return fmt.Errorf("Error setting `service_principal`: %+v", err)
 		}
+
+		aadProfile := flattenKubernetesClusterDataSourceAadProfile(resp.ManagedClusterProperties.AadProfile)
+		if err := d.Set("aad_profile", aadProfile); err != nil {
+			return fmt.Errorf("Error setting `aad_profile`: %+v", err)
+		}
 	}
 
 	kubeConfigRaw, kubeConfig := flattenKubernetesClusterDataSourceAccessProfile(&profile)
@@ -434,6 +474,32 @@ func flattenKubernetesClusterDataSourceAccessProfile(profile *containerservice.M
 	return nil, []interface{}{}
 }
 
+func flattenKubernetesClusterDataSourceAadProfile(profile *containerservice.ManagedClusterAADProfile) []interface{} {
+	if profile == nil {
+		return nil
+	}
+
+	values := make(map[string]interface{})
+
+	if serverAppId := profile.ServerAppID; serverAppId != nil {
+		values["server_app_id"] = *serverAppId
+	}
+
+	if serverAppSecret := profile.ServerAppSecret; serverAppSecret != nil {
+		values["server_app_secret"] = *serverAppSecret
+	}
+
+	if clientAppId := profile.ClientAppID; clientAppId != nil {
+		values["client_app_id"] = *clientAppId
+	}
+
+	if tenantId := profile.TenantID; tenantId != nil {
+		values["tenant_id"] = *tenantId
+	}
+
+	return []interface{}{values}
+}
+
 func flattenKubernetesClusterDataSourceKubeConfig(config kubernetes.KubeConfig) []interface{} {
 	values := make(map[string]interface{})
 

azurerm/helpers/kubernetes/kube_config.go

@@ -27,6 +27,26 @@ type user struct {
 	ClientKeyData        string `yaml:"client-key-data"`
 }
 
+type userItemRBAC struct {
+	Name string   `yaml:"name"`
+	User userRBAC `yaml:"user"`
+}
+
+type userRBAC struct {
+	AuthProvider authProvider `yaml:"auth-provider"`
+}
+
+type authProvider struct {
+	Name   string            `yaml:"name"`
+	Config configRBACAzureAD `yaml:"config"`
+}
+
+type configRBACAzureAD struct {
+	APIServerID string `yaml:"apiserver-id,omitempty"`
+	ClientID    string `yaml:"client-id,omitempty"`
+	TenantID    string `yaml:"tenant-id,omitempty"`
+}
+
 type contextItem struct {
 	Name    string  `yaml:"name"`
 	Context context `yaml:"context"`
@@ -48,6 +68,16 @@ type KubeConfig struct {
 	Preferences    map[string]interface{} `yaml:"preferences,omitempty"`
 }
 
+type KubeConfigRBAC struct {
+	APIVersion     string                 `yaml:"apiVersion"`
+	Clusters       []clusterItem          `yaml:"clusters"`
+	Users          []userItemRBAC         `yaml:"users"`
+	Contexts       []contextItem          `yaml:"contexts,omitempty"`
+	CurrentContext string                 `yaml:"current-context,omitempty"`
+	Kind           string                 `yaml:"kind,omitempty"`
+	Preferences    map[string]interface{} `yaml:"preferences,omitempty"`
+}
+
 func ParseKubeConfig(config string) (*KubeConfig, error) {
 	if config == "" {
 		return nil, fmt.Errorf("Cannot parse empty config")
@@ -72,3 +102,25 @@ func ParseKubeConfig(config string) (*KubeConfig, error) {
 
 	return &kubeConfig, nil
 }
+
+func ParseKubeConfigRBAC(config string) (*KubeConfigRBAC, error) {
+	if config == "" {
+		return nil, fmt.Errorf("Cannot parse empty config")
+	}
+
+	var kubeConfig KubeConfigRBAC
+	err := yaml.Unmarshal([]byte(config), &kubeConfig)
+	if err != nil {
+		return nil, fmt.Errorf("Failed to unmarshal YAML config with error %+v", err)
+	}
+	if len(kubeConfig.Clusters) <= 0 || len(kubeConfig.Users) <= 0 {
+		return nil, fmt.Errorf("Config %+v contains no valid clusters or users", kubeConfig)
+	}
+
+	cluster := kubeConfig.Clusters[0].Cluster
+	if cluster.Server == "" {
+		return nil, fmt.Errorf("Config has invalid or non existent server for cluster %+v", cluster)
+	}
+
+	return &kubeConfig, nil
+}