Adding support for AzureAD auth to AKS via RBAC

azurerm/data_source_kubernetes_cluster.go

@@ -2,6 +2,7 @@ package azurerm
 
 import (
 	"fmt"
+	"strings"
 
 	"github.com/Azure/azure-sdk-for-go/services/containerservice/mgmt/2018-03-31/containerservice"
 	"github.com/hashicorp/terraform/helper/schema"
@@ -38,6 +39,11 @@ func dataSourceArmKubernetesCluster() *schema.Resource {
 				Computed: true,
 			},
 
+			"enable_rbac": {
+				Type:     schema.TypeBool,
+				Computed: true,
+			},
+
 			"node_resource_group": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -171,6 +177,29 @@ func dataSourceArmKubernetesCluster() *schema.Resource {
 				},
 			},
 
+			"aad_profile": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"server_app_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+
+						"client_app_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+
+						"tenant_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
+
 			"network_profile": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -285,6 +314,7 @@ func dataSourceArmKubernetesClusterRead(d *schema.ResourceData, meta interface{}
 		d.Set("dns_prefix", props.DNSPrefix)
 		d.Set("fqdn", props.Fqdn)
 		d.Set("kubernetes_version", props.KubernetesVersion)
+		d.Set("enable_rbac", props.EnableRBAC)
 		d.Set("node_resource_group", props.NodeResourceGroup)
 
 		linuxProfile := flattenKubernetesClusterDataSourceLinuxProfile(props.LinuxProfile)
@@ -311,6 +341,11 @@ func dataSourceArmKubernetesClusterRead(d *schema.ResourceData, meta interface{}
 		if err := d.Set("service_principal", servicePrincipal); err != nil {
 			return fmt.Errorf("Error setting `service_principal`: %+v", err)
 		}
+
+		aadProfile := flattenKubernetesClusterDataSourceAadProfile(resp.ManagedClusterProperties.AadProfile)
+		if err := d.Set("aad_profile", aadProfile); err != nil {
+			return fmt.Errorf("Error setting `aad_profile`: %+v", err)
+		}
 	}
 
 	kubeConfigRaw, kubeConfig := flattenKubernetesClusterDataSourceAccessProfile(&profile)
@@ -421,19 +456,54 @@ func flattenKubernetesClusterDataSourceAccessProfile(profile *containerservice.M
 
 	if kubeConfigRaw := profile.AccessProfile.KubeConfig; kubeConfigRaw != nil {
 		rawConfig := string(*kubeConfigRaw)
+		var flattenedKubeConfig []interface{}
+
+		if strings.Contains(rawConfig, "apiserver-id:") {
+			kubeConfigAAD, err := kubernetes.ParseKubeConfigAAD(rawConfig)
+
+			if err != nil {
+				return utils.String(rawConfig), []interface{}{}
+			}
+
+			flattenedKubeConfig = flattenKubernetesClusterDataSourceKubeConfigAAD(*kubeConfigAAD)
+		} else {
+			kubeConfig, err := kubernetes.ParseKubeConfig(rawConfig)
+
+			if err != nil {
+				return utils.String(rawConfig), []interface{}{}
+			}
 
-		kubeConfig, err := kubernetes.ParseKubeConfig(rawConfig)
-		if err != nil {
-			return utils.String(rawConfig), []interface{}{}
+			flattenedKubeConfig = flattenKubernetesClusterDataSourceKubeConfig(*kubeConfig)
 		}
 
-		flattenedKubeConfig := flattenKubernetesClusterDataSourceKubeConfig(*kubeConfig)
 		return utils.String(rawConfig), flattenedKubeConfig
 	}
 
 	return nil, []interface{}{}
 }
 
+func flattenKubernetesClusterDataSourceAadProfile(profile *containerservice.ManagedClusterAADProfile) []interface{} {
+	if profile == nil {
+		return nil
+	}
+
+	values := make(map[string]interface{})
+
+	if serverAppId := profile.ServerAppID; serverAppId != nil {
+		values["server_app_id"] = *serverAppId
+	}
+
+	if clientAppId := profile.ClientAppID; clientAppId != nil {
+		values["client_app_id"] = *clientAppId
+	}
+
+	if tenantId := profile.TenantID; tenantId != nil {
+		values["tenant_id"] = *tenantId
+	}
+
+	return []interface{}{values}
+}
+
 func flattenKubernetesClusterDataSourceKubeConfig(config kubernetes.KubeConfig) []interface{} {
 	values := make(map[string]interface{})
 
@@ -451,6 +521,24 @@ func flattenKubernetesClusterDataSourceKubeConfig(config kubernetes.KubeConfig)
 	return []interface{}{values}
 }
 
+func flattenKubernetesClusterDataSourceKubeConfigAAD(config kubernetes.KubeConfigAAD) []interface{} {
+	values := make(map[string]interface{})
+
+	cluster := config.Clusters[0].Cluster
+	name := config.Users[0].Name
+
+	values["host"] = cluster.Server
+	values["username"] = name
+
+	values["password"] = ""
+	values["client_certificate"] = ""
+	values["client_key"] = ""
+
+	values["cluster_ca_certificate"] = cluster.ClusterAuthorityData
+
+	return []interface{}{values}
+}
+
 func flattenKubernetesClusterDataSourceNetworkProfile(profile *containerservice.NetworkProfile) []interface{} {
 	values := make(map[string]interface{})
 

azurerm/data_source_kubernetes_cluster_test.go

@@ -38,6 +38,38 @@ func TestAccDataSourceAzureRMKubernetesCluster_basic(t *testing.T) {
 	})
 }
 
+func TestAccDataSourceAzureRMKubernetesCluster_aadProfile(t *testing.T) {
+	dataSourceName := "data.azurerm_kubernetes_cluster.test"
+	ri := acctest.RandInt()
+	clientId := os.Getenv("ARM_CLIENT_ID")
+	clientSecret := os.Getenv("ARM_CLIENT_SECRET")
+	serverAppId := os.Getenv("ARM_SERVER_APP_ID")
+	serverAppSecret := os.Getenv("ARM_SERVER_APP_SECRET")
+	clientAppId := os.Getenv("ARM_CLIENT_APP_ID")
+	tenantId := os.Getenv("ARM_TENANT_ID")
+	location := testLocation()
+	config := testAccDataSourceAzureRMKubernetesCluster_rbacAAD(ri, clientId, clientSecret, location, serverAppId, serverAppSecret, clientAppId, tenantId)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testCheckAzureRMKubernetesClusterDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: config,
+				Check: resource.ComposeTestCheckFunc(
+					testCheckAzureRMKubernetesClusterExists(dataSourceName),
+					resource.TestCheckResourceAttr(dataSourceName, "aad_profile.#", "1"),
+					resource.TestCheckResourceAttrSet(dataSourceName, "aad_profile.0.server_app_id"),
+					resource.TestCheckResourceAttrSet(dataSourceName, "aad_profile.0.server_app_secret"),
+					resource.TestCheckResourceAttrSet(dataSourceName, "aad_profile.0.client_app_id"),
+					resource.TestCheckResourceAttrSet(dataSourceName, "aad_profile.0.tenant_id"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccDataSourceAzureRMKubernetesCluster_internalNetwork(t *testing.T) {
 	dataSourceName := "data.azurerm_kubernetes_cluster.test"
 	ri := acctest.RandInt()
@@ -244,6 +276,18 @@ data "azurerm_kubernetes_cluster" "test" {
 `, resource)
 }
 
+func testAccDataSourceAzureRMKubernetesCluster_rbacAAD(rInt int, clientId string, clientSecret string, location string, serverAppId string, serverAppSecret string, clientAppId string, tenantId string) string {
+	resource := testAccAzureRMKubernetesCluster_rbacAAD(rInt, clientId, clientSecret, location, serverAppId, serverAppSecret, clientAppId, tenantId)
+	return fmt.Sprintf(`
+%s
+
+data "azurerm_kubernetes_cluster" "test" {
+	name                = "${azurerm_kubernetes_cluster.test.name}"
+	resource_group_name = "${azurerm_kubernetes_cluster.test.resource_group_name}"
+}
+`, resource)
+}
+
 func testAccDataSourceAzureRMKubernetesCluster_internalNetwork(rInt int, clientId string, clientSecret string, location string) string {
 	resource := testAccAzureRMKubernetesCluster_internalNetwork(rInt, clientId, clientSecret, location)
 	return fmt.Sprintf(`

azurerm/helpers/kubernetes/kube_config.go

@@ -27,6 +27,26 @@ type user struct {
 	ClientKeyData        string `yaml:"client-key-data"`
 }
 
+type userItemAAD struct {
+	Name string  `yaml:"name"`
+	User userAAD `yaml:"user"`
+}
+
+type userAAD struct {
+	AuthProvider authProvider `yaml:"auth-provider"`
+}
+
+type authProvider struct {
+	Name   string        `yaml:"name"`
+	Config configAzureAD `yaml:"config"`
+}
+
+type configAzureAD struct {
+	APIServerID string `yaml:"apiserver-id,omitempty"`
+	ClientID    string `yaml:"client-id,omitempty"`
+	TenantID    string `yaml:"tenant-id,omitempty"`
+}
+
 type contextItem struct {
 	Name    string  `yaml:"name"`
 	Context context `yaml:"context"`
@@ -38,16 +58,25 @@ type context struct {
 	Namespace string `yaml:"namespace,omitempty"`
 }
 
-type KubeConfig struct {
+type KubeConfigBase struct {
 	APIVersion     string                 `yaml:"apiVersion"`
 	Clusters       []clusterItem          `yaml:"clusters"`
-	Users          []userItem             `yaml:"users"`
 	Contexts       []contextItem          `yaml:"contexts,omitempty"`
 	CurrentContext string                 `yaml:"current-context,omitempty"`
 	Kind           string                 `yaml:"kind,omitempty"`
 	Preferences    map[string]interface{} `yaml:"preferences,omitempty"`
 }
 
+type KubeConfig struct {
+	KubeConfigBase `yaml:",inline"`
+	Users          []userItem `yaml:"users"`
+}
+
+type KubeConfigAAD struct {
+	KubeConfigBase `yaml:",inline"`
+	Users          []userItemAAD `yaml:"users"`
+}
+
 func ParseKubeConfig(config string) (*KubeConfig, error) {
 	if config == "" {
 		return nil, fmt.Errorf("Cannot parse empty config")
@@ -72,3 +101,25 @@ func ParseKubeConfig(config string) (*KubeConfig, error) {
 
 	return &kubeConfig, nil
 }
+
+func ParseKubeConfigAAD(config string) (*KubeConfigAAD, error) {
+	if config == "" {
+		return nil, fmt.Errorf("Cannot parse empty config")
+	}
+
+	var kubeConfig KubeConfigAAD
+	err := yaml.Unmarshal([]byte(config), &kubeConfig)
+	if err != nil {
+		return nil, fmt.Errorf("Failed to unmarshal YAML config with error %+v", err)
+	}
+	if len(kubeConfig.Clusters) <= 0 || len(kubeConfig.Users) <= 0 {
+		return nil, fmt.Errorf("Config %+v contains no valid clusters or users", kubeConfig)
+	}
+
+	cluster := kubeConfig.Clusters[0].Cluster
+	if cluster.Server == "" {
+		return nil, fmt.Errorf("Config has invalid or non existent server for cluster %+v", cluster)
+	}
+
+	return &kubeConfig, nil
+}