From 05a07066276d62bec2610f821c340c75a884d17d Mon Sep 17 00:00:00 2001 From: ritikaguptams Date: Tue, 30 Jul 2024 09:12:44 -0700 Subject: [PATCH] add role assignments for gmsa creds Signed-off-by: ritikaguptams --- .../terraform/capz/{README => README.md} | 0 infra/azure/terraform/capz/identities/main.tf | 45 +++++++++++++++++ infra/azure/terraform/capz/main.tf | 48 +++++++++++-------- .../terraform/capz/role-assignments/main.tf | 18 +++++++ .../cleanup-app/{README => README.md} | 0 5 files changed, 92 insertions(+), 19 deletions(-) rename infra/azure/terraform/capz/{README => README.md} (100%) rename infra/azure/terraform/cleanup-app/{README => README.md} (100%) diff --git a/infra/azure/terraform/capz/README b/infra/azure/terraform/capz/README.md similarity index 100% rename from infra/azure/terraform/capz/README rename to infra/azure/terraform/capz/README.md diff --git a/infra/azure/terraform/capz/identities/main.tf b/infra/azure/terraform/capz/identities/main.tf index 37504cf9645..6e8d74dd574 100644 --- a/infra/azure/terraform/capz/identities/main.tf +++ b/infra/azure/terraform/capz/identities/main.tf @@ -22,6 +22,14 @@ variable "location" { type = string } +variable "subscription_id" { + type = string +} + +variable "container_registry_scope" { + type = string +} + resource "azurerm_user_assigned_identity" "cloud_provider_user_identity" { name = "cloud-provider-user-identity" location = var.location @@ -40,6 +48,43 @@ resource "azurerm_user_assigned_identity" "gmsa_user_identity" { resource_group_name = var.resource_group_name } +resource "azurerm_role_definition" "gmsa_custom_role" { + name = "gMSA" + scope = "/subscriptions/${var.subscription_id}" + description = "Required permissions for gmsa to read properties of subscriptions and managed identities" + + permissions { + actions = [ + "Microsoft.Resources/subscriptions/read", + "Microsoft.ManagedIdentity/userAssignedIdentities/read" + ] + not_actions = [] + } + + assignable_scopes = [ + "/subscriptions/${var.subscription_id}" + ] +} + +resource "azurerm_role_assignment" "gmsa_role_assignment" { + principal_id = azurerm_user_assigned_identity.domain_vm_identity.principal_id + role_definition_name = azurerm_role_definition.gmsa_custom_role.name + scope = "/subscriptions/${var.subscription_id}" + depends_on = [azurerm_user_assigned_identity.domain_vm_identity] +} + +resource "azurerm_role_assignment" "cloud_provider_sub_contributor" { + principal_id = azurerm_user_assigned_identity.cloud_provider_user_identity.principal_id + role_definition_name = "Contributor" + scope = "/subscriptions/${var.subscription_id}" +} + +resource "azurerm_role_assignment" "acr_pull" { + principal_id = azurerm_user_assigned_identity.cloud_provider_user_identity.principal_id + role_definition_name = "AcrPull" + scope = var.container_registry_scope +} + output "cloud_provider_user_identity_id" { value = azurerm_user_assigned_identity.cloud_provider_user_identity.principal_id } diff --git a/infra/azure/terraform/capz/main.tf b/infra/azure/terraform/capz/main.tf index 7a4c16de0e3..bad77744a45 100644 --- a/infra/azure/terraform/capz/main.tf +++ b/infra/azure/terraform/capz/main.tf @@ -80,37 +80,46 @@ resource "azurerm_storage_account" "k8sprowstorage" { min_tls_version = "TLS1_0" account_replication_type = "RAGRS" cross_tenant_replication_enabled = true - depends_on = [azurerm_resource_group.capz_ci] + depends_on = [ + azurerm_resource_group.capz_ci + ] } -# Import identities module -module "identities" { - source = "./identities" +# Import container registry module +module "container_registry" { + source = "./container-registry" resource_group_name = var.resource_group_name location = var.location - depends_on = [azurerm_resource_group.capz_ci] + depends_on = [ + azurerm_resource_group.capz_ci + ] +} + +# Import identities module +module "identities" { + source = "./identities" + resource_group_name = var.resource_group_name + location = var.location + subscription_id = data.azurerm_client_config.current.subscription_id + container_registry_scope = module.container_registry.container_registry_id + depends_on = [ + azurerm_resource_group.capz_ci + ] } # Import key vault module module "key_vault" { - source = "./key-vault" - resource_group_name = var.resource_group_name - location = var.location - tenant_id = data.azurerm_client_config.current.tenant_id + source = "./key-vault" + resource_group_name = var.resource_group_name + location = var.location + tenant_id = data.azurerm_client_config.current.tenant_id identities = { - cloud_provider_user_identity_id = module.identities.cloud_provider_user_identity_id domain_vm_identity_id = module.identities.domain_vm_identity_id gmsa_user_identity_id = module.identities.gmsa_user_identity_id } - depends_on = [azurerm_resource_group.capz_ci] -} - -# Import container registry module -module "container_registry" { - source = "./container-registry" - resource_group_name = var.resource_group_name - location = var.location - depends_on = [azurerm_resource_group.capz_ci] + depends_on = [ + azurerm_resource_group.capz_ci + ] } # Import role assignments module @@ -120,6 +129,7 @@ module "role_assignments" { container_registry_scope = module.container_registry.container_registry_id storage_account_scope = azurerm_storage_account.k8sprowstorage.id subscription_id = data.azurerm_client_config.current.subscription_id + key_vault_id = module.key_vault.key_vault_id depends_on = [ azurerm_resource_group.capz_ci, azurerm_storage_account.k8sprowstorage, diff --git a/infra/azure/terraform/capz/role-assignments/main.tf b/infra/azure/terraform/capz/role-assignments/main.tf index f89a6ab7eaf..66181c61467 100644 --- a/infra/azure/terraform/capz/role-assignments/main.tf +++ b/infra/azure/terraform/capz/role-assignments/main.tf @@ -14,6 +14,8 @@ See the License for the specific language governing permissions and limitations under the License. */ +# This module maintains all role assignments for our service principal - az-cli-prow + variable "resource_group_name" { type = string } @@ -30,6 +32,10 @@ variable "subscription_id" { type = string } +variable "key_vault_id" { + type = string +} + data "azuread_service_principal" "az_service_principal" { display_name = "az-cli-prow" } @@ -73,3 +79,15 @@ resource "azurerm_role_assignment" "sp_custom_role_assignment" { role_definition_name = azurerm_role_definition.custom_role.name scope = "/subscriptions/${var.subscription_id}" } + +resource "azurerm_key_vault_access_policy" "access_policy_gmsa_sp" { + key_vault_id = var.key_vault_id + tenant_id = data.azuread_service_principal.az_service_principal.application_tenant_id + object_id = data.azuread_service_principal.az_service_principal.id + secret_permissions = [ + "Get", + "Delete", + "List", + "Purge" + ] +} diff --git a/infra/azure/terraform/cleanup-app/README b/infra/azure/terraform/cleanup-app/README.md similarity index 100% rename from infra/azure/terraform/cleanup-app/README rename to infra/azure/terraform/cleanup-app/README.md