-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
DOM-54281 Add support for shared access signatures (#51)
- Loading branch information
Showing
11 changed files
with
209 additions
and
92 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,16 +1,24 @@ | ||
| resource "azuread_group" "flyte_metadata_access" { | ||
| display_name = "Flyte metadata access" | ||
| resource "azuread_group" "flyte_metadata" { | ||
| display_name = "${var.deploy_id}-flyte-metadata-group" | ||
| security_enabled = true | ||
| members = [ | ||
| azurerm_user_assigned_identity.this["flyte_controlplane"].principal_id, | ||
| azurerm_user_assigned_identity.this["flyte_dataplane"].principal_id, | ||
| azurerm_user_assigned_identity.flyte_controlplane.principal_id, | ||
| azurerm_user_assigned_identity.flyte_dataplane.principal_id, | ||
| ] | ||
| } | ||
|
|
||
| resource "azuread_group" "flyte_data_access" { | ||
| display_name = "Flyte data access" | ||
| resource "azuread_group" "flyte_data" { | ||
| display_name = "${var.deploy_id}-flyte-data-group" | ||
| security_enabled = true | ||
| members = [ | ||
| azurerm_user_assigned_identity.this["flyte_dataplane"].principal_id, | ||
| azurerm_user_assigned_identity.flyte_dataplane.principal_id, | ||
| ] | ||
| } | ||
|
|
||
| resource "azuread_group" "flyte_sas" { | ||
| display_name = "${var.deploy_id}-flyte-sas-group" | ||
| security_enabled = true | ||
| members = [ | ||
| azurerm_user_assigned_identity.flyte_dataplane.principal_id, | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,26 +1,33 @@ | ||
| locals { | ||
| # Kubernetes service account to user-assigned managed identity mapping | ||
| mapping = { | ||
| flyteadmin = "flyte_dataplane" | ||
| flytepropeller = "flyte_controlplane" | ||
| datacatalog = "flyte_controlplane" | ||
| federated_identity_mapping = { | ||
| flyteadmin = azurerm_user_assigned_identity.flyte_controlplane.id | ||
| flytepropeller = azurerm_user_assigned_identity.flyte_controlplane.id | ||
| datacatalog = azurerm_user_assigned_identity.flyte_controlplane.id | ||
| nucleus = azurerm_user_assigned_identity.flyte_dataplane.id | ||
| } | ||
| } | ||
|
|
||
| resource "azurerm_user_assigned_identity" "this" { | ||
| for_each = toset(values(local.mapping)) | ||
| name = each.key | ||
| location = var.azurerm_resource_group_location | ||
| resource_group_name = var.azurerm_resource_group_name | ||
| resource "azurerm_user_assigned_identity" "flyte_controlplane" { | ||
| name = "${var.deploy_id}-flyte-controlplane" | ||
| location = var.resource_group_location | ||
| resource_group_name = var.resource_group_name | ||
| tags = var.tags | ||
| } | ||
|
|
||
| resource "azurerm_user_assigned_identity" "flyte_dataplane" { | ||
| name = "${var.deploy_id}-flyte-dataplane" | ||
| location = var.resource_group_location | ||
| resource_group_name = var.resource_group_name | ||
| tags = var.tags | ||
| } | ||
|
|
||
| resource "azurerm_federated_identity_credential" "this" { | ||
| for_each = local.mapping | ||
| name = each.key | ||
| resource_group_name = var.azurerm_resource_group_name | ||
| for_each = local.federated_identity_mapping | ||
| name = "${var.deploy_id}-${each.key}" | ||
| resource_group_name = var.resource_group_name | ||
| audience = ["api://AzureADTokenExchange"] | ||
| issuer = var.azurerm_kubernetes_cluster_oidc_issuer_url | ||
| parent_id = azurerm_user_assigned_identity.this[each.value].id | ||
| subject = "system:serviceaccount:${var.namespaces.platform}:${var.serviceaccount_names[each.key]}" | ||
| issuer = var.oidc_issuer_url | ||
| parent_id = each.value | ||
| subject = "system:serviceaccount:${var.namespaces.platform}:${var.service_account_names[each.key]}" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,30 +1,56 @@ | ||
| resource "azurerm_role_definition" "flyte_storage_access" { | ||
| name = "${var.deploy_id}-flyte-storage-access" | ||
| resource "azurerm_role_definition" "flyte_metadata" { | ||
| name = "${var.deploy_id}-flyte-metadata-role" | ||
| scope = azurerm_storage_container.flyte_metadata.resource_manager_id | ||
| permissions { | ||
| actions = [ | ||
| "Microsoft.Storage/storageAccounts/blobServices/containers/read", | ||
| "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action" | ||
| data_actions = [ | ||
| "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read", | ||
| "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write", | ||
| "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action", | ||
| ] | ||
| } | ||
| } | ||
|
|
||
| resource "azurerm_role_definition" "flyte_data" { | ||
| name = "${var.deploy_id}-flyte-data-role" | ||
| scope = azurerm_storage_container.flyte_data.resource_manager_id | ||
| permissions { | ||
| data_actions = [ | ||
| "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read", | ||
| "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write", | ||
| "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action", | ||
| ] | ||
| } | ||
| assignable_scopes = [ | ||
| azurerm_storage_container.flyte_metadata.resource_manager_id, | ||
| azurerm_storage_container.flyte_data.resource_manager_id, | ||
| ] | ||
| } | ||
|
|
||
| resource "azurerm_role_assignment" "flyte_metadata_access" { | ||
| # Because the Get User Delegation Key operation acts at the level of the storage account, the | ||
| # Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey action must be scoped at the level | ||
| # of the storage account, the resource group, or the subscription. | ||
| # https://learn.microsoft.com/en-us/rest/api/storageservices/get-user-delegation-key | ||
| # | ||
| resource "azurerm_role_definition" "flyte_sas" { | ||
| name = "${var.deploy_id}-flyte-sas-role" | ||
| scope = azurerm_storage_account.flyte.id | ||
| permissions { | ||
| actions = [ | ||
| "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action", | ||
| ] | ||
| } | ||
| } | ||
|
|
||
| resource "azurerm_role_assignment" "flyte_metadata" { | ||
| scope = azurerm_storage_container.flyte_metadata.resource_manager_id | ||
| role_definition_id = azurerm_role_definition.flyte_storage_access.role_definition_resource_id | ||
| principal_id = azuread_group.flyte_metadata_access.object_id | ||
| role_definition_id = azurerm_role_definition.flyte_metadata.role_definition_resource_id | ||
| principal_id = azuread_group.flyte_metadata.object_id | ||
| } | ||
|
|
||
| resource "azurerm_role_assignment" "flyte_data_access" { | ||
| resource "azurerm_role_assignment" "flyte_data" { | ||
| scope = azurerm_storage_container.flyte_data.resource_manager_id | ||
| role_definition_id = azurerm_role_definition.flyte_storage_access.role_definition_resource_id | ||
| principal_id = azuread_group.flyte_data_access.object_id | ||
| role_definition_id = azurerm_role_definition.flyte_data.role_definition_resource_id | ||
| principal_id = azuread_group.flyte_data.object_id | ||
| } | ||
|
|
||
| resource "azurerm_role_assignment" "flyte_sas" { | ||
| scope = azurerm_storage_account.flyte.id | ||
| role_definition_id = azurerm_role_definition.flyte_sas.role_definition_resource_id | ||
| principal_id = azuread_group.flyte_sas.object_id | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,11 +1,30 @@ | ||
| resource "azurerm_storage_account" "flyte" { | ||
| name = join("", [replace(var.deploy_id, "/[_-]/", ""), "flyte"]) | ||
| location = var.resource_group_location | ||
| resource_group_name = var.resource_group_name | ||
| account_kind = "StorageV2" | ||
| account_tier = var.storage_account_tier | ||
| account_replication_type = var.storage_account_replication_type | ||
| access_tier = "Hot" | ||
| min_tls_version = "TLS1_2" | ||
| tags = var.tags | ||
| is_hns_enabled = true | ||
|
|
||
| lifecycle { | ||
| ignore_changes = [ | ||
| tags | ||
| ] | ||
| } | ||
| } | ||
|
|
||
| resource "azurerm_storage_container" "flyte_metadata" { | ||
| name = "${var.deploy_id}-flyte-metadata" | ||
| storage_account_name = var.azurerm_storage_account_name | ||
| storage_account_name = azurerm_storage_account.flyte.name | ||
| container_access_type = "private" | ||
| } | ||
|
|
||
| resource "azurerm_storage_container" "flyte_data" { | ||
| name = "${var.deploy_id}-flyte-data" | ||
| storage_account_name = var.azurerm_storage_account_name | ||
| storage_account_name = azurerm_storage_account.flyte.name | ||
| container_access_type = "private" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,56 +1,65 @@ | ||
| mock_provider "azuread" {} | ||
| mock_provider "azurerm" {} | ||
|
|
||
| run "test_identities" { | ||
| command = plan | ||
|
|
||
| assert { | ||
| condition = azurerm_user_assigned_identity.this["flyte_controlplane"].name == "flyte_controlplane" | ||
| condition = azurerm_user_assigned_identity.flyte_controlplane.name == "${var.deploy_id}-flyte-controlplane" | ||
| error_message = "Incorrect user-assigned identity name for flyte_controlplane" | ||
| } | ||
|
|
||
| assert { | ||
| condition = azurerm_user_assigned_identity.this["flyte_controlplane"].resource_group_name == var.azurerm_resource_group_name | ||
| condition = azurerm_user_assigned_identity.flyte_controlplane.resource_group_name == var.resource_group_name | ||
| error_message = "Incorrect user-assigned identity resource group name for flyte_controlplane" | ||
| } | ||
|
|
||
| assert { | ||
| condition = azurerm_user_assigned_identity.this["flyte_dataplane"].name == "flyte_dataplane" | ||
| condition = azurerm_user_assigned_identity.flyte_dataplane.name == "${var.deploy_id}-flyte-dataplane" | ||
| error_message = "Incorrect user-assigned identity name for flyte_dataplane" | ||
| } | ||
|
|
||
| assert { | ||
| condition = azurerm_user_assigned_identity.this["flyte_dataplane"].resource_group_name == var.azurerm_resource_group_name | ||
| condition = azurerm_user_assigned_identity.flyte_dataplane.resource_group_name == var.resource_group_name | ||
| error_message = "Incorrect user-assigned identity resource group name for flyte_dataplane" | ||
| } | ||
|
|
||
| assert { | ||
| condition = azurerm_federated_identity_credential.this["flyteadmin"].name == "flyteadmin" | ||
| condition = azurerm_federated_identity_credential.this["flyteadmin"].name == "${var.deploy_id}-flyteadmin" | ||
| error_message = "Incorrect federated identity credential name for flyteadmin" | ||
| } | ||
|
|
||
| assert { | ||
| condition = azurerm_federated_identity_credential.this["flyteadmin"].subject == "system:serviceaccount:${var.namespaces.platform}:${var.serviceaccount_names["flyteadmin"]}" | ||
| condition = azurerm_federated_identity_credential.this["flyteadmin"].subject == "system:serviceaccount:${var.namespaces.platform}:${var.service_account_names.flyteadmin}" | ||
| error_message = "Incorrect federated identity credential subject for flyteadmin" | ||
| } | ||
|
|
||
| assert { | ||
| condition = azurerm_federated_identity_credential.this["flytepropeller"].name == "flytepropeller" | ||
| condition = azurerm_federated_identity_credential.this["flytepropeller"].name == "${var.deploy_id}-flytepropeller" | ||
| error_message = "Incorrect federated identity credential name for flytepropeller" | ||
| } | ||
|
|
||
| assert { | ||
| condition = azurerm_federated_identity_credential.this["flytepropeller"].subject == "system:serviceaccount:${var.namespaces.platform}:${var.serviceaccount_names["flytepropeller"]}" | ||
| condition = azurerm_federated_identity_credential.this["flytepropeller"].subject == "system:serviceaccount:${var.namespaces.platform}:${var.service_account_names.flytepropeller}" | ||
| error_message = "Incorrect federated identity credential subject for flytepropeller" | ||
| } | ||
|
|
||
| assert { | ||
| condition = azurerm_federated_identity_credential.this["datacatalog"].name == "datacatalog" | ||
| condition = azurerm_federated_identity_credential.this["datacatalog"].name == "${var.deploy_id}-datacatalog" | ||
| error_message = "Incorrect federated identity credential name for datacatalog" | ||
| } | ||
|
|
||
| assert { | ||
| condition = azurerm_federated_identity_credential.this["datacatalog"].subject == "system:serviceaccount:${var.namespaces.platform}:${var.serviceaccount_names["datacatalog"]}" | ||
| condition = azurerm_federated_identity_credential.this["datacatalog"].subject == "system:serviceaccount:${var.namespaces.platform}:${var.service_account_names.datacatalog}" | ||
| error_message = "Incorrect federated identity credential subject for datacatalog" | ||
| } | ||
|
|
||
| assert { | ||
| condition = azurerm_federated_identity_credential.this["nucleus"].name == "${var.deploy_id}-nucleus" | ||
| error_message = "Incorrect federated identity credential name for nucleus" | ||
| } | ||
|
|
||
| assert { | ||
| condition = azurerm_federated_identity_credential.this["nucleus"].subject == "system:serviceaccount:${var.namespaces.platform}:${var.service_account_names.nucleus}" | ||
| error_message = "Incorrect federated identity credential subject for nucleus" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,16 +1,15 @@ | ||
| mock_provider "azuread" {} | ||
| mock_provider "azurerm" {} | ||
|
|
||
| run "test_outputs" { | ||
| command = plan | ||
|
|
||
| assert { | ||
| condition = output.flyte_metadata_container_name == azurerm_storage_container.flyte_metadata.name | ||
| condition = output.metadata_container_name == azurerm_storage_container.flyte_metadata.name | ||
| error_message = "Incorrect Flyte metadata container name output" | ||
| } | ||
|
|
||
| assert { | ||
| condition = output.flyte_data_container_name == azurerm_storage_container.flyte_data.name | ||
| condition = output.data_container_name == azurerm_storage_container.flyte_data.name | ||
| error_message = "Incorrect Flyte data container name output" | ||
| } | ||
| } |
Oops, something went wrong.