Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

POC: Proposed solution for flexible azure auth #1206

Closed
wants to merge 17 commits into from

Conversation

frodopwns
Copy link
Contributor

@frodopwns frodopwns commented Jul 1, 2020

Allows flexible authentication options for the Resource Group and Azure SQL operators as a way for proving the concept.

This PR adds 2 environment variables:

  • AZURE_OPERATOR_AUTH_SOURCE_MODE
  • AZURE_OPERATOR_AUTH_SOURCE_NAMESPACE

AZURE_OPERATOR_AUTH_SOURCE_MODE defaults to "fallback".
Potential values:

  • fallback: Operators tries to find service principal in namespace where resource request is created. If not found, the operator tries to find a credential in an admin namespace if AZURE_OPERATOR_AUTH_SOURCE_NAMESPACE is set. If those fail, the operator falls back to the current default of using a global credential.
  • namespace: Operator tries to find a credential named aso-auth in the same namespace as the request. This is a strict mode so no alternatives will be used.
  • admin-namespace: Operator tries to find a credential in the admin namespace designated by the env var mentioned above. The credential secret in that namespace would be named aso-auth-{target_namespace}. This allows admins to store secrets that grant permissions for deployment in other namespaces. This is also a strict mode.
  • global: Operator uses the current default which is to use a global service principal.

The Async Controller would source the credential before calling Ensure or Delete.

relates to #1173
relates to #1188

What this PR does / why we need it:
proposes a solution for allowing multiple service principals and later managed identities to be used in multi-tenant clusters

Special notes for your reviewer:
Look at the implementation and submit your feedback. This is a POC.

@@ -211,3 +225,85 @@ func (r *AsyncReconciler) Reconcile(req ctrl.Request, obj runtime.Object) (resul

return result, err
}

// AuthSourceMode determines the strategy used to soruce auth credentials when authenticating with Azure
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// AuthSourceMode determines the strategy used to soruce auth credentials when authenticating with Azure
// AuthSourceMode determines the strategy used to source auth credentials when authenticating with Azure

@matthchr
Copy link
Member

matthchr commented Feb 4, 2021

@babbageclunk I think as discussed we can close this PR based on the work you're doing?

@babbageclunk babbageclunk mentioned this pull request Apr 15, 2021
2 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants