Skip to content

Commit 68f5510

Browse files
ishuarishuar
authored
added complete example with aks (#3)
* added complete example with aks * docs: fmt * docs : make docs and fmt
1 parent 49a5adf commit 68f5510

File tree

11 files changed

+285
-2
lines changed

11 files changed

+285
-2
lines changed

‎.config/header.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,5 +93,7 @@ module "simple" {
9393
Examples are availabe in `examples` directory.
9494

9595
- [simple](/examples/simple)
96+
- [multiple-identities](/examples/multiple-identities/)
97+
- [complete-with-aks](/examples/complete-with-aks/)
9698

9799
**⭐️ Don't forget to give the project a star! Thanks again! ⭐️**

‎.github/release-version.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
## Update this file for a new release version.
22

3-
module_version: "0.2.0"
3+
module_version: "0.3.0"
44

55
## Example for manual release notes.
66
# release_notes: |

‎CHANGELOG.md‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
2323
2424
-->
2525

26+
## v0.3.0
27+
28+
### Added
29+
- Added complete example for creating multiple identities and kubernetes resources in azure kubernetes service.
30+
31+
### Fixed
32+
- Fix typos in the readme.
33+
2634
## v0.2.0
2735

2836
### Added
@@ -38,7 +46,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
3846

3947
- First version of Module.
4048
- Available Features
41-
- Multiple [Azure built-i00n roles](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles) assignments.
49+
- Multiple [Azure built-in roles](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles) assignments.
4250
- Multiple [Azure custom roles](https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles) assignment.
4351
- Combination of Azure built-in and custom roles on the same identity.
4452
- Optional Kubernetes Service Account and Namespace creation when using with Azure Kubernetes Service.

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,8 @@ module "simple" {
9292
Examples are availabe in `examples` directory.
9393

9494
- [simple](/examples/simple)
95+
- [multiple-identities](/examples/multiple-identities/)
96+
- [complete-with-aks](/examples/complete-with-aks/)
9597

9698
**⭐️ Don't forget to give the project a star! Thanks again! ⭐️**
9799

‎examples/complete-with-aks/.terraform.lock.hcl‎

Lines changed: 48 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎examples/complete-with-aks/Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
include ../Makefile

‎examples/complete-with-aks/README.md‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Introduction
2+
3+
This example show the example of using the module to create multiple user-managed identities and also create kubernetes resources (optional) in AKS.
4+
The AKS creation and dependent resources are out of this module scope. This example assumes that AKS cluster and other dependent resources are already created.
5+
6+
## Requirements
7+
8+
| Name | Version |
9+
|------|---------|
10+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3 |
11+
| <a name="requirement_azurerm"></a> [azurerm](#requirement\_azurerm) | ~> 3.85.0 |
12+
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | ~>2.24 |
13+
14+
## Providers
15+
16+
| Name | Version |
17+
|------|---------|
18+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.85.0 |
19+
20+
## Modules
21+
22+
| Name | Source | Version |
23+
|------|--------|---------|
24+
| <a name="module_complete_with_aks"></a> [complete\_with\_aks](#module\_complete\_with\_aks) | ../../ | n/a |
25+
26+
## Resources
27+
28+
| Name | Type |
29+
|------|------|
30+
| [azurerm_client_config.current](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/client_config) | data source |
31+
| [azurerm_dns_zone.example](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/dns_zone) | data source |
32+
| [azurerm_kubernetes_cluster.example](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/kubernetes_cluster) | data source |
33+
| [azurerm_resource_group.example](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/resource_group) | data source |
34+
| [azurerm_subscription.current](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/subscription) | data source |
35+
36+
## Inputs
37+
38+
| Name | Description | Type | Default | Required |
39+
|------|-------------|------|---------|:--------:|
40+
| <a name="input_dns_zone_name"></a> [dns\_zone\_name](#input\_dns\_zone\_name) | DNS Zone name | `string` | `"example.learndevops.in"` | no |
41+
| <a name="input_prefix"></a> [prefix](#input\_prefix) | Prefix for all resources in this example | `string` | `"wi-tf-mod"` | no |
42+
43+
## Outputs
44+
45+
No outputs.

‎examples/complete-with-aks/local.tf‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
locals {
2+
tags = {
3+
managed_by = "terraform"
4+
github_repo = "ishuar/terraform-azure-workload-identity"
5+
}
6+
7+
## Workload Identities
8+
external-dns = [
9+
{
10+
service_account_name = "${var.prefix}-sa-external-dns"
11+
namespace = "${var.prefix}-external-dns"
12+
role_assignments = [
13+
{
14+
role_definition_name = "DNS Zone Contributor"
15+
scope = data.azurerm_dns_zone.example.id
16+
},
17+
]
18+
},
19+
]
20+
## This example will also create a new namespace and service account kubernetes resources for cert-manager.
21+
cert-manager = [
22+
{
23+
service_account_name = "${var.prefix}-sa-cert-manager"
24+
namespace = "${var.prefix}-cert-manager"
25+
create_kubernetes_namespace = true
26+
create_service_account = true
27+
role_assignments = [
28+
{
29+
role_definition_name = "DNS Zone Contributor"
30+
scope = data.azurerm_dns_zone.example.id
31+
},
32+
]
33+
},
34+
]
35+
36+
## Example to create custom role for velero
37+
velero = [
38+
{
39+
service_account_name = "${var.prefix}-sa-velero"
40+
namespace = "${var.prefix}-velero"
41+
role_assignments = [
42+
{
43+
role_definition_name = "velero"
44+
create_custom_role = true
45+
scope = data.azurerm_subscription.current.id
46+
custom_role_description = "Role Required for velero to manage snapshots, backups and restores."
47+
custom_role_actions = [
48+
"Microsoft.Compute/disks/read",
49+
"Microsoft.Compute/disks/write",
50+
"Microsoft.Compute/disks/endGetAccess/action",
51+
"Microsoft.Compute/disks/beginGetAccess/action",
52+
"Microsoft.Compute/snapshots/read",
53+
"Microsoft.Compute/snapshots/write",
54+
"Microsoft.Compute/snapshots/delete",
55+
"Microsoft.Storage/storageAccounts/listkeys/action",
56+
"Microsoft.Storage/storageAccounts/regeneratekey/action",
57+
"Microsoft.Storage/storageAccounts/blobServices/containers/delete",
58+
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
59+
"Microsoft.Storage/storageAccounts/blobServices/containers/write",
60+
"Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
61+
]
62+
custom_role_data_actions = [
63+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
64+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
65+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
66+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action",
67+
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
68+
]
69+
}
70+
]
71+
}
72+
]
73+
74+
identities = concat(
75+
local.external-dns,
76+
local.cert-manager,
77+
local.velero
78+
)
79+
}

‎examples/complete-with-aks/main.tf‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
data "azurerm_client_config" "current" {}
2+
3+
data "azurerm_subscription" "current" {}
4+
5+
data "azurerm_resource_group" "example" {
6+
name = "rg-${var.prefix}"
7+
}
8+
9+
data "azurerm_kubernetes_cluster" "example" {
10+
name = "${var.prefix}-aks"
11+
resource_group_name = data.azurerm_resource_group.example.name
12+
}
13+
14+
data "azurerm_dns_zone" "example" {
15+
name = var.dns_zone_name
16+
resource_group_name = data.azurerm_resource_group.example.name
17+
}
18+
19+
module "complete_with_aks" {
20+
for_each = { for identity in local.identities : identity.service_account_name => identity }
21+
22+
source = "../../"
23+
resource_group_name = data.azurerm_resource_group.example.name
24+
location = data.azurerm_resource_group.example.location
25+
oidc_issuer_url = data.azurerm_kubernetes_cluster.example.oidc_issuer_url
26+
service_account_name = each.value.service_account_name
27+
namespace = each.value.namespace
28+
role_assignments = each.value.role_assignments
29+
30+
## Create Kubernetes resources
31+
create_kubernetes_namespace = try(each.value.create_kubernetes_namespace, false)
32+
create_service_account = try(each.value.create_service_account, false)
33+
34+
depends_on = [
35+
data.azurerm_kubernetes_cluster.example,
36+
data.azurerm_dns_zone.example
37+
]
38+
}

‎examples/complete-with-aks/variables.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
variable "prefix" {
2+
type = string
3+
description = "Prefix for all resources in this example"
4+
default = "wi-tf-mod"
5+
}
6+
7+
variable "dns_zone_name" {
8+
type = string
9+
description = "DNS Zone name"
10+
default = "example.learndevops.in"
11+
}

0 commit comments

Comments
 (0)