start managing azure infra with terraform#8974
Open
upodroid wants to merge 1 commit into
Open
Conversation
k8s-ci-robot
added
area/infra
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: upodroid The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
size/L
This comment has been minimized.
This comment has been minimized.
nojnhuh
reviewed
Jan 20, 2026
upodroid
force-pushed
the
az-terraform
branch
from
ab49a22 to
6a013be
Compare
This comment has been minimized.
This comment has been minimized.
upodroid
force-pushed
the
az-terraform
branch
from
6a013be to
ba08330
Compare
Contributor
Argo CD Diff PreviewSummary: Total: 2 files changed
Modified (2):
± aks-prow-build (+16)
± atlantis (+21)aks-prow-build (kubernetes/apps/prow.yaml)@@ Application modified: aks-prow-build (kubernetes/apps/prow.yaml) @@
}
}
kind: ConfigMap
metadata:
name: google-adc
namespace: test-pods
---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ annotations:
+ azure.workload.identity/client-id: 333bb18b-207b-4abd-9ed0-e7e3834378b1
+ name: azure
+ namespace: test-pods
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ annotations:
+ azure.workload.identity/client-id: f23f8fcc-855b-40fd-a41b-b329ccdb95a1
+ name: rg-cleanup
+ namespace: test-pods
+---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
api-approved.kubernetes.io: https://github.com/kubernetes-sigs/boskos/pull/105
name: dynamicresourcelifecycles.boskos.k8s.io
spec:atlantis (kubernetes/apps/atlantis.yaml)@@ Application modified: atlantis (kubernetes/apps/atlantis.yaml) @@
- env:
- name: AWS_ROLE_ARN
value: arn:aws:iam::348685125169:role/atlantis
- name: AWS_WEB_IDENTITY_TOKEN_FILE
value: /var/run/secrets/aws-iam-token/serviceaccount/token
- name: AWS_REGION
value: us-east-2
+ - name: ARM_USE_AKS_WORKLOAD_IDENTITY
+ value: "true"
+ - name: ARM_SUBSCRIPTION_ID
+ value: 46678f10-4bbb-447e-98e8-d2829589f2d8
+ - name: AZURE_CLIENT_ID
+ value: 6fe87cee-6470-45d8-accc-57687193e504
+ - name: AZURE_FEDERATED_TOKEN_FILE
+ value: /var/run/secrets/azure-token/serviceaccount/token
+ - name: AZURE_TENANT_ID
+ value: d1aa7522-0959-442e-80ee-8c4f7fb4c184
- name: ATLANTIS_CONFIG
value: /config/atlantis.yaml
- name: ATLANTIS_GH_TOKEN
valueFrom:
secretKeyRef:
key: token
name: atlantis-vcs
@@ skipped 32 lines (41 -> 72) @@
memory: 1Gi
volumeMounts:
- mountPath: /config
name: config
- mountPath: /var/run/secrets/aws-iam-token/serviceaccount
name: aws-iam-token
readOnly: true
+ - mountPath: /var/run/secrets/azure-token/serviceaccount
+ name: azure-token
+ readOnly: true
- mountPath: /atlantis
name: atlantis-data
securityContext:
fsGroup: 1000
serviceAccountName: atlantis
volumes:
- configMap:
name: atlantis-config-4mc949mdm2
name: config
- name: aws-iam-token
projected:
defaultMode: 420
sources:
- serviceAccountToken:
audience: sts.amazonaws.com
+ expirationSeconds: 86400
+ path: token
+ - name: azure-token
+ projected:
+ defaultMode: 420
+ sources:
+ - serviceAccountToken:
+ audience: api://AzureADTokenExchange
expirationSeconds: 86400
path: token
updateStrategy:
rollingUpdate:
partition: 0
type: RollingUpdate
volumeClaimTemplates:Stats: |
Member
Author
|
atlantis plan |
This comment has been minimized.
This comment has been minimized.
Member
Author
|
atlantis plan |
This comment has been minimized.
This comment has been minimized.
Member
Author
|
atlantis plan |
This comment has been minimized.
This comment has been minimized.
Member
Author
|
atlantis plan |
This comment has been minimized.
This comment has been minimized.
Member
Author
|
atlantis plan |
Contributor
|
Ran Plan for dir: Plan Error Show Output |
|
The Kubernetes project currently lacks enough contributors to adequately respond to all PRs. This bot triages PRs according to the following rules:
You can:
Please send feedback to sig-contributor-experience at kubernetes/community. /lifecycle stale |
k8s-ci-robot
added
the
lifecycle/stale
|
The Kubernetes project currently lacks enough active contributors to adequately respond to all PRs. This bot triages PRs according to the following rules:
You can:
Please send feedback to sig-contributor-experience at kubernetes/community. /lifecycle rotten |
k8s-ci-robot
added
lifecycle/rotten
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR introduces a few changes: