-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Feature/add support for all types of azure auth mechanism (#126)
* 785124 - initial impl of additional Azure auth options * HDP 785124 - standardize variable names, implement unit testing for auth validator * HDP 785124 - implement cerbot manager unit tests and fix arising issues * HDP 785124 - formatting changes * HDP 785124 - streamline if branching in new logic * HDP 785124 - improve logging * HDP 785124 - add missing tests and test files * HDP 785124 - cleanup imports * HDP 785124 - update readme * HDP 785124 - fix formatting * HDP 785124 - delete unused file * HDP 785124 - reformatting by black * HDP 785124 - complement tests, increase validator robustness * HDP devops 785124 - add service principal certification handling, improve tests and refactor credentials validator logic * Update README.md Co-authored-by: felixZdi <93919627+felixZdi@users.noreply.github.com> --------- Co-authored-by: felixZdi <93919627+felixZdi@users.noreply.github.com>
- Loading branch information
Showing
31 changed files
with
928 additions
and
19 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
6 changes: 6 additions & 0 deletions
6
tests/app/resources/certbot_init/expected_azure_cli_credentials.ini
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,6 @@ | ||
dns_azure_use_cli_credentials = true | ||
dns_azure_tenant_id = 56578228-5913-11ee-8c99-0242ac120002 | ||
dns_azure_environment = AzurePublicCloud | ||
dns_azure_zone1 = xyz.example.org:/subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/example.org | ||
dns_azure_zone2 = zyx.example.org:/subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/my-dev.domain.com/TXT/_acme-challenge.zyx | ||
dns_azure_zone3 = abc.example.org:/subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/my-dev.domain.com/TXT/_acme |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,6 @@ | ||
dns_azure_msi_client_id = 00000000-0000-0000-0000-000000000000 | ||
dns_azure_tenant_id = 56578228-5913-11ee-8c99-0242ac120002 | ||
dns_azure_environment = AzurePublicCloud | ||
dns_azure_zone1 = xyz.example.org:/subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/example.org | ||
dns_azure_zone2 = zyx.example.org:/subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/my-dev.domain.com/TXT/_acme-challenge.zyx | ||
dns_azure_zone3 = abc.example.org:/subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/my-dev.domain.com/TXT/_acme |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,7 @@ | ||
dns_azure_sp_client_id = 00000000-0000-0000-0000-000000000000 | ||
dns_azure_sp_client_secret = xyz | ||
dns_azure_tenant_id = 56578228-5913-11ee-8c99-0242ac120002 | ||
dns_azure_environment = AzurePublicCloud | ||
dns_azure_zone1 = xyz.example.org:/subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/example.org | ||
dns_azure_zone2 = zyx.example.org:/subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/my-dev.domain.com/TXT/_acme-challenge.zyx | ||
dns_azure_zone3 = abc.example.org:/subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/my-dev.domain.com/TXT/_acme |
7 changes: 7 additions & 0 deletions
7
tests/app/resources/certbot_init/expected_sp_credentials_cert.ini
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,7 @@ | ||
dns_azure_sp_client_id = 00000000-0000-0000-0000-000000000000 | ||
dns_azure_sp_certificate_path = /path/to/cert.pem | ||
dns_azure_tenant_id = 56578228-5913-11ee-8c99-0242ac120002 | ||
dns_azure_environment = AzurePublicCloud | ||
dns_azure_zone1 = xyz.example.org:/subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/example.org | ||
dns_azure_zone2 = zyx.example.org:/subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/my-dev.domain.com/TXT/_acme-challenge.zyx | ||
dns_azure_zone3 = abc.example.org:/subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/my-dev.domain.com/TXT/_acme |
6 changes: 6 additions & 0 deletions
6
tests/app/resources/certbot_init/expected_system_assigned_idty_credentials.ini
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,6 @@ | ||
dns_azure_msi_system_assigned = true | ||
dns_azure_tenant_id = 56578228-5913-11ee-8c99-0242ac120002 | ||
dns_azure_environment = AzurePublicCloud | ||
dns_azure_zone1 = xyz.example.org:/subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/example.org | ||
dns_azure_zone2 = zyx.example.org:/subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/my-dev.domain.com/TXT/_acme-challenge.zyx | ||
dns_azure_zone3 = abc.example.org:/subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/my-dev.domain.com/TXT/_acme |
6 changes: 6 additions & 0 deletions
6
tests/app/resources/certbot_init/expected_workload_idty_credentials.ini
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,6 @@ | ||
dns_azure_use_workload_identity_credentials = true | ||
dns_azure_tenant_id = 56578228-5913-11ee-8c99-0242ac120002 | ||
dns_azure_environment = AzurePublicCloud | ||
dns_azure_zone1 = xyz.example.org:/subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/example.org | ||
dns_azure_zone2 = zyx.example.org:/subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/my-dev.domain.com/TXT/_acme-challenge.zyx | ||
dns_azure_zone3 = abc.example.org:/subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/my-dev.domain.com/TXT/_acme |
28 changes: 28 additions & 0 deletions
28
tests/app/resources/config/credential_tests/accepted_azure_cli_credentials.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,28 @@ | ||
use_azure_cli_credentials: True | ||
server: https://acme-staging-v02.api.letsencrypt.org/directory | ||
|
||
tenant_id: 56578228-5913-11ee-8c99-0242ac120002 | ||
|
||
key_vault_id: https://my12keyvaultdev.vault.azure.net/ | ||
# keyvault_account_secret_name: #optional / default: acme-account-${acme_server} #if non-existing or empty, certbot register will be executed, account directory will be stored as base64 tar.gz file | ||
eab: | ||
enabled: false #optional / default: false | ||
# kid_secret_name: #optional / default: acme-eab-kid #must be created upfront with information from CIT | ||
# hmac_key_secret_name: #optional / default: acme-eab-hmac-key #must be created upfront with information from CIT | ||
|
||
certbot.ini: | | ||
key-type = rsa | ||
rsa-key-size = 2048 | ||
certificates: | ||
- name: tls-xyz-example-org | ||
dns_zone_resource_id: /subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/example.org | ||
domains: # min 1 entry | ||
- name: xyz.example.org | ||
- name: zyx.example.org | ||
dns_zone_resource_id: /subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/my-dev.domain.com | ||
|
||
- name: tls-wildcard-abc-example-org | ||
dns_zone_resource_id: /subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/my-dev.domain.com | ||
domains: | ||
- name: "*.abc.example.org" |
29 changes: 29 additions & 0 deletions
29
tests/app/resources/config/credential_tests/accepted_managed_idty.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,29 @@ | ||
use_managed_identity_credentials: True | ||
managed_identity_id: 00000000-0000-0000-0000-000000000000 | ||
server: https://acme-staging-v02.api.letsencrypt.org/directory | ||
|
||
tenant_id: 56578228-5913-11ee-8c99-0242ac120002 | ||
|
||
key_vault_id: https://my12keyvaultdev.vault.azure.net/ | ||
# keyvault_account_secret_name: #optional / default: acme-account-${acme_server} #if non-existing or empty, certbot register will be executed, account directory will be stored as base64 tar.gz file | ||
eab: | ||
enabled: false #optional / default: false | ||
# kid_secret_name: #optional / default: acme-eab-kid #must be created upfront with information from CIT | ||
# hmac_key_secret_name: #optional / default: acme-eab-hmac-key #must be created upfront with information from CIT | ||
|
||
certbot.ini: | | ||
key-type = rsa | ||
rsa-key-size = 2048 | ||
certificates: | ||
- name: tls-xyz-example-org | ||
dns_zone_resource_id: /subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/example.org | ||
domains: # min 1 entry | ||
- name: xyz.example.org | ||
- name: zyx.example.org | ||
dns_zone_resource_id: /subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/my-dev.domain.com | ||
|
||
- name: tls-wildcard-abc-example-org | ||
dns_zone_resource_id: /subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/my-dev.domain.com | ||
domains: | ||
- name: "*.abc.example.org" |
28 changes: 28 additions & 0 deletions
28
tests/app/resources/config/credential_tests/accepted_managed_idty_no_flag.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,28 @@ | ||
managed_identity_id: 00000000-0000-0000-0000-000000000000 | ||
server: https://acme-staging-v02.api.letsencrypt.org/directory | ||
|
||
tenant_id: 56578228-5913-11ee-8c99-0242ac120002 | ||
|
||
key_vault_id: https://my12keyvaultdev.vault.azure.net/ | ||
# keyvault_account_secret_name: #optional / default: acme-account-${acme_server} #if non-existing or empty, certbot register will be executed, account directory will be stored as base64 tar.gz file | ||
eab: | ||
enabled: false #optional / default: false | ||
# kid_secret_name: #optional / default: acme-eab-kid #must be created upfront with information from CIT | ||
# hmac_key_secret_name: #optional / default: acme-eab-hmac-key #must be created upfront with information from CIT | ||
|
||
certbot.ini: | | ||
key-type = rsa | ||
rsa-key-size = 2048 | ||
certificates: | ||
- name: tls-xyz-example-org | ||
dns_zone_resource_id: /subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/example.org | ||
domains: # min 1 entry | ||
- name: xyz.example.org | ||
- name: zyx.example.org | ||
dns_zone_resource_id: /subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/my-dev.domain.com | ||
|
||
- name: tls-wildcard-abc-example-org | ||
dns_zone_resource_id: /subscriptions/2709c03e-5888-11ee-8c99-0242ac120002/resourceGroups/rg123-my-rg/providers/Microsoft.Network/dnszones/my-dev.domain.com | ||
domains: | ||
- name: "*.abc.example.org" |
Oops, something went wrong.