chore: use user assigned identity for all applications #1580
Conversation
|
Warning Rate limit exceeded@arealmaas has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 12 minutes and 33 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (1)
📝 Walkthrough📝 Walkthrough📝 WalkthroughWalkthroughThe pull request introduces several changes across multiple Bicep files to implement managed identities for various Azure applications. Each application configuration is updated to include a new managed identity resource, enhancing security by allowing applications to authenticate to Azure services without managing credentials. Environment variables are modified to reference the new managed identity's client ID, and access policies are updated to use the managed identity's principal ID instead of previous outputs. This ensures that the correct identity is utilized for resource access. Changes
Possibly related PRs
Suggested reviewers
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Outside diff range and nitpick comments (1)
.azure/applications/web-api-eu/main.bicep (1)
63-67: LGTM! Managed identity properly implemented for Web API EU application.The implementation follows the established pattern consistently:
- Managed identity resource
- Azure SDK environment variable
- Container app integration
- Key Vault and App Configuration access policies
The consistent implementation across all applications is commendable as it simplifies maintenance and reduces the likelihood of configuration errors.
The consistent pattern used across all applications for implementing managed identities is a good architectural choice. This uniformity:
- Simplifies maintenance
- Makes it easier to onboard new team members
- Reduces the likelihood of configuration errors
- Makes it easier to automate and script infrastructure changes
Also applies to: 86-89, 172-172, 180-180, 188-188
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
📒 Files selected for processing (7)
.azure/applications/graphql/main.bicep(3 hunks).azure/applications/sync-subject-resource-mappings-job/main.bicep(3 hunks).azure/applications/web-api-eu/main.bicep(3 hunks).azure/applications/web-api-migration-job/main.bicep(2 hunks).azure/applications/web-api-so/main.bicep(3 hunks).azure/modules/containerApp/main.bicep(3 hunks).azure/modules/containerAppJob/main.bicep(3 hunks)
🧰 Additional context used
📓 Learnings (4)
.azure/applications/graphql/main.bicep (1)
Learnt from: arealmaas
PR: digdir/dialogporten#1303
File: .azure/applications/service/main.bicep:116-120
Timestamp: 2024-11-12T05:32:45.311Z
Learning: In the Bicep file `.azure/applications/service/main.bicep`, the `managedIdentity` resource is created alongside the container app and does not exist prior to deployment.
.azure/applications/web-api-migration-job/main.bicep (1)
Learnt from: arealmaas
PR: digdir/dialogporten#1303
File: .azure/applications/service/main.bicep:116-120
Timestamp: 2024-11-12T05:32:45.311Z
Learning: In the Bicep file `.azure/applications/service/main.bicep`, the `managedIdentity` resource is created alongside the container app and does not exist prior to deployment.
.azure/applications/web-api-eu/main.bicep (1)
Learnt from: arealmaas
PR: digdir/dialogporten#1303
File: .azure/applications/service/main.bicep:116-120
Timestamp: 2024-11-12T05:32:45.311Z
Learning: In the Bicep file `.azure/applications/service/main.bicep`, the `managedIdentity` resource is created alongside the container app and does not exist prior to deployment.
.azure/applications/web-api-so/main.bicep (1)
Learnt from: arealmaas
PR: digdir/dialogporten#1303
File: .azure/applications/service/main.bicep:116-120
Timestamp: 2024-11-12T05:32:45.311Z
Learning: In the Bicep file `.azure/applications/service/main.bicep`, the `managedIdentity` resource is created alongside the container app and does not exist prior to deployment.
🔇 Additional comments (23)
.azure/applications/web-api-so/main.bicep (5)
91-96: Managed Identity Resource Declaration
The managedIdentity resource is correctly declared and will be created alongside the container app. This adheres to best practices for using user-assigned managed identities in Azure deployments.
114-117: Adding AZURE_CLIENT_ID Environment Variable
The environment variable AZURE_CLIENT_ID is correctly set to the managed identity's client ID. This ensures that the application can authenticate using the user-assigned managed identity.
173-173: Passing User-Assigned Identity ID to Container App Module
The userAssignedIdentityId parameter is appropriately passed to the containerApp module. This links the container app to the newly created managed identity, enabling it to utilize the managed identity for authentication.
181-181: Updating Key Vault Access Policy Principal IDs
The principalIds parameter for the Key Vault reader access policy is correctly updated to use the managed identity's principalId. This grants the necessary access permissions to the managed identity.
189-189: Updating App Configuration Access Policy Principal IDs
Similarly, the principalIds parameter for the App Configuration reader access policy is updated to use the managed identity's principalId. This ensures the managed identity has the required access to App Configuration.
.azure/modules/containerAppJob/main.bicep (4)
28-31: Adding userAssignedIdentityId Parameter
The userAssignedIdentityId parameter is correctly added as a required parameter with a minimum length constraint. This allows the module to accept an ID for a user-assigned managed identity.
49-52: Referencing Existing Managed Identity Resource
The managedIdentity resource is referenced as an existing resource using the provided userAssignedIdentityId. This ensures that the job uses the specified user-assigned managed identity.
57-60: Configuring Job Identity to Use User-Assigned Identity
The identity configuration for the job resource is correctly set to 'UserAssigned', and the userAssignedIdentities are properly specified. This enables the job to authenticate using the provided managed identity.
86-86: Updating Output identityPrincipalId
The output identityPrincipalId is updated to reference managedIdentity.properties.principalId. This change ensures that the output provides the principal ID of the user-assigned managed identity.
.azure/applications/web-api-migration-job/main.bicep (5)
37-42: Adding Managed Identity Resource
The managedIdentity resource is correctly declared to create a user-assigned managed identity for the migration job. This follows best practices for secure authentication.
48-51: Setting AZURE_CLIENT_ID Environment Variable
The environment variable AZURE_CLIENT_ID is appropriately set to the managed identity's client ID. This allows the migration job to utilize the managed identity for authentication.
75-75: Passing User-Assigned Identity ID to Migration Job Module
The userAssignedIdentityId parameter is correctly passed to the migrationJob module, linking the job to the newly created managed identity.
83-83: Updating Key Vault Access Policy Principal IDs
The principalIds parameter in the keyVaultReaderAccessPolicy module is updated to use managedIdentity.properties.principalId. This grants the managed identity the necessary access to Key Vault.
87-87: Updating Output identityPrincipalId
The output identityPrincipalId is updated to managedIdentity.properties.principalId, ensuring that it references the principal ID of the user-assigned managed identity.
.azure/modules/containerApp/main.bicep (4)
61-63: Making userAssignedIdentityId Parameter Required
The userAssignedIdentityId parameter is now required with a minimum length constraint. This change enforces the provision of a user-assigned managed identity ID when using this module.
84-85: Referencing Existing Managed Identity Resource
The managedIdentity resource is correctly referenced as an existing resource using the userAssignedIdentityId. This ensures the container app utilizes the specified managed identity.
91-96: Configuring Container App to Use User-Assigned Identity
The identity configuration of the containerApp resource is correctly set to 'UserAssigned', and the userAssignedIdentities are properly specified. This links the container app to the managed identity for authentication.
119-119: Updating Output identityPrincipalId
The output identityPrincipalId now references managedIdentity.properties.principalId, ensuring consistency with the use of the user-assigned managed identity.
.azure/applications/sync-subject-resource-mappings-job/main.bicep (4)
49-53: LGTM! Managed identity resource properly configured.
The managed identity resource is correctly defined with appropriate naming convention and inherits location and tags from parameters.
72-75: LGTM! Environment variable correctly configured for managed identity.
The AZURE_CLIENT_ID environment variable is properly set to use the managed identity's client ID, following Azure SDK conventions.
107-107: LGTM! Container app properly configured to use managed identity.
The container app module is correctly configured to use the managed identity through the userAssignedIdentityId parameter.
115-115: LGTM! Access policy and output properly updated for managed identity.
The Key Vault access policy and output are correctly updated to use the managed identity's principal ID.
Also applies to: 119-119
.azure/applications/graphql/main.bicep (1)
64-68: LGTM! Managed identity properly implemented for GraphQL application.
All components are correctly configured:
- Managed identity resource with proper naming
- Environment variable for Azure SDK authentication
- Container app integration
- Access policies for both Key Vault and App Configuration
The implementation follows the same pattern as other applications, maintaining consistency across the codebase.
Also applies to: 83-86, 170-170, 178-178, 186-186
|
Description
Related Issue(s)
Verification
Documentation
docs-directory, Altinnpedia or a separate linked PR in altinn-studio-docs., if applicable)