Support for msi/resource-manager / 2022-01-31-preview

[weisdd]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Service Name

msi/resource-manager

API Versions Required

2022-01-31-preview

References

Target usage

To fully enable Workload Identity setups on AKS (https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview), 3 things are required:

• OIDC issuer:
  • already available through oidc_issuer_enabled: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/kubernetes_cluster#oidc_issuer_enabled
• workload identity addon:
  • already available through workload_identity_enabled: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster#workload_identity_enabled
• federated identity credentials (basically, some sort of association between a managed identity and a kubernetes service account). azurerm-provider does not currently offer support for that.

After a client for msi/resource-manager is generated, it'll help to work on a PR for this feature request: hashicorp/terraform-provider-azurerm#18617

Azure API

• The API is described here: https://github.com/Azure/azure-rest-api-specs/blob/main/specification/msi/resource-manager/Microsoft.ManagedIdentity/preview/2022-01-31-preview/ManagedIdentity.json
• That's an example for the resource creation: https://github.com/Azure/azure-rest-api-specs/blob/main/specification/msi/resource-manager/Microsoft.ManagedIdentity/preview/2022-01-31-preview/examples/FederatedIdentityCredentialCreate.json

Extra information

• azuread has a similar resource: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_federated_identity_credential, though the underlying library offers a client only for applications, not managed identities: https://pkg.go.dev/github.com/manicminer/hamilton/msgraph#ApplicationsClient.CreateFederatedIdentityCredential

[favoretti]

hashicorp/pandora#1805

[weisdd]

@favoretti thanks, I was not aware of pandora :)
Since you assigned hashicorp/terraform-provider-azurerm#18617 to yourself, I guess you plan to implement support for the new resource as well. Then I'll just follow updates.

[favoretti]

@weisdd Yeah, as soon as SDK is merged - I'll add the resource.

[tombuildsstuff]

Available here: https://github.com/hashicorp/go-azure-sdk/tree/v0.20221108.1145701/resource-manager/managedidentity/2022-01-31-preview which is being vendored into AzureRM here: hashicorp/terraform-provider-azurerm#19193 - thanks @favoretti