feat: delegated identity support

client/aci/client.go

@@ -14,13 +14,15 @@ import (
 const (
 	defaultUserAgent = "virtual-kubelet/azure-arm-aci/2021-07-01"
 	apiVersion       = "2021-07-01"
+	aksApiVersion	 = "2022-04-01"
 
 	containerGroupURLPath                    = "subscriptions/{{.subscriptionId}}/resourceGroups/{{.resourceGroup}}/providers/Microsoft.ContainerInstance/containerGroups/{{.containerGroupName}}"
 	containerGroupListURLPath                = "subscriptions/{{.subscriptionId}}/providers/Microsoft.ContainerInstance/containerGroups"
 	containerGroupListByResourceGroupURLPath = "subscriptions/{{.subscriptionId}}/resourceGroups/{{.resourceGroup}}/providers/Microsoft.ContainerInstance/containerGroups"
 	containerLogsURLPath                     = containerGroupURLPath + "/containers/{{.containerName}}/logs"
 	containerExecURLPath                     = containerGroupURLPath + "/containers/{{.containerName}}/exec"
 	containerGroupMetricsURLPath             = containerGroupURLPath + "/providers/microsoft.Insights/metrics"
+	aksClustersListURLPath                   = "subscriptions/{{.subscriptionId}}/resourceGroups/{{.resourceGroup}}/providers/Microsoft.ContainerService/managedClusters"
 )
 
 // Client is a client for interacting with Azure Container Instances.

client/aci/list.go

@@ -52,7 +52,6 @@ func (c *Client) ListContainerGroups(ctx context.Context, resourceGroup string)
 		return nil, fmt.Errorf("Sending get container group list request failed: %v", err)
 	}
 	defer resp.Body.Close()
-
 	// 200 (OK) is a success response.
 	if err := api.CheckResponse(resp); err != nil {
 		return nil, err
@@ -69,3 +68,69 @@ func (c *Client) ListContainerGroups(ctx context.Context, resourceGroup string)
 
 	return &list, nil
 }
+
+func (c *Client) ListAKSClusters(ctx context.Context, resourceGroup string) (*AKSClusterListResult, error) {
+
+	// make aksApiVersion a new constant
+	urlParams := url.Values{
+		"api-version": []string{aksApiVersion},
+	}
+
+	// Create the url.
+	uri := api.ResolveRelative(c.auth.ResourceManagerEndpoint, aksClustersListURLPath)
+	uri += "?" + url.Values(urlParams).Encode()
+
+	// Create the request.
+	req, err := http.NewRequest("GET", uri, nil)
+	if err != nil {
+		return nil, fmt.Errorf("Creating get AKS cluster list uri request failed: %v", err)
+	}
+	req = req.WithContext(ctx)
+
+	// Add the parameters to the url.
+	err = api.ExpandURL(req.URL, map[string]string{
+		"subscriptionId": c.auth.SubscriptionID,
+		"resourceGroup":  resourceGroup,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("Expanding URL with parameters failed: %v", err)
+	}
+
+	// Send the request.
+	resp, err := c.hc.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("Sending get clusters list request failed: %v", err)
+	}
+	defer resp.Body.Close()
+
+	// 200 (OK) is a success response.
+	if err := api.CheckResponse(resp); err != nil {
+		return nil, err
+	}
+
+	// Decode the body from the response.
+	if resp.Body == nil {
+		return nil, errors.New("List AKS clusters returned an empty body in the response")
+	}
+
+	var list AKSClusterListResult
+	if err := json.NewDecoder(resp.Body).Decode(&list); err != nil {
+		return nil, fmt.Errorf("Decoding get AKS clusters response body failed: %v", err)
+	}
+	return &list, nil
+
+}
+
+func (c *Client) GetAKSCluster(ctx context.Context, resourceGroup string, clusterFqdn string) (*AKSCluster, error) {
+	clusters, err := c.ListAKSClusters(ctx, resourceGroup)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, cluster := range clusters.Value {
+		if cluster.Properties.Fqdn == clusterFqdn {
+			return &cluster, nil
+		}
+	}
+	return nil, fmt.Errorf("no cluster found with domain %s, in resource group %s", clusterFqdn, resourceGroup)
+}

client/aci/types.go

@@ -66,6 +66,38 @@ type AzureFileVolume struct {
 	StorageAccountKey  string `json:"storageAccountKey,omitempty"`
 }
 
+// AKSClusterListResult is the aks cluster list response that contains cluster properties
+// ttps://management.azure.com/subscriptions/{subscription}/resourceGroups/{resouorce-groups}/providers/Microsoft.ContainerService/managedClusters/{clusterid}?api-version=2022-04-01
+type AKSClusterListResult struct {
+	api.ResponseMetadata `json:"-"`
+	Value                []AKSCluster			  `json:"value,omitempty"`
+	NextLink             string					  `json:"nextLink,omitempty"`
+}
+
+// AKS cluster object along with some properties
+type AKSCluster struct {
+	Id string `json:"id,omitempty"`
+	Name string `json:"name,omitempty"`
+	Properties AKSClusterPropertiesTruncated `json:"properties,omitempty"`
+}
+
+// truncated properties only include identity profile (kubelet identity)
+type AKSClusterPropertiesTruncated struct {
+	Fqdn string `json:"fqdn,omitempty"`
+	IdentityProfile AKSIdentityProfile `json:"identityProfile,omitempty"`
+}
+
+// AKS Identity profile definition
+type AKSIdentityProfile struct {
+	KubeletIdentity AzIdentity
+}
+
+// Azure managed identity definition
+type AzIdentity struct {
+	ResourceId string
+	ClientId string
+	ObjectId string
+}
 // Container is a container instance.
 type Container struct {
 	Name                string `json:"name,omitempty"`
@@ -81,6 +113,7 @@ type ContainerGroup struct {
 	Location                 string            `json:"location,omitempty"`
 	Tags                     map[string]string `json:"tags,omitempty"`
 	ContainerGroupProperties `json:"properties,omitempty"`
+	Identity *ACIContainerGroupIdentity `json:"identity,omitempty"`
 }
 
 // ContainerGroupProperties is
@@ -99,6 +132,24 @@ type ContainerGroupProperties struct {
 	DNSConfig                *DNSConfig                           `json:"dnsConfig,omitempty"`
 }
 
+// container group identity object
+type ACIContainerGroupIdentity struct {
+	PrincipalId string `json:"principalid,omitempty"`
+	TenantId string `json:"tenantid,omitempty"`
+	Type string `json:"type,omitempty"`
+	UserAssignedIdentities map[string]map[string]string `json:"userassignedidentities,omitempty"`
+	DelegatedResources map[string]DelegatedIdentitySpec `json:"delegatedResources,omitempty"`
+}
+
+// delegated identity specification
+type DelegatedIdentitySpec struct {
+	ResourceId string		`json:"resourceId,omitempty"`
+	TenantId string			`json:"tenantId,omitempty"`
+	ReferralResource string `json:"referralResource,omitempty"`
+	Location string			`json:"location,omitempty"`
+
+}
+
 // ContainerGroupPropertiesInstanceView is the instance view of the container group. Only valid in response.
 type ContainerGroupPropertiesInstanceView struct {
 	Events []Event `json:"events,omitempty"`
@@ -183,6 +234,8 @@ type ImageRegistryCredential struct {
 	Server   string `json:"server,omitempty"`
 	Username string `json:"username,omitempty"`
 	Password string `json:"password,omitempty"`
+	IdentityURL string `json:"identityurl,omitempty"`
+	Identity string `json:"identity,omitempty"`
 }
 
 // IPAddress is IP address for the container group.