feat: simplify azure vendor access module (#118)

streamnative · Feb 28, 2025 · 8f46442 · 8f46442
1 parent 91d111d
commit 8f46442
Show file tree

Hide file tree

Showing 4 changed files with 40 additions and 10 deletions.
diff --git a/modules/azure/sn-cloud-manager/main.tf b/modules/azure/sn-cloud-manager/main.tf
@@ -201,4 +201,14 @@ output "sn_automation_client_id" {
 output "sn_automation_principal_id" {
   value       = azurerm_user_assigned_identity.sn_automation.principal_id
   description = "The principal ID of the sn automation service principal for StreamNative Cloud automation"
-}
+}
+
+output "subscription_id" {
+  value       = data.azurerm_subscription.current.subscription_id
+  description = "The subscription ID of the AKS cluster"
+}
+
+output "tenant_id" {
+  value       = data.azurerm_subscription.current.tenant_id
+  description = "The tenant ID of the AKS cluster"
+}
diff --git a/modules/azure/vendor-access/main.tf b/modules/azure/vendor-access/main.tf
@@ -21,6 +21,18 @@ locals {
     "Service"                = "StreamNative Cloud"
     "StreamNativeCloudOrgID" = var.streamnative_org_id
   }, var.additional_tags)
+
+  identity_resource_group    = var.identity_resource_group != "" ? var.identity_resource_group : format("sncloud-%s-manager-rg", var.streamnative_org_id)
+}
+
+data "azurerm_user_assigned_identity" "automation" {
+  name                = format("sncloud-%s-automation", var.streamnative_org_id)
+  resource_group_name = local.identity_resource_group
+}
+
+data "azurerm_user_assigned_identity" "support" {
+  name                = format("sncloud-%s-support", var.streamnative_org_id)
+  resource_group_name = local.identity_resource_group
 }
 
 # Create a resource group for the AKS cluster
@@ -69,31 +81,31 @@ resource "azurerm_role_definition" "velero_backup_role" {
 resource "azurerm_role_assignment" "sn_automation" {
   scope                = azurerm_resource_group.aks.id
   role_definition_name = "Contributor"
-  principal_id         = var.sn_automation_principal_id
+  principal_id         = data.azurerm_user_assigned_identity.automation.principal_id
   depends_on           = [azurerm_resource_group.aks]
 }
 
 # Grand the sn automation service principal as the Azure Kubernetes Service Cluster Admin Role to the AKS resource group
 resource "azurerm_role_assignment" "sn_automation_cluster_admin" {
   scope                = azurerm_resource_group.aks.id
   role_definition_name = "Azure Kubernetes Service Cluster Admin Role"
-  principal_id         = var.sn_automation_principal_id
+  principal_id         = data.azurerm_user_assigned_identity.automation.principal_id
   depends_on           = [azurerm_resource_group.aks]
 }
 
 # Grand the sn support service principal as the Azure Kubernetes Service Cluster User Role to the AKS resource group
 resource "azurerm_role_assignment" "sn_support" {
   scope                = azurerm_resource_group.aks.id
   role_definition_name = "Azure Kubernetes Service Cluster User Role"
-  principal_id         = var.sn_support_principal_id
+  principal_id         = data.azurerm_user_assigned_identity.support.principal_id
   depends_on           = [azurerm_resource_group.aks]
 }
 
 # Grand the sn automation service principal as the Constrain roles by Role Based Access Control Administrator to the AKS resource group
 resource "azurerm_role_assignment" "user_access_administrator" {
   scope                = azurerm_resource_group.aks.id
   role_definition_name = "Role Based Access Control Administrator"
-  principal_id         = var.sn_automation_principal_id
+  principal_id         = data.azurerm_user_assigned_identity.automation.principal_id
   condition_version    = "2.0"
   condition            = templatefile("${path.module}/role-assignment-condition.tpl", { role_definition_id = azurerm_role_definition.velero_backup_role.role_definition_id })
   depends_on           = [azurerm_role_definition.velero_backup_role]

diff --git a/modules/azure/vendor-access/outputs.tf b/modules/azure/vendor-access/outputs.tf
@@ -18,7 +18,7 @@ output "sn_automation_client_id" {
 }
 
 output "sn_automation_principal_id" {
-  value       = var.sn_automation_principal_id
+  value       = data.azurerm_user_assigned_identity.automation.principal_id
   description = "The principal ID of the sn automation service principal for StreamNative Cloud automation"
 }
 
@@ -28,7 +28,7 @@ output "sn_support_client_id" {
 }
 
 output "sn_support_principal_id" {
-  value       = var.sn_support_principal_id
+  value       = data.azurerm_user_assigned_identity.support.principal_id
   description = "The principal ID of the sn support service principal for StreamNative Cloud support access"
 }
 

diff --git a/modules/azure/vendor-access/variables.tf b/modules/azure/vendor-access/variables.tf
@@ -35,12 +35,14 @@ variable "streamnative_org_id" {
 
 variable "sn_automation_principal_id" {
   type        = string
-  description = "The principal ID of the sn automation service principal for StreamNative Cloud automation"
+  description = "(Deprecated) The principal ID of the sn automation service principal for StreamNative Cloud automation"
+  default     = ""
 }
 
 variable "sn_support_principal_id" {
   type        = string
-  description = "The principal ID of the sn support service principal for StreamNative Cloud support access"
+  description = "(Deprecated) The principal ID of the sn support service principal for StreamNative Cloud support access"
+  default     = ""
 }
 
 variable "sn_automation_client_id" {
@@ -51,4 +53,10 @@ variable "sn_automation_client_id" {
 variable "sn_support_client_id" {
   type        = string
   description = "The client ID of the sn support service principal for StreamNative Cloud support access"
-}
+}
+
+variable "identity_resource_group" {
+  type        = string
+  description = "The resource group name which contains the automation and support managed identities"
+  default     = ""
+}