CORS-2467: dns: azure: use azidentity with an adapter #846
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,21 +1,67 @@ | ||
| package client | ||
|
|
||
| import ( | ||
| "strings" | ||
|
|
||
| "github.com/Azure/azure-sdk-for-go/sdk/azcore" | ||
| "github.com/Azure/azure-sdk-for-go/sdk/azcore/cloud" | ||
| "github.com/Azure/azure-sdk-for-go/sdk/azidentity" | ||
| "github.com/Azure/go-autorest/autorest" | ||
| "github.com/Azure/go-autorest/autorest/azure" | ||
| "github.com/jongio/azidext/go/azidext" | ||
| ) | ||
|
|
||
| func getAuthorizerForResource(config Config) (autorest.Authorizer, error) { | ||
| var cloudConfig cloud.Configuration | ||
| switch config.Environment { | ||
| case azure.ChinaCloud: | ||
| cloudConfig = cloud.AzureChina | ||
| // GermanCloud was closed on Oct 29, 2021 | ||
|
Contributor
There was a problem hiding this comment. Do we have any CI jobs that still expect the GermanCloud region/zone to be present?
Contributor
Author
There was a problem hiding this comment. I didn't find anything in openshift/release.
Contributor
Author
There was a problem hiding this comment. But I can un-comment it if you think it's safer. |
||
| // https://learn.microsoft.com/en-us/azure/active-directory/develop/authentication-national-cloud | ||
| // case azure.GermanCloud: | ||
| // return nil, nil | ||
| case azure.USGovernmentCloud: | ||
| cloudConfig = cloud.AzureGovernment | ||
| case azure.PublicCloud: | ||
| cloudConfig = cloud.AzurePublic | ||
| default: // AzureStackCloud | ||
| cloudConfig = cloud.Configuration{ | ||
| ActiveDirectoryAuthorityHost: config.Environment.ActiveDirectoryEndpoint, | ||
| Services: map[cloud.ServiceName]cloud.ServiceConfiguration{ | ||
| cloud.ResourceManager: { | ||
| Audience: config.Environment.TokenAudience, | ||
| Endpoint: config.Environment.ResourceManagerEndpoint, | ||
| }, | ||
| }, | ||
| } | ||
| } | ||
| options := azidentity.ClientSecretCredentialOptions{ | ||
| ClientOptions: azcore.ClientOptions{ | ||
| Cloud: cloudConfig, | ||
| }, | ||
| } | ||
| cred, err := azidentity.NewClientSecretCredential(config.TenantID, config.ClientID, config.ClientSecret, &options) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| scope := endpointToScope(config.Environment.TokenAudience) | ||
|
|
||
| // Use an adapter so azidentity in the Azure SDK can be used as | ||
| // Authorizer when calling the Azure Management Packages, which we | ||
| // currently use. Once the Azure SDK clients (found in /sdk) move to | ||
| // stable, we can update our clients and they will be able to use the | ||
| // creds directly without the authorizer. The schedule is here: | ||
| // https://azure.github.io/azure-sdk/releases/latest/index.html#go | ||
| authorizer := azidext.NewTokenCredentialAdapter(cred, []string{scope}) | ||
|
|
||
| return authorizer, nil | ||
| } | ||
|
|
||
| func endpointToScope(endpoint string) string { | ||
| scope := endpoint | ||
| if !strings.HasSuffix(scope, "/.default") { | ||
| scope += "/.default" | ||
| } | ||
| return scope | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| package client | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/assert" | ||
| ) | ||
|
|
||
| func TestEndpointToScope(t *testing.T) { | ||
| cases := []struct { | ||
| name string | ||
| endpoint string | ||
| expected string | ||
| }{ | ||
| { | ||
| name: "Default scope is suffixed", | ||
| endpoint: "https://graph.microsoft.com", | ||
| expected: "https://graph.microsoft.com/.default", | ||
| }, | ||
| { | ||
| name: "No-OP for a valid scope", | ||
| endpoint: "https://graph.microsoft.com/.default", | ||
| expected: "https://graph.microsoft.com/.default", | ||
| }, | ||
| { | ||
| name: "Existing slash is preserved", | ||
| endpoint: "https://graph.microsoft.com/", | ||
| expected: "https://graph.microsoft.com//.default", | ||
| }, | ||
| } | ||
|
|
||
| for _, tc := range cases { | ||
| t.Run(tc.name, func(t *testing.T) { | ||
| scope := endpointToScope(tc.endpoint) | ||
| assert.Equal(t, scope, tc.expected) | ||
| }) | ||
| } | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is there a reason this logic flow differs from https://github.com/r4f4/installer/blob/897b6226e87ec5c9e25c0c952b7f6a301204fe67/pkg/asset/installconfig/azure/session.go#L73-L89? The default here is AzureStackCloud, but the default in openshift/installer is AzurePublic.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
No particular reason other than I was changing the Installer code a lot during my testing of AzureStack and figuring out how to get it to work. I can change this to make it like the Installer's if you prefer.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I have no preference, just wanted to make sure there it isn't supposed to be exactly the same. As long as it works as expected.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hmm, sorry. I've done quite a few of these so I'm getting them mixed up. In this case there was a simple reason for the swap of Public <-> Stack: autorest doesn't define
azure.StackCloud[1]. In the installer, we have our own definition for the cloud environments [2]. So to get around that, I've left StackCloud as the last branch.[1] https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L34-L41
[2] https://github.com/openshift/installer/blob/master/pkg/types/azure/platform.go#L95-L110
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Okay seems reasonable, thanks.