如何通过 terraform 访问 azure 上托管 aks 集群内的托管实体

Question

我已经通过 terraform 设置了一个 AKS 集群，并且在同一个资源组中，我创建了一个应用程序网关。 像这样

resource "azurerm_kubernetes_cluster" "cluster" {
  name                              = var.aks_name
  tags                              = var.tags
  location                          = var.vnet_location
  resource_group_name               = local.aks_resource_group
  dns_prefix                        = "k8s"
  oidc_issuer_enabled               = true
  role_based_access_control_enabled = true
  azure_policy_enabled              = true
  #workload_identity_enabled         = true

  default_node_pool {
    name            = var.node_pool_name
    node_count      = var.node_count
    vm_size         = var.node_type
    os_disk_size_gb = var.os_disk_size_gb
    vnet_subnet_id  = local.aks_subnet_id
  }

  identity {
    type = "SystemAssigned"
  }

  ingress_application_gateway {
    gateway_id = var.application_gateway_id
  }
...

在创建过程中，Azure 为托管集群创建了一个 MC_******* 资源组，我使用服务主体部署所有 Terraform 资源应用程序“ingress_application_gateway”的入口 controller 自动获取部署在 MC_* 内的托管实体*** 资源组。
我需要访问该托管实体，以便对相关资源设置一些所需的访问策略。

入口 controller 需要访问应用程序网关和原始资源组，因此；

#----------------------------------------------------------------
# Ingress controller running on AKS
#-----------------------------------------------------------------
data "azurerm_resource_group" "aks_resource_group" {
  name = local.aks_resource_group
}

#Gateway ingress controller should have reader access on resource group
resource "azurerm_role_assignment" "igc_reader_access" {
  scope                = data.azurerm_resource_group.aks_resource_group.id
  role_definition_name = "Reader"
  principal_id         = data.azurerm_user_assigned_identity.ingress_controller_identity.principal_id
}

#Gateway ingress controller should have contributor access on application gateway
resource "azurerm_role_assignment" "ag_contributor_access" {
  scope                = var.application_gateway_id
  role_definition_name = "Contributor"
  principal_id         = data.azurerm_user_assigned_identity.ingress_controller_identity.principal_id
}

data "azurerm_user_assigned_identity" "ingress_controller_identity" {
  name                = "ingressapplicationgateway-qa"
  resource_group_name = "MC_RG-Digital-Service-qa_westeurope"
}

对于这个问题，我如何设置我的服务主体（用于创建 azurerm_kube.netes_cluster 资源）以在 azure 为 aks 创建的 MC_****** 资源组上具有读者访问权限。

我不想让完整的订阅贡献者访问我的服务主体。

Answer 1

当您作为服务主体执行 Terraform 时，您可以像这样执行 smtg（如果应用程序网关位于同一个 Terraform 项目中，我们可以减少数据资源）：

# get current client ( your Service principal)
data "azurerm_client_config" "current" {
}

# get MC Resource Group
data "azurerm_resource_group" "aks_mc_rg" {
  depends_on = [azurerm_kubernetes_cluster.cluster]
  name = azurerm_kubernetes_cluster.aks.node_resource_group
}

# get Application Gateway
data "azurerm_application_gateway" "aks_igc" {
  name                = "existing-app-gateway"
  resource_group_name = "existing-resources"
}

# read Managed identity
data "azurerm_user_assigned_identity" "ingress_controller_identity" {
  name                = "ingressapplicationgateway-qa"
  resource_group_name = data.azurerm_resource_group.aks_mc_rg.id
}

# assign reader to current client 
resource "azurerm_role_assignment" "rg_aks_nodes_owners" {
  scope                = data.azurerm_resource_group.aks_mc_rg.id
  role_definition_name = "Reader"
  principal_id         = data.azurerm_client_config.current.object_id
}

#Gateway ingress controller should have reader access on resource group
resource "azurerm_role_assignment" "igc_reader_access" {
  scope                = data.azurerm_resource_group.aks_mc_rg.id
  role_definition_name = "Reader"
  principal_id         = data.azurerm_user_assigned_identity.ingress_controller_identity.principal_id
}

#Gateway ingress controller should have contributor access on application gateway
resource "azurerm_role_assignment" "ag_contributor_access" {
  scope                = data.azurerm_application_gateway.aks_igc.id
  role_definition_name = "Contributor"
  principal_id         = data.azurerm_user_assigned_identity.ingress_controller_identity.principal_id
}