Create a Service Principal for Azure clusters

terraform/azure/main.tf

@@ -1,10 +1,25 @@
 
 terraform {
+  required_providers {
+    azurerm = {
+      source = "hashicorp/azurerm"
+      version = "2.86.0"
+    }
+
+    azuread = {
+      source = "hashicorp/azuread"
+      version = "2.10.0"
+    }
+  }
   backend "gcs" {
     bucket = "two-eye-two-see-org-terraform-state"
     prefix = "terraform/state/pilot-hubs"
   }
 }
+
+provider "azuread" {
+  tenant_id = var.tenant_id
+}
 provider "azurerm" {
   subscription_id = var.subscription_id
   features {}
@@ -83,6 +98,15 @@ resource "azurerm_kubernetes_cluster" "jupyterhub" {
     network_plugin = "kubenet"
     network_policy = "calico"
   }
+
+  dynamic "service_principal" {
+    for_each = var.create_service_principal ? [1] : []
+
+    content {
+      client_id     = azuread_service_principal.service_principal[0].object_id
+      client_secret = azuread_service_principal_password.service_principal_password[0].value
+    }
+  }
 }
 
 

terraform/azure/projects/carbonplan.tfvars

@@ -1,5 +1,7 @@
+tenant_id          = "d6b0296c-4d43-4983-93b0-36248aa9c592"
 subscription_id    = "c5e7a734-3dbf-4285-80e5-4c0afb1f65dc"
 resourcegroup_name = "2i2c-carbonplan-cluster"
+create_service_principal = true
 
 ssh_pub_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCrtD6l/2S2dDT1OFLIUa46KAuzlUkckneQ4oyK5c2izT0nlBOxOcWACvnJ4rqntZVuhML7GYS35tQQnXyEXctTS2LnB7illl+oCT63WQzhhutfPLZSW3gJ+/CFVVp0VdHq4t1O8CQO+EgeV1cvuBre/neNZo5tcqXEsoV7tw/qw8XmD7Dk3yPz4NEFYZyZ4xQM7Qn2j9krZlRO2wCrosMFLo5Rv108PSDTHn3VtXEpJwemUO93D0ipJvCDE62M3vJxamqP4k5HLVn3Jun5KEvA7fINvgP3NSXkPVEEE4Prcqc1IJIzSxzygEN7xkZYsUEfJkybGXUWtUXdNjOEfLLlhYToMhdcP4jZluAjTtQmnJTr1sLegH+kbGIvI8MFIJAgXXLXS8/ubXHMozb+4gXRhyT8SMPwmgXGA+FtDduy5gnpPMSgmozQY17av5r25T6viWX5ivtL+n/CNJGf4npM1vKWcUNKiGyJrwzxQdpwJZ2uMP3EIdCYxOvqCQ+7UEM= [email protected]"
 

terraform/azure/service-principal.tf

@@ -0,0 +1,27 @@
+resource "azuread_service_principal" "service_principal" {
+  count = var.create_service_principal ? 1 : 0
+
+  application_id               = var.subscription_id
+  app_role_assignment_required = false
+  use_existing                 = true
+}
+
+resource "azuread_service_principal_password" "service_principal_password" {
+  count = var.create_service_principal ? 1 : 0
+
+  service_principal_id = azuread_service_principal.service_principal[0].object_id
+}
+
+locals{
+  service_principal = {
+    "tenant_id": var.tenant_id,
+    "subscription_id": var.subscription_id,
+    "service_principal_id": var.create_service_principal ? azuread_service_principal.service_principal[0].object_id : "",
+    "service_principal_password": var.create_service_principal ? azuread_service_principal_password.service_principal_password[0].value : ""
+  }
+}
+
+output "service_principal_config" {
+  value     = jsonencode(local.service_principal)
+  sensitive = true
+}

terraform/azure/variables.tf

@@ -9,6 +9,16 @@ variable "subscription_id" {
   EOT
 }
 
+variable "tenant_id" {
+  type        = string
+  description = <<-EOT
+  Tenant ID inside which our subscription is housed
+
+  `az account show -s SUBSCRIPTION_ID -o table` will show the ID of the tenant
+  after you have logged in with `az login`.
+  EOT
+}
+
 variable "resourcegroup_name" {
   type        = string
   description = <<-EOT
@@ -91,6 +101,17 @@ variable "notebook_nodes" {
 
 variable "dask_nodes" {
   type        = map(map(string))
-  description = "Dask node pools to create. Defaults to notebook_nodes"
+  description = "Dask node pools to create"
   default     = {}
 }
+
+variable "create_service_principal" {
+  type        = bool
+  default     = false
+  description = <<-EOT
+  When true, create a Service Principal to authenticate with.
+
+  This is a temporary fix to allow for the fact that we cannot create Service
+  Principals for UToronto.
+  EOT
+}