Skip to content
This repository has been archived by the owner on Nov 16, 2023. It is now read-only.

Removing ACR credentials from variables #45

Merged
merged 9 commits into from
Sep 4, 2020
Merged

Conversation

allantargino
Copy link
Contributor

PR #33 introduced Azure Key Vault and Service Connections as a way to remove secrets from group variables in AzDO. This heavily increases security - but the setup also becomes more complicated, given the additional infrastructure requirements that Key Vault introduces. The service connection already all the information we needed to store the service principal credentials, while we were mainly using Key Vault to store ACR credentials.

Main changes:

  • This PR removes the dependency of keeping ACR credentials by leveraging data.azurerm_container_registry provider to get credentials at runtime - allowing us to remove Key Vault.
  • It has a new step to setup Terraform credentials, extracting all necessary values from the service connection.

Breaking/variables changes:

  • Renaming TF_VAR_JMETER_IMAGE_REGISTRY_NAME to TF_VAR_JMETER_ACR_NAME
  • Renaming TF_VAR_SERVICE_CONNECTION_NAME to AZURE_SERVICE_CONNECTION_NAME
  • Introducing AZURE_SUBSCRIPTION_ID
  • Introducing TF_VAR_JMETER_ACR_RESOURCE_GROUP_NAME
  • Removing TF_VAR_JMETER_IMAGE_REGISTRY_USERNAME
  • Removing TF_VAR_JMETER_IMAGE_REGISTRY_PASSWORD

TF_VAR_* variables are directly used by the terraform template, while AZURE_* are used only by the pipelines.

Other changes:

@allantargino
Copy link
Contributor Author

cc/ @hepsi204
Please let me know if you have comments or suggestions 👍

@fedeoliv
Copy link
Contributor

fedeoliv commented Sep 4, 2020

@allantargino this approach is great! Getting the credentials at runtime reduces a lot the complexity of managing and configuring Key Vault. LGTM 👍

fedeoliv
fedeoliv previously approved these changes Sep 4, 2020
@hepsi204
Copy link
Contributor

hepsi204 commented Sep 4, 2020

I have to say, this approach is really great and much cleaner than maintaining a key vault. Nice work. 🙂

@allantargino
Copy link
Contributor Author

Thanks @fernandoBRS!
Also thanks @hepsi204, this is just building on top of your great work :)

@allantargino allantargino merged commit 27ccfde into main Sep 4, 2020
@allantargino allantargino deleted the allantargino/acr-data branch January 6, 2021 15:34
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Upgrade azurerm provider version to 2.26.0
3 participants