Merge pull request #3698 from adriananeci/aso_secrets

Add support for Azure authentication in ASO

azure/scope/identity.go

@@ -42,7 +42,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
-const azureSecretKey = "clientSecret"
+// AzureSecretKey is the value for they client secret key.
+const AzureSecretKey = "clientSecret"
 
 // CredentialsProvider defines the behavior for azure identity based credential providers.
 type CredentialsProvider interface {
@@ -220,7 +221,7 @@ func (p *AzureCredentialsProvider) GetClientSecret(ctx context.Context) (string,
 		if err := p.Client.Get(ctx, key, secret); err != nil {
 			return "", errors.Wrap(err, "Unable to fetch ClientSecret")
 		}
-		return string(secret.Data[azureSecretKey]), nil
+		return string(secret.Data[AzureSecretKey]), nil
 	}
 	return "", nil
 }

azure/services/aso/aso.go

@@ -29,6 +29,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	infrav1 "sigs.k8s.io/cluster-api-provider-azure/api/v1beta1"
 	"sigs.k8s.io/cluster-api-provider-azure/azure"
+	"sigs.k8s.io/cluster-api-provider-azure/util/aso"
 	"sigs.k8s.io/cluster-api-provider-azure/util/tele"
 	"sigs.k8s.io/cluster-api/util/patch"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -49,6 +50,9 @@ const (
 
 	createOrUpdateFutureType = "ASOCreateOrUpdate"
 	deleteFutureType         = "ASODelete"
+
+	// SecretNameAnnotation is the annotation key for ASO's credentials to use.
+	SecretNameAnnotation = "serviceoperator.azure.com/credential-from"
 )
 
 // Service is an implementation of the Reconciler interface. It handles creation
@@ -188,6 +192,10 @@ func (s *Service) CreateOrUpdateResource(ctx context.Context, spec azure.ASOReso
 		annotations[ReconcilePolicyAnnotation] = ReconcilePolicyManage
 	}
 
+	// Set the secret name annotation in order to leverage the ASO resource credential scope as defined in
+	// https://azure.github.io/azure-service-operator/guide/authentication/credential-scope/#resource-scope.
+	annotations[SecretNameAnnotation] = aso.GetASOSecretName(s.clusterName)
+
 	if len(labels) == 0 {
 		labels = nil
 	}

azure/services/aso/aso_test.go

@@ -149,6 +149,7 @@ func TestCreateOrUpdateResource(t *testing.T) {
 		}))
 		g.Expect(created.Annotations).To(Equal(map[string]string{
 			ReconcilePolicyAnnotation: ReconcilePolicySkip,
+			SecretNameAnnotation:      "cluster-aso-secret",
 		}))
 		g.Expect(created.Spec).To(Equal(asoresourcesv1.ResourceGroup_Spec{
 			Location: ptr.To("location"),
@@ -425,6 +426,7 @@ func TestCreateOrUpdateResource(t *testing.T) {
 		g.Expect(c.Get(ctx, types.NamespacedName{Name: "name", Namespace: "namespace"}, updated)).To(Succeed())
 		g.Expect(updated.Annotations).To(Equal(map[string]string{
 			ReconcilePolicyAnnotation: ReconcilePolicyManage,
+			SecretNameAnnotation:      "cluster-aso-secret",
 		}))
 	})
 
@@ -482,6 +484,7 @@ func TestCreateOrUpdateResource(t *testing.T) {
 		g.Expect(c.Get(ctx, types.NamespacedName{Name: "name", Namespace: "namespace"}, updated)).To(Succeed())
 		g.Expect(updated.Annotations).To(Equal(map[string]string{
 			ReconcilePolicyAnnotation: ReconcilePolicyManage,
+			SecretNameAnnotation:      "cluster-aso-secret",
 		}))
 	})
 
@@ -603,6 +606,7 @@ func TestCreateOrUpdateResource(t *testing.T) {
 				},
 				Annotations: map[string]string{
 					ReconcilePolicyAnnotation: ReconcilePolicyManage,
+					SecretNameAnnotation:      "cluster-aso-secret",
 				},
 			},
 			Spec: asoresourcesv1.ResourceGroup_Spec{