623368b8dd
The SystemAssigned managed identity requires a preview feature to be
enabled.
```
rgil@rem5:~/atst/terraform/providers/dev$ az feature list|grep MSIPreview
"id": "/subscriptions/95934d54-980d-47cc-9bce-3a96bf9a2d1b/providers/Microsoft.Features/providers/Microsoft.ContainerService/features/MSIPreview",
"name": "Microsoft.ContainerService/MSIPreview",
rgil@rem5:~/atst/terraform/providers/dev$ az feature register --namespace Microsoft.ContainerService --name MSIPreview
Once the feature 'MSIPreview' is registered, invoking 'az provider register -n Microsoft.ContainerService' is required to get the change propagated
{
"id": "/subscriptions/95934d54-980d-47cc-9bce-3a96bf9a2d1b/providers/Microsoft.Features/providers/Microsoft.ContainerService/features/MSIPreview",
"name": "Microsoft.ContainerService/MSIPreview",
"properties": {
"state": "Registering"
},
"type": "Microsoft.Features/providers/features"
}
rgil@rem5:~/atst/terraform/providers/dev$ az provider register -n Microsoft.ContainerService
rgil@rem5:~/atst/terraform/providers/dev$
```
This also now integrates the policy for keyvault with the k8s managed
identity (system assigned).
37 lines
856 B
HCL
37 lines
856 B
HCL
data "azurerm_client_config" "current" {}
|
|
|
|
resource "azurerm_resource_group" "keyvault" {
|
|
name = "${var.name}-${var.environment}-keyvault"
|
|
location = var.region
|
|
}
|
|
|
|
resource "azurerm_key_vault" "keyvault" {
|
|
name = "${var.name}-${var.environment}-keyvault"
|
|
location = azurerm_resource_group.keyvault.location
|
|
resource_group_name = azurerm_resource_group.keyvault.name
|
|
tenant_id = data.azurerm_client_config.current.tenant_id
|
|
|
|
sku_name = "premium"
|
|
|
|
tags = {
|
|
environment = var.environment
|
|
owner = var.owner
|
|
}
|
|
}
|
|
|
|
resource "azurerm_key_vault_access_policy" "keyvault" {
|
|
key_vault_id = azurerm_key_vault.keyvault.id
|
|
|
|
tenant_id = data.azurerm_client_config.current.tenant_id
|
|
object_id = var.principal_id
|
|
|
|
key_permissions = [
|
|
"get",
|
|
]
|
|
|
|
secret_permissions = [
|
|
"get",
|
|
]
|
|
}
|
|
|