[RFC-0007] Enable Azure OIDC for Azure DevOps Repository #747
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dipti-pai
commented
Sep 11, 2024
15 tasks
57 tasks
a9bdad2 to
db09c6b
Compare
66fefa7 to
704c7e2
Compare
darkowlzz
reviewed
Sep 16, 2024
There was a problem hiding this comment.
Overall, the implementation looks good to me.
Left a few suggestions for the docs.
I tested this in an AKS cluster, similar to the manual testing of source-controller against Azure DevOps and got similar results (the results below are not in order):
Without setting the provider on the associated GitRepo, IUA fails with the following status:
status:
conditions:
- lastTransitionTime: "2024-09-16T13:20:54Z"
message: reconciliation in progress
observedGeneration: 1
reason: ProgressingWithRetry
status: "True"
type: Reconciling
- lastTransitionTime: "2024-09-16T13:20:54Z"
message: 'failed to checkout source: unable to list remote for ''https://dev.azure.com/test-org/fluxProjinowombat/_git/fluxRepoinowombat'':
authentication required'
observedGeneration: 1
reason: GitOperationFailed
status: "False"
type: Ready
lastAutomationRunTime: "2024-09-16T13:20:59Z"
lastPushCommit: 8667f22eb70c7d888b2b4f75008fe77f758dab64
lastPushTime: "2024-09-16T13:20:53Z"
observedGeneration: 1
observedPolicies:
podinfo:
name: ghcr.io/stefanprodan/podinfo
tag: 4.0.6
observedSourceRevision: main@sha1:8667f22eb70c7d888b2b4f75008fe77f758dab64With provider set as azure but removed access of the identity from the repo results in the following failure:
status:
conditions:
- lastTransitionTime: "2024-09-16T13:23:32Z"
message: reconciliation in progress
observedGeneration: 1
reason: ProgressingWithRetry
status: "True"
type: Reconciling
- lastTransitionTime: "2024-09-16T13:23:32Z"
message: 'failed to checkout source: unable to clone: repository not found: git
repository: ''https://dev.azure.com/test-org/fluxProjinowombat/_git/fluxRepoinowombat'''
observedGeneration: 1
reason: GitOperationFailed
status: "False"
type: Ready
lastAutomationRunTime: "2024-09-16T13:23:35Z"
lastPushCommit: 8667f22eb70c7d888b2b4f75008fe77f758dab64
lastPushTime: "2024-09-16T13:20:53Z"
observedGeneration: 1
observedPolicies:
podinfo:
name: ghcr.io/stefanprodan/podinfo
tag: 4.0.6
observedSourceRevision: main@sha1:8667f22eb70c7d888b2b4f75008fe77f758dab64With proper permission, it succeeds:
status:
conditions:
- lastTransitionTime: "2024-09-16T13:18:14Z"
message: repository up-to-date
observedGeneration: 1
reason: Succeeded
status: "True"
type: Ready
lastAutomationRunTime: "2024-09-16T13:19:06Z"
lastPushCommit: a44ad49f985328762dd518496ba9670bd3143fd0
lastPushTime: "2024-09-16T13:19:11Z"
observedGeneration: 1
observedPolicies:
podinfo:
name: ghcr.io/stefanprodan/podinfo
tag: 5.1.4
observedSourceRevision: main@sha1:a44ad49f985328762dd518496ba9670bd3143fd0Everything looks as expected.
A screenshot of the commit list to show that it actually was able to push, regardless of what the status shows
8c9e25f to
41bf89f
Compare
darkowlzz
reviewed
Sep 17, 2024
41bf89f to
c292f74
Compare
makkes
reviewed
Sep 18, 2024
c292f74 to
3c906fb
Compare
0e7b624 to
738de6f
Compare
- Controller changes to set the provider options in git authOptions to fetch provider credentials while building git config if `.spec.provider` field is set to `azure`. - API docs for setting up Azure workload identity in IAC - Unit tests for testing provider settings in git config Signed-off-by: Dipti Pai <diptipai89@outlook.com>
Signed-off-by: Sunny <github@darkowlzz.space>
738de6f to
87bff0e
Compare
stefanprodan
approved these changes
Sep 26, 2024
7 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Controller changes to set the provider options in git authOptions to fetch provider credentials while building git config if
.spec.providerfield is set toazure.API docs for setting up Azure workload identity in IAC
Unit tests for testing provider settings in git config