Adding support for AzureAD auth to AKS via RBAC

azurerm/data_source_kubernetes_cluster_test.go

@@ -26,6 +26,7 @@ func TestAccDataSourceAzureRMKubernetesCluster_basic(t *testing.T) {
 				Config: config,
 				Check: resource.ComposeTestCheckFunc(
 					testCheckAzureRMKubernetesClusterExists(dataSourceName),
+					resource.TestCheckResourceAttr(dataSourceName, "role_based_access_control.#", "0"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "kube_config.0.client_key"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "kube_config.0.client_certificate"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "kube_config.0.cluster_ca_certificate"),
@@ -38,6 +39,34 @@ func TestAccDataSourceAzureRMKubernetesCluster_basic(t *testing.T) {
 	})
 }
 
+func TestAccDataSourceAzureRMKubernetesCluster_roleBasedAccessControl(t *testing.T) {
+	dataSourceName := "data.azurerm_kubernetes_cluster.test"
+	ri := acctest.RandInt()
+	clientId := os.Getenv("ARM_CLIENT_ID")
+	clientSecret := os.Getenv("ARM_CLIENT_SECRET")
+	tenantId := os.Getenv("ARM_TENANT_ID")
+	location := testLocation()
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testCheckAzureRMKubernetesClusterDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataSourceAzureRMKubernetesCluster_roleBasedAccessControl(ri, location, clientId, clientSecret, tenantId),
+				Check: resource.ComposeTestCheckFunc(
+					testCheckAzureRMKubernetesClusterExists(dataSourceName),
+					resource.TestCheckResourceAttr(dataSourceName, "role_based_access_control.#", "1"),
+					resource.TestCheckResourceAttr(dataSourceName, "role_based_access_control.0.azure_active_directory.#", "1"),
+					resource.TestCheckResourceAttrSet(dataSourceName, "role_based_access_control.0.azure_active_directory.0.client_app_id"),
+					resource.TestCheckResourceAttrSet(dataSourceName, "role_based_access_control.0.azure_active_directory.0.server_app_id"),
+					resource.TestCheckResourceAttrSet(dataSourceName, "role_based_access_control.0.azure_active_directory.0.tenant_id"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccDataSourceAzureRMKubernetesCluster_internalNetwork(t *testing.T) {
 	dataSourceName := "data.azurerm_kubernetes_cluster.test"
 	ri := acctest.RandInt()
@@ -244,6 +273,18 @@ data "azurerm_kubernetes_cluster" "test" {
 `, r)
 }
 
+func testAccDataSourceAzureRMKubernetesCluster_roleBasedAccessControl(rInt int, location, clientId, clientSecret, tenantId string) string {
+	resource := testAccAzureRMKubernetesCluster_roleBasedAccessControl(rInt, location, clientId, clientSecret, tenantId)
+	return fmt.Sprintf(`
+%s
+
+data "azurerm_kubernetes_cluster" "test" {
+  name                = "${azurerm_kubernetes_cluster.test.name}"
+  resource_group_name = "${azurerm_kubernetes_cluster.test.resource_group_name}"
+}
+`, resource)
+}
+
 func testAccDataSourceAzureRMKubernetesCluster_internalNetwork(rInt int, clientId string, clientSecret string, location string) string {
 	r := testAccAzureRMKubernetesCluster_internalNetwork(rInt, clientId, clientSecret, location)
 	return fmt.Sprintf(`

azurerm/helpers/kubernetes/kube_config.go

@@ -27,6 +27,26 @@ type user struct {
 	ClientKeyData        string `yaml:"client-key-data"`
 }
 
+type userItemAAD struct {
+	Name string  `yaml:"name"`
+	User userAAD `yaml:"user"`
+}
+
+type userAAD struct {
+	AuthProvider authProvider `yaml:"auth-provider"`
+}
+
+type authProvider struct {
+	Name   string        `yaml:"name"`
+	Config configAzureAD `yaml:"config"`
+}
+
+type configAzureAD struct {
+	APIServerID string `yaml:"apiserver-id,omitempty"`
+	ClientID    string `yaml:"client-id,omitempty"`
+	TenantID    string `yaml:"tenant-id,omitempty"`
+}
+
 type contextItem struct {
 	Name    string  `yaml:"name"`
 	Context context `yaml:"context"`
@@ -38,16 +58,25 @@ type context struct {
 	Namespace string `yaml:"namespace,omitempty"`
 }
 
-type KubeConfig struct {
+type KubeConfigBase struct {
 	APIVersion     string                 `yaml:"apiVersion"`
 	Clusters       []clusterItem          `yaml:"clusters"`
-	Users          []userItem             `yaml:"users"`
 	Contexts       []contextItem          `yaml:"contexts,omitempty"`
 	CurrentContext string                 `yaml:"current-context,omitempty"`
 	Kind           string                 `yaml:"kind,omitempty"`
 	Preferences    map[string]interface{} `yaml:"preferences,omitempty"`
 }
 
+type KubeConfig struct {
+	KubeConfigBase `yaml:",inline"`
+	Users          []userItem `yaml:"users"`
+}
+
+type KubeConfigAAD struct {
+	KubeConfigBase `yaml:",inline"`
+	Users          []userItemAAD `yaml:"users"`
+}
+
 func ParseKubeConfig(config string) (*KubeConfig, error) {
 	if config == "" {
 		return nil, fmt.Errorf("Cannot parse empty config")
@@ -72,3 +101,25 @@ func ParseKubeConfig(config string) (*KubeConfig, error) {
 
 	return &kubeConfig, nil
 }
+
+func ParseKubeConfigAAD(config string) (*KubeConfigAAD, error) {
+	if config == "" {
+		return nil, fmt.Errorf("Cannot parse empty config")
+	}
+
+	var kubeConfig KubeConfigAAD
+	err := yaml.Unmarshal([]byte(config), &kubeConfig)
+	if err != nil {
+		return nil, fmt.Errorf("Failed to unmarshal YAML config with error %+v", err)
+	}
+	if len(kubeConfig.Clusters) <= 0 || len(kubeConfig.Users) <= 0 {
+		return nil, fmt.Errorf("Config %+v contains no valid clusters or users", kubeConfig)
+	}
+
+	cluster := kubeConfig.Clusters[0].Cluster
+	if cluster.Server == "" {
+		return nil, fmt.Errorf("Config has invalid or non existent server for cluster %+v", cluster)
+	}
+
+	return &kubeConfig, nil
+}

azurerm/helpers/kubernetes/kube_config_test.go

@@ -17,14 +17,17 @@ func TestParseKubeConfig(t *testing.T) {
 		{
 			"user_with_token.yml",
 			KubeConfig{
-				APIVersion: "v1",
-				Clusters: []clusterItem{
-					{
-						Name: "test-cluster",
-						Cluster: cluster{
-							Server: "https://testcluster.net:8080",
+				KubeConfigBase: KubeConfigBase{
+					APIVersion: "v1",
+					Clusters: []clusterItem{
+						{
+							Name: "test-cluster",
+							Cluster: cluster{
+								Server: "https://testcluster.net:8080",
+							},
 						},
 					},
+					Kind: "Config",
 				},
 				Users: []userItem{
 					{
@@ -34,22 +37,36 @@ func TestParseKubeConfig(t *testing.T) {
 						},
 					},
 				},
-				Kind: "Config",
 			},
 			isValidConfig,
 		},
 		{
 			"user_with_cert.yml",
 			KubeConfig{
-				APIVersion: "v1",
-				Clusters: []clusterItem{
-					{
-						Name: "test-cluster",
-						Cluster: cluster{
-							ClusterAuthorityData: "test-cluster-authority-data",
-							Server:               "https://testcluster.org:443",
+				KubeConfigBase: KubeConfigBase{
+					APIVersion: "v1",
+					Clusters: []clusterItem{
+						{
+							Name: "test-cluster",
+							Cluster: cluster{
+								ClusterAuthorityData: "test-cluster-authority-data",
+								Server:               "https://testcluster.org:443",
+							},
 						},
 					},
+					Contexts: []contextItem{
+						{
+							Name: "test-cluster",
+							Context: context{
+								Cluster:   "test-cluster",
+								User:      "test-user",
+								Namespace: "test-namespace",
+							},
+						},
+					},
+					CurrentContext: "test-cluster",
+					Kind:           "Config",
+					Preferences:    nil,
 				},
 				Users: []userItem{
 					{
@@ -60,34 +77,38 @@ func TestParseKubeConfig(t *testing.T) {
 						},
 					},
 				},
-				Contexts: []contextItem{
-					{
-						Name: "test-cluster",
-						Context: context{
-							Cluster:   "test-cluster",
-							User:      "test-user",
-							Namespace: "test-namespace",
-						},
-					},
-				},
-				CurrentContext: "test-cluster",
-				Kind:           "Config",
-				Preferences:    nil,
 			},
 			isValidConfig,
 		},
 		{
 			"user_with_cert_token.yml",
 			KubeConfig{
-				APIVersion: "v1",
-				Clusters: []clusterItem{
-					{
-						Name: "test-cluster",
-						Cluster: cluster{
-							ClusterAuthorityData: "test-cluster-authority-data",
-							Server:               "https://testcluster.org:443",
+				KubeConfigBase: KubeConfigBase{
+					APIVersion: "v1",
+					Clusters: []clusterItem{
+						{
+							Name: "test-cluster",
+							Cluster: cluster{
+								ClusterAuthorityData: "test-cluster-authority-data",
+								Server:               "https://testcluster.org:443",
+							},
 						},
 					},
+					Contexts: []contextItem{
+						{
+							Name: "test-cluster",
+							Context: context{
+								Cluster:   "test-cluster",
+								User:      "test-user",
+								Namespace: "test-namespace",
+							},
+						},
+					},
+					CurrentContext: "test-cluster",
+					Kind:           "Config",
+					Preferences: map[string]interface{}{
+						"colors": true,
+					},
 				},
 				Users: []userItem{
 					{
@@ -99,21 +120,6 @@ func TestParseKubeConfig(t *testing.T) {
 						},
 					},
 				},
-				Contexts: []contextItem{
-					{
-						Name: "test-cluster",
-						Context: context{
-							Cluster:   "test-cluster",
-							User:      "test-user",
-							Namespace: "test-namespace",
-						},
-					},
-				},
-				CurrentContext: "test-cluster",
-				Kind:           "Config",
-				Preferences: map[string]interface{}{
-					"colors": true,
-				},
 			},
 			isValidConfig,
 		},