Skip to content

Commit 402d899

Browse files
LJSpillerLJSpiller
authored
Merge pull request #197762 from juliakm/users/jukullam/oidc-arm
Adding Open ID authentication option to ARM GitHub Actions article
2 parents 9a5987f + e0ed2f1 commit 402d899

File tree

1 file changed

+94
-9
lines changed

1 file changed

+94
-9
lines changed

‎articles/azure-resource-manager/templates/deploy-github-actions.md

Lines changed: 94 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Deploy Resource Manager templates by using GitHub Actions
33
description: Describes how to deploy Azure Resource Manager templates (ARM templates) by using GitHub Actions.
44
ms.topic: conceptual
5-
ms.date: 02/07/2022
5+
ms.date: 05/10/2022
66
ms.custom: github-actions-azure
77
---
88

@@ -27,11 +27,13 @@ The file has two sections:
2727

2828
|Section |Tasks |
2929
|---------|---------|
30-
|**Authentication** | 1. Define a service principal. <br /> 2. Create a GitHub secret. |
30+
|**Authentication** | 1. Generate deployment credentials. |
3131
|**Deploy** | 1. Deploy the Resource Manager template. |
3232

3333
## Generate deployment credentials
3434

35+
# [Service principal](#tab/userlevel)
36+
3537
You can create a [service principal](../../active-directory/develop/app-objects-and-service-principals.md#service-principal-object) with the [az ad sp create-for-rbac](/cli/azure/ad/sp#az-ad-sp-create-for-rbac) command in the [Azure CLI](/cli/azure/). Run this command with [Azure Cloud Shell](https://shell.azure.com/) in the Azure portal or by selecting the **Try it** button.
3638

3739
Create a resource group if you do not already have one.
@@ -61,8 +63,29 @@ In the example above, replace the placeholders with your subscription ID and res
6163
> [!IMPORTANT]
6264
> It is always a good practice to grant minimum access. The scope in the previous example is limited to the resource group.
6365
66+
# [OpenID Connect](#tab/openid)
67+
68+
You need to provide your application's **Client ID**, **Tenant ID**, and **Subscription ID** to the login action. These values can either be provided directly in the workflow or can be stored in GitHub secrets and referenced in your workflow. Saving the values as GitHub secrets is the more secure option.
69+
70+
1. Open your GitHub repository and go to **Settings**.
71+
72+
1. Select **Settings > Secrets > New secret**.
73+
74+
1. Create secrets for `AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, and `AZURE_SUBSCRIPTION_ID`. Use these values from your Active Directory application for your GitHub secrets:
75+
76+
|GitHub Secret | Active Directory Application |
77+
|---------|---------|
78+
|AZURE_CLIENT_ID | Application (client) ID |
79+
|AZURE_TENANT_ID | Directory (tenant) ID |
80+
|AZURE_SUBSCRIPTION_ID | Subscription ID |
81+
82+
1. Save each secret by selecting **Add secret**.
83+
84+
---
6485
## Configure the GitHub secrets
6586

87+
# [Service principal](#tab/userlevel)
88+
6689
You need to create secrets for your Azure credentials, resource group, and subscriptions.
6790

6891
1. In [GitHub](https://github.com/), browse your repository.
@@ -75,6 +98,25 @@ You need to create secrets for your Azure credentials, resource group, and subsc
7598

7699
1. Create an additional secret named `AZURE_SUBSCRIPTION`. Add your subscription ID to the secret's value field (example: `90fd3f9d-4c61-432d-99ba-1273f236afa2`).
77100

101+
# [OpenID Connect](#tab/openid)
102+
103+
You need to provide your application's **Client ID**, **Tenant ID**, and **Subscription ID** to the login action. These values can either be provided directly in the workflow or can be stored in GitHub secrets and referenced in your workflow. Saving the values as GitHub secrets is the more secure option.
104+
105+
1. Open your GitHub repository and go to **Settings**.
106+
107+
1. Select **Settings > Secrets > New secret**.
108+
109+
1. Create secrets for `AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, and `AZURE_SUBSCRIPTION_ID`. Use these values from your Active Directory application for your GitHub secrets:
110+
111+
|GitHub Secret | Active Directory Application |
112+
|---------|---------|
113+
|AZURE_CLIENT_ID | Application (client) ID |
114+
|AZURE_TENANT_ID | Directory (tenant) ID |
115+
|AZURE_SUBSCRIPTION_ID | Subscription ID |
116+
117+
1. Save each secret by selecting **Add secret**.
118+
119+
---
78120
## Add Resource Manager template
79121

80122
Add a Resource Manager template to your GitHub repository. This template creates a storage account.
@@ -94,8 +136,9 @@ The workflow file must be stored in the **.github/workflows** folder at the root
94136
1. Select **set up a workflow yourself**.
95137
1. Rename the workflow file if you prefer a different name other than **main.yml**. For example: **deployStorageAccount.yml**.
96138
1. Replace the content of the yml file with the following:
139+
# [Service principal](#tab/userlevel)
97140

98-
```yml
141+
```yml
99142
on: [push]
100143
name: Azure ARM
101144
jobs:
@@ -122,15 +165,57 @@ The workflow file must be stored in the **.github/workflows** folder at the root
122165

123166
# output containerName variable from template
124167
- run: echo ${{ steps.deploy.outputs.containerName }}
125-
```
168+
```
169+
170+
> [!NOTE]
171+
> You can specify a JSON format parameters file instead in the ARM Deploy action (example: `.azuredeploy.parameters.json`).
172+
173+
The first section of the workflow file includes:
174+
175+
- **name**: The name of the workflow.
176+
- **on**: The name of the GitHub events that triggers the workflow. The workflow is trigger when there is a push event on the main branch, which modifies at least one of the two files specified. The two files are the workflow file and the template file.
177+
178+
# [OpenID Connect](#tab/openid)
179+
180+
```yml
181+
on: [push]
182+
name: Azure ARM
183+
jobs:
184+
build-and-deploy:
185+
runs-on: ubuntu-latest
186+
steps:
187+
188+
# Checkout code
189+
- uses: actions/checkout@main
190+
191+
# Log into Azure
192+
- uses: azure/login@v1
193+
with:
194+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
195+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
196+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
197+
198+
# Deploy ARM template
199+
- name: Run ARM deploy
200+
uses: azure/arm-deploy@v1
201+
with:
202+
subscriptionId: ${{ secrets.AZURE_SUBSCRIPTION }}
203+
resourceGroupName: ${{ secrets.AZURE_RG }}
204+
template: ./azuredeploy.json
205+
parameters: storageAccountType=Standard_LRS
206+
207+
# output containerName variable from template
208+
- run: echo ${{ steps.deploy.outputs.containerName }}
209+
```
126210

127-
> [!NOTE]
128-
> You can specify a JSON format parameters file instead in the ARM Deploy action (example: `.azuredeploy.parameters.json`).
211+
> [!NOTE]
212+
> You can specify a JSON format parameters file instead in the ARM Deploy action (example: `.azuredeploy.parameters.json`).
129213

130-
The first section of the workflow file includes:
214+
The first section of the workflow file includes:
131215

132-
- **name**: The name of the workflow.
133-
- **on**: The name of the GitHub events that triggers the workflow. The workflow is trigger when there is a push event on the main branch, which modifies at least one of the two files specified. The two files are the workflow file and the template file.
216+
- **name**: The name of the workflow.
217+
- **on**: The name of the GitHub events that triggers the workflow. The workflow is trigger when there is a push event on the main branch, which modifies at least one of the two files specified. The two files are the workflow file and the template file.
218+
---
134219

135220
1. Select **Start commit**.
136221
1. Select **Commit directly to the main branch**.

0 commit comments

Comments
 (0)