azure init concourse (#5)

* azure init concourse

* changes to docker file

---------

Co-authored-by: ani <anirudhsriram1995@gmail.com>

Author: Tang8330

Dockerfile

@@ -17,7 +17,11 @@ ARG HELM_PLUGINS_TO_INSTALL="https://github.com/databus23/helm-diff"
 ENV PATH $PATH:/usr/local/gcloud/google-cloud-sdk/bin
 
 #install packages
-RUN apk add --update --upgrade --no-cache jq bash curl git gettext libintl py-pip aws-cli
+RUN apk add --update --upgrade --no-cache jq bash curl git gettext libintl py-pip aws-cli && \
+    apk add --no-cache --virtual .build-deps gcc musl-dev python3-dev libffi-dev openssl-dev cargo make && \
+    pip install --break-system-packages --upgrade pip && \
+    pip install --break-system-packages azure-cli && \
+    apk del .build-deps
 
 #install kubectl
 RUN curl -sL -o /usr/local/bin/kubectl https://storage.googleapis.com/kubernetes-release/release/v${KUBERNETES_VERSION}/bin/linux/amd64/kubectl; \

README.md

@@ -93,6 +93,17 @@ resource_types:
 -   `aws.user.role_arn` _Optional._ If this is provided, we will use the user credentials to assume into the role
 -   `aws.user.external_id` _Optional._ External ID to use when assuming the role (for enhanced security)
 
+## Source options for Azure AKS
+
+-   `azure.subscription_id` _Optional._ Azure subscription ID where the AKS cluster is located
+-   `azure.resource_group` _Optional._ Resource group containing the AKS cluster
+-   `azure.cluster_name` _Optional._ Name of the AKS cluster
+-   `azure.service_principal.tenant_id` _Optional._ Azure AD tenant ID for service principal authentication
+-   `azure.service_principal.client_id` _Optional._ Service principal client ID (application ID)
+-   `azure.service_principal.client_secret` _Optional._ Service principal client secret
+
+**Note:** If `azure.service_principal` is not provided, the resource will attempt to use managed identity authentication (useful when Concourse workers are running in Azure).
+
 ## Behavior
 
 ### `check`: Check the release, not happy with dynamic releases.
@@ -237,6 +248,35 @@ resources:
         external_id: my-external-id  # Optional: required if role requires external_id
 ```
 
+Azure AKS using service principal
+```yaml
+resources:
+- name: myapp-helm
+  type: helm
+  source:
+    azure:
+      subscription_id: <azure_subscription_id>
+      resource_group: <resource_group_name>
+      cluster_name: <aks_cluster_name>
+      service_principal:
+        tenant_id: <azure_ad_tenant_id>
+        client_id: <service_principal_client_id>
+        client_secret: <service_principal_client_secret>
+```
+
+Azure AKS using managed identity
+```yaml
+resources:
+- name: myapp-helm
+  type: helm
+  source:
+    azure:
+      subscription_id: <azure_subscription_id>
+      resource_group: <resource_group_name>
+      cluster_name: <aks_cluster_name>
+    # No service_principal block - will use managed identity of the Concourse worker
+```
+
 Add to job:
 
 ```yaml

VERSION

@@ -1 +1 @@
-1.39.3
+1.39.4

assets/common.sh

@@ -187,6 +187,70 @@ setup_aws_kubernetes() {
   echo "done setting up kubeconfig for EKS"
 }
 
+setup_azure_kubernetes() {
+#  Need to pass in:
+#  source.azure.subscription_id
+#  source.azure.resource_group
+#  source.azure.cluster_name
+#  source.azure.service_principal (optional)
+  payload=$1
+  source=$2
+
+  subscription_id=$(jq -r '.source.azure.subscription_id // ""' < $payload)
+  resource_group=$(jq -r '.source.azure.resource_group // ""' < $payload)
+  cluster_name=$(jq -r '.source.azure.cluster_name // ""' < $payload)
+
+  if [ -z "$subscription_id" ] || [ -z "$resource_group" ] || [ -z "$cluster_name" ]; then
+    echo "invalid payload for Azure AKS, please pass all required params (subscription_id, resource_group, cluster_name)"
+    exit 1
+  fi
+
+  use_service_principal_auth=$(jq -r '.source.azure|has("service_principal")' < $payload)
+
+  if [ "${use_service_principal_auth}" = true ]; then
+    echo "proceed with service principal to set up kubeconfig."
+    
+    tenant_id=$(jq -r '.source.azure.service_principal.tenant_id // ""' < $payload)
+    client_id=$(jq -r '.source.azure.service_principal.client_id // ""' < $payload)
+    client_secret=$(jq -r '.source.azure.service_principal.client_secret // ""' < $payload)
+
+    if [ -z "$tenant_id" ] || [ -z "$client_id" ] || [ -z "$client_secret" ]; then
+      echo "invalid service principal auth payload for Azure AKS, please pass all required params (tenant_id, client_id, client_secret)"
+      exit 1
+    fi
+
+    echo "tenant_id=${tenant_id} client_id=${client_id}"
+    
+    # Login using service principal
+    az login --service-principal \
+      --username "${client_id}" \
+      --password "${client_secret}" \
+      --tenant "${tenant_id}" \
+      --output none
+
+    # Set the subscription
+    az account set --subscription "${subscription_id}"
+
+  else
+    # defaults to use managed identity
+    echo "no service principal specified. Fallback to use managed identity of the instance to set up kubeconfig"
+    
+    # Login using managed identity (for Concourse workers running in Azure)
+    az login --identity --output none
+    
+    # Set the subscription
+    az account set --subscription "${subscription_id}"
+  fi
+
+  # Get AKS credentials and configure kubectl
+  az aks get-credentials \
+    --resource-group "${resource_group}" \
+    --name "${cluster_name}" \
+    --overwrite-existing
+
+  echo "done setting up kubeconfig for AKS"
+}
+
 setup_gcp_kubernetes() {
   payload=$1
   source=$2
@@ -330,6 +394,7 @@ setup_resource() {
   do_access_token=$(jq -r '.source.digitalocean.access_token // "false"' < $1)
   gcloud_cluster_auth=$(jq -r '.source.gcloud_cluster_auth // "false"' < $1)
   aws_cluster_auth=$(jq -r '.source|has("aws")' < $1)
+  azure_cluster_auth=$(jq -r '.source|has("azure")' < $1)
 
   if [ "$do_cluster_id" != "false" ] && [ "$do_access_token" != "false" ]; then
     echo "Initializing digitalocean..."
@@ -340,6 +405,9 @@ setup_resource() {
   elif [ "$aws_cluster_auth" = "true" ]; then
       echo "Initializing kubectl access using AWS credentials"
       setup_aws_kubernetes $1 $2
+  elif [ "$azure_cluster_auth" = "true" ]; then
+      echo "Initializing kubectl access using Azure credentials"
+      setup_azure_kubernetes $1 $2
   else
     echo "Initializing kubectl using certificates"
     setup_kubernetes $1 $2