@@ -1463,9 +1463,9 @@ jobs:
14631463The Azure Event Hub provider supports the following authentication methods,
14641464- [Managed
14651465 Identity](https://learn.microsoft.com/en-us/azure/event-hubs/authenticate-managed-identity)
1466- - [JWT](https://docs.microsoft.com/en-us/azure/event-hubs/authenticate-application)
14671466- [SAS](https://docs.microsoft.com/en-us/azure/event-hubs/authorize-access-shared-access-signature)
14681467 based.
1468+ - [JWT](https://docs.microsoft.com/en-us/azure/event-hubs/authenticate-application) (Deprecated)
14691469
14701470# ### Managed Identity
14711471
@@ -1511,15 +1511,9 @@ for the client-id and tenant-id of the managed identity.
15111511For a complete guide on how to set up authentication for an Azure Event Hub,
15121512see the integration [docs](/flux/integrations/azure/).
15131513
1514- # ### JWT based auth
1515-
1516- In JWT we use 3 input values. Channel, token and address. We perform the
1517- following translation to match we the data we need to communicate with Azure
1518- Event Hub.
1514+ # ### SAS based auth
15191515
1520- - channel = Azure Event Hub namespace
1521- - address = Azure Event Hub name
1522- - token = JWT
1516+ When using SAS auth, we only use the `address` field in the secret.
15231517
15241518` ` ` yaml
15251519---
@@ -1530,47 +1524,44 @@ metadata:
15301524 namespace: default
15311525spec:
15321526 type: azureeventhub
1533- address: <event-hub-name>
1534- channel: <event-hub-namespace>
15351527 secretRef:
1536- name: azure-token
1528+ name: azure-webhook
15371529---
15381530apiVersion: v1
15391531kind: Secret
15401532metadata:
1541- name: azure-token
1533+ name: azure-webhook
15421534 namespace: default
15431535stringData:
1544- token : <event-hub-token >
1536+ address : <SAS-URL >
15451537` ` `
15461538
1547- The controller doesn't take any responsibility for the JWT token to be updated.
1548- You need to use a secondary tool to make sure that the token in the secret is
1549- renewed.
1550-
1551- If you want to make a easy test assuming that you have setup a Azure Enterprise
1552- application and you called it event-hub you can follow most of the bellow
1553- commands. You will need to provide the `client_secret` that you got when
1554- generating the Azure Enterprise Application.
1539+ Assuming that you have created the Azure event hub and namespace you should be
1540+ able to use a similar command to get your connection string. This will give you
1541+ the default Root SAS, which is NOT supposed to be used in production.
15551542
15561543` ` ` shell
1557- export AZURE_CLIENT=$(az ad app list --filter "startswith(displayName,'event-hub')" --query '[].appId' |jq -r '.[0]')
1558- export AZURE_SECRET='secret-client-secret-generated-at-creation'
1559- export AZURE_TENANT=$(az account show -o tsv --query tenantId)
1560-
1561- curl -X GET --data 'grant_type=client_credentials' --data "client_id=$AZURE_CLIENT" --data "client_secret=$AZURE_SECRET" --data 'resource=https://eventhubs.azure.net' -H 'Content-Type: application/x-www-form-urlencoded' https://login.microsoftonline.com/$AZURE_TENANT/oauth2/token |jq .access_token
1544+ az eventhubs namespace authorization-rule keys list --resource-group <rg-name> --namespace-name <namespace-name> --name RootManageSharedAccessKey -o tsv --query primaryConnectionString
1545+ # The output should look something like this:
1546+ Endpoint=sb://fluxv2.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=yoursaskeygeneatedbyazure;EntityPath=youreventhub
15621547` ` `
15631548
1564- Use the output you got from `curl` and add it to your secret like bellow
1549+ To create the needed secret
15651550
15661551` ` ` shell
1567- kubectl create secret generic azure-token \
1568- --from-literal=token='A-valid-JWT-token'
1552+ kubectl create secret generic azure-webhook \
1553+ --from-literal=address="Endpoint=sb://fluxv2.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=yoursaskeygeneatedbyazure"
15691554` ` `
15701555
1571- # ### SAS based auth
1556+ # ### JWT based auth (Deprecated)
15721557
1573- When using SAS auth, we only use the `address` field in the secret.
1558+ In JWT we use 3 input values. Channel, token and address. We perform the
1559+ following translation to match we the data we need to communicate with Azure
1560+ Event Hub.
1561+
1562+ - channel = Azure Event Hub namespace
1563+ - address = Azure Event Hub name
1564+ - token = JWT
15741565
15751566` ` ` yaml
15761567---
@@ -1581,33 +1572,42 @@ metadata:
15811572 namespace: default
15821573spec:
15831574 type: azureeventhub
1575+ address: <event-hub-name>
1576+ channel: <event-hub-namespace>
15841577 secretRef:
1585- name: azure-webhook
1578+ name: azure-token
15861579---
15871580apiVersion: v1
15881581kind: Secret
15891582metadata:
1590- name: azure-webhook
1583+ name: azure-token
15911584 namespace: default
15921585stringData:
1593- address : <SAS-URL >
1586+ token : <event-hub-token >
15941587` ` `
15951588
1596- Assuming that you have created the Azure event hub and namespace you should be
1597- able to use a similar command to get your connection string. This will give you
1598- the default Root SAS, which is NOT supposed to be used in production.
1589+ The controller doesn't take any responsibility for the JWT token to be updated.
1590+ You need to use a secondary tool to make sure that the token in the secret is
1591+ renewed.
1592+
1593+ If you want to make a easy test assuming that you have setup a Azure Enterprise
1594+ application and you called it event-hub you can follow most of the bellow
1595+ commands. You will need to provide the `client_secret` that you got when
1596+ generating the Azure Enterprise Application.
15991597
16001598` ` ` shell
1601- az eventhubs namespace authorization-rule keys list --resource-group <rg-name> --namespace-name <namespace-name> --name RootManageSharedAccessKey -o tsv --query primaryConnectionString
1602- # The output should look something like this:
1603- Endpoint=sb://fluxv2.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=yoursaskeygeneatedbyazure
1599+ export AZURE_CLIENT=$(az ad app list --filter "startswith(displayName,'event-hub')" --query '[].appId' |jq -r '.[0]')
1600+ export AZURE_SECRET='secret-client-secret-generated-at-creation'
1601+ export AZURE_TENANT=$(az account show -o tsv --query tenantId)
1602+
1603+ curl -X GET --data 'grant_type=client_credentials' --data "client_id=$AZURE_CLIENT" --data "client_secret=$AZURE_SECRET" --data 'resource=https://eventhubs.azure.net' -H 'Content-Type: application/x-www-form-urlencoded' https://login.microsoftonline.com/$AZURE_TENANT/oauth2/token |jq .access_token
16041604` ` `
16051605
1606- To create the needed secret
1606+ Use the output you got from `curl` and add it to your secret like bellow
16071607
16081608` ` ` shell
1609- kubectl create secret generic azure-webhook \
1610- --from-literal=address="Endpoint=sb://fluxv2.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=yoursaskeygeneatedbyazure"
1609+ kubectl create secret generic azure-token \
1610+ --from-literal=token='A-valid-JWT-token'
16111611` ` `
16121612
16131613# ## Git Commit Status Updates
@@ -1753,7 +1753,37 @@ the repository specified in `.spec.address`.
17531753
17541754# ### Azure DevOps
17551755
1756- When `.spec.type` is set to `azuredevops`, the referenced secret must contain a key called `token` with the value set to a
1756+ The following authentication methods can be used when `.spec.type` is set to
1757+ ` azuredevops` .
1758+
1759+ - [Managed Identity](https://learn.microsoft.com/en-us/azure/event-hubs/authenticate-managed-identity)
1760+ - [Personal Access Token](#pat)
1761+
1762+ # ### Managed Identity
1763+
1764+ Managed Identity authentication can be setup using Azure Workload identity.
1765+
1766+ # #### Pre-requisites
1767+
1768+ - Ensure Workload Identity is properly
1769+ [set up on your cluster](https://learn.microsoft.com/en-us/azure/aks/workload-identity-deploy-cluster#create-an-aks-cluster).
1770+
1771+ # #### Configure Workload Identity
1772+
1773+ - Create a Managed Identity and grant the necessary permissions to list/update
1774+ commit status.
1775+ - Establish a federated identity credential between the managed identity and the
1776+ service account to be used for authentication. Ensure the federated credential
1777+ uses the correct namespace and name of the service account. For more details,
1778+ please refer to this
1779+ [guide](https://azure.github.io/azure-workload-identity/docs/quick-start.html#6-establish-federated-identity-credential-between-the-identity-and-the-service-account-issuer--subject).
1780+ The service account used for authentication can be single-tenant
1781+ (controller-level) or multi-tenant(object-level). For a complete guide on how to
1782+ set up authentication, see the integration [docs](/flux/integrations/azure/).
1783+
1784+ # ### PAT
1785+
1786+ The `.spec.secretRef` must contain a key called `token` with the value set to a
17571787[Azure DevOps personal access token](https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&tabs=preview-page).
17581788
17591789The token must have permissions to update the commit status for the Azure DevOps repository specified in `.spec.address`.
0 commit comments