You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
|`AZURE_RESOURCE_GROUP`| DNS zone resource group |
77
-
|`AZURE_SUBSCRIPTION_ID`| DNS zone subscription ID |
78
73
|`AZURE_TENANT_ID`| Tenant ID |
79
74
80
75
The environment variable names can be suffixed by `_FILE` to reference a file instead of a value.
@@ -91,6 +86,9 @@ More information [here]({{< ref "dns#configuration-and-credentials" >}}).
91
86
|`AZURE_POLLING_INTERVAL`| Time between DNS propagation check |
92
87
|`AZURE_PRIVATE_ZONE`| Set to true to use Azure Private DNS Zones and not public |
93
88
|`AZURE_PROPAGATION_TIMEOUT`| Maximum waiting time for DNS propagation |
89
+
|`AZURE_RESOURCE_GROUP`| DNS zone resource group |
90
+
|`AZURE_SERVICEDISCOVERY_FILTER`| Advanced ServiceDiscovery filter using Kusto query condition |
91
+
|`AZURE_SUBSCRIPTION_ID`| DNS zone subscription ID |
94
92
|`AZURE_TTL`| The TTL of the TXT record used for the DNS challenge |
95
93
|`AZURE_ZONE_NAME`| Zone name to use inside Azure DNS service to add the TXT record in |
96
94
@@ -115,14 +113,30 @@ Link:
115
113
116
114
### Environment variables
117
115
116
+
#### Service Discovery
117
+
118
+
Lego automatically finds all visible Azure (private) DNS zones using [Azure ResourceGraph query](https://learn.microsoft.com/en-us/azure/governance/resource-graph/).
119
+
This can be limited by specifying environment variable `AZURE_SUBSCRIPTION_ID` and/or `AZURE_RESOURCE_GROUP` which limits the
120
+
DNS zones to only a subscription or to one resourceGroup.
121
+
122
+
Additionally environment variable `AZURE_SERVICEDISCOVERY_FILTER` can be used to filter DNS zones with an addition Kusto filter eg:
123
+
124
+
```
125
+
resources
126
+
| where type =~ "microsoft.network/dnszones"
127
+
| ${AZURE_SERVICEDISCOVERY_FILTER}
128
+
| project subscriptionId, resourceGroup, name
129
+
```
130
+
131
+
118
132
#### Client secret
119
133
120
134
The Azure Credentials can be configured using the following environment variables:
121
135
* AZURE_CLIENT_ID = "Client ID"
122
136
* AZURE_CLIENT_SECRET = "Client secret"
123
137
* AZURE_TENANT_ID = "Tenant ID"
124
138
125
-
This authentication method can be specificaly used by setting the `AZURE_AUTH_METHOD` environment variable to `env`.
139
+
This authentication method can be specifically used by setting the `AZURE_AUTH_METHOD` environment variable to `env`.
126
140
127
141
#### Client certificate
128
142
@@ -131,7 +145,7 @@ The Azure Credentials can be configured using the following environment variable
This authentication method can be specificaly used by setting the `AZURE_AUTH_METHOD` environment variable to `env`.
148
+
This authentication method can be specifically used by setting the `AZURE_AUTH_METHOD` environment variable to `env`.
135
149
136
150
### Workload identity
137
151
@@ -142,12 +156,12 @@ This must be configured in kubernetes workload deployment in one hand and on the
142
156
Here is a summary of the steps to follow to use it :
143
157
* create a `ServiceAccount` resource, add following annotations to reference the targeted Azure AD application registration : `azure.workload.identity/client-id` and `azure.workload.identity/tenant-id`.
144
158
* on the `Deployment` resource you must reference the previous `ServiceAccount` and add the following label : `azure.workload.identity/use: "true"`.
145
-
* create a fedreated credentials of type `Kubernetes accessing Azure resources`, add the cluster issuer URL and add the namespace and name of your kubernetes service account.
159
+
* create a federated credentials of type `Kubernetes accessing Azure resources`, add the cluster issuer URL and add the namespace and name of your kubernetes service account.
146
160
147
161
Link :
148
162
-[Azure AD Workload identity](https://azure.github.io/azure-workload-identity/docs/topics/service-account-labels-and-annotations.html)
149
163
150
-
This authentication method can be specificaly used by setting the `AZURE_AUTH_METHOD` environment variable to `wli`.
164
+
This authentication method can be specifically used by setting the `AZURE_AUTH_METHOD` environment variable to `wli`.
151
165
152
166
### Azure Managed Identity
153
167
@@ -182,9 +196,9 @@ az role assignment create \
182
196
```
183
197
184
198
A timeout wrapper is configured for this authentication method.
185
-
The duraction can be configured by setting the `AZURE_AUTH_MSI_TIMEOUT`.
199
+
The duration can be configured by setting the `AZURE_AUTH_MSI_TIMEOUT`.
186
200
The default timeout is 2 seconds.
187
-
This authentication method can be specificaly used by setting the `AZURE_AUTH_METHOD` environment variable to `msi`.
201
+
This authentication method can be specifically used by setting the `AZURE_AUTH_METHOD` environment variable to `msi`.
188
202
189
203
#### Azure Managed Identity (with Azure Arc)
190
204
@@ -198,17 +212,17 @@ you may need to set the environment variables:
0 commit comments