Skip to content

Commit f4f42f1

Browse files
jlaundryldez
jlaundry
and
ldez
authored
azuredns: update docs (go-acme#1988)
Co-authored-by: Fernandez Ludovic <[email protected]>
1 parent 07c4dae commit f4f42f1

File tree

4 files changed

+134
-20
lines changed

4 files changed

+134
-20
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ Detailed documentation is available [here](https://go-acme.github.io/lego/dns).
5555
|---------------------------------------------------------------------------------|---------------------------------------------------------------------------------|---------------------------------------------------------------------------------|---------------------------------------------------------------------------------|
5656
| [Akamai EdgeDNS](https://go-acme.github.io/lego/dns/edgedns/) | [Alibaba Cloud DNS](https://go-acme.github.io/lego/dns/alidns/) | [all-inkl](https://go-acme.github.io/lego/dns/allinkl/) | [Amazon Lightsail](https://go-acme.github.io/lego/dns/lightsail/) |
5757
| [Amazon Route 53](https://go-acme.github.io/lego/dns/route53/) | [ArvanCloud](https://go-acme.github.io/lego/dns/arvancloud/) | [Aurora DNS](https://go-acme.github.io/lego/dns/auroradns/) | [Autodns](https://go-acme.github.io/lego/dns/autodns/) |
58-
| [Azure (deprecated)](https://go-acme.github.io/lego/dns/azure/) | [AzureDNS](https://go-acme.github.io/lego/dns/azuredns/) | [Bindman](https://go-acme.github.io/lego/dns/bindman/) | [Bluecat](https://go-acme.github.io/lego/dns/bluecat/) |
58+
| [Azure (deprecated)](https://go-acme.github.io/lego/dns/azure/) | [Azure DNS](https://go-acme.github.io/lego/dns/azuredns/) | [Bindman](https://go-acme.github.io/lego/dns/bindman/) | [Bluecat](https://go-acme.github.io/lego/dns/bluecat/) |
5959
| [Brandit](https://go-acme.github.io/lego/dns/brandit/) | [Bunny](https://go-acme.github.io/lego/dns/bunny/) | [Checkdomain](https://go-acme.github.io/lego/dns/checkdomain/) | [Civo](https://go-acme.github.io/lego/dns/civo/) |
6060
| [Cloud.ru](https://go-acme.github.io/lego/dns/cloudru/) | [CloudDNS](https://go-acme.github.io/lego/dns/clouddns/) | [Cloudflare](https://go-acme.github.io/lego/dns/cloudflare/) | [ClouDNS](https://go-acme.github.io/lego/dns/cloudns/) |
6161
| [CloudXNS](https://go-acme.github.io/lego/dns/cloudxns/) | [ConoHa](https://go-acme.github.io/lego/dns/conoha/) | [Constellix](https://go-acme.github.io/lego/dns/constellix/) | [Derak Cloud](https://go-acme.github.io/lego/dns/derak/) |

‎cmd/zz_gen_cmd_dnshelp.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -300,9 +300,9 @@ func displayDNSHelp(w io.Writer, name string) error {
300300

301301
case "azuredns":
302302
// generated from: providers/dns/azuredns/azuredns.toml
303-
ew.writeln(`Configuration for AzureDNS.`)
303+
ew.writeln(`Configuration for Azure DNS.`)
304304
ew.writeln(`Code: 'azuredns'`)
305-
ew.writeln(`Since: 'v0.1.0'`)
305+
ew.writeln(`Since: 'v4.13.0'`)
306306
ew.writeln()
307307

308308
ew.writeln(`Credentials:`)

‎docs/content/dns/zz_gen_azuredns.md‎

Lines changed: 67 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
---
2-
title: "AzureDNS"
2+
title: "Azure DNS"
33
date: 2019-03-03T16:39:46+01:00
44
draft: false
55
slug: azuredns
66
dnsprovider:
7-
since: "v0.1.0"
7+
since: "v4.13.0"
88
code: "azuredns"
99
url: "https://azure.microsoft.com/services/dns/"
1010
---
@@ -14,33 +14,53 @@ dnsprovider:
1414
<!-- THIS DOCUMENTATION IS AUTO-GENERATED. PLEASE DO NOT EDIT. -->
1515

1616

17-
Configuration for [AzureDNS](https://azure.microsoft.com/services/dns/).
17+
Configuration for [Azure DNS](https://azure.microsoft.com/services/dns/).
1818

1919

2020
<!--more-->
2121

2222
- Code: `azuredns`
23-
- Since: v0.1.0
23+
- Since: v4.13.0
2424

2525

26-
Here is an example bash command using the AzureDNS provider:
26+
Here is an example bash command using the Azure DNS provider:
2727

2828
```bash
2929
### Using client secret
30+
3031
AZURE_CLIENT_ID=<your service principal client ID> \
3132
AZURE_TENANT_ID=<your service principal tenant ID> \
3233
AZURE_CLIENT_SECRET=<your service principal client secret> \
3334
lego --domains example.com --email [email protected] --dns azuredns run
3435

3536
### Using client certificate
37+
3638
AZURE_CLIENT_ID=<your service principal client ID> \
3739
AZURE_TENANT_ID=<your service principal tenant ID> \
3840
AZURE_CLIENT_CERTIFICATE_PATH=<your service principal certificate path> \
3941
lego --domains example.com --email [email protected] --dns azuredns run
4042

4143
### Using Azure CLI
44+
4245
az login \
4346
lego --domains example.com --email [email protected] --dns azuredns run
47+
48+
### Using Managed Identity (Azure VM)
49+
50+
AZURE_TENANT_ID=<your service principal tenant ID> \
51+
AZURE_SUBSCRIPTION_ID=<your target zone subscription ID> \
52+
AZURE_RESOURCE_GROUP=<your target zone resource group name> \
53+
lego --domains example.com --email [email protected] --dns azuredns run
54+
55+
### Using Managed Identity (Azure Arc)
56+
57+
AZURE_TENANT_ID=<your service principal tenant ID> \
58+
AZURE_SUBSCRIPTION_ID=<your target zone subscription ID> \
59+
AZURE_RESOURCE_GROUP=<your target zone resource group name> \
60+
IMDS_ENDPOINT=http://localhost:40342 \
61+
IDENTITY_ENDPOINT=http://localhost:40342/metadata/identity/oauth2/token \
62+
lego --domains example.com --email [email protected] --dns azuredns run
63+
4464
```
4565

4666

@@ -90,16 +110,53 @@ Link:
90110

91111
#### Azure Managed Identity
92112

93-
Azure managed identity service allows linking Azure AD identities to Azure resources. \
94-
Workloads running inside compute typed resource can inherit from this configuration to get rights on Azure resources.
113+
The Azure Managed Identity service allows linking Azure AD identities to Azure resources, without needing to manually manage client IDs and secrets.
114+
115+
Workloads with a Managed Identity can manage their own certificates, with permissions on specific domain names set using IAM assignments.
116+
For this to work, the Managed Identity requires the **Reader** role on the target DNS Zone,
117+
and the **DNS Zone Contributor** on the relevant `_acme-challenge` TXT records.
118+
119+
For example, to allow a Managed Identity to create a certificate for "fw01.lab.example.com", using Azure CLI:
120+
121+
```bash
122+
export AZURE_SUBSCRIPTION_ID="00000000-0000-0000-0000-000000000000"
123+
export AZURE_RESOURCE_GROUP="rg1"
124+
export SERVICE_PRINCIPAL_ID="00000000-0000-0000-0000-000000000000"
125+
126+
export AZURE_DNS_ZONE="lab.example.com"
127+
export AZ_HOSTNAME="fw01"
128+
export AZ_RECORD_SET="_acme-challenge.${AZ_HOSTNAME}"
129+
130+
az role assignment create \
131+
--assignee "${SERVICE_PRINCIPAL_ID}" \
132+
--role "Reader" \
133+
--scope "/subscriptions/${AZURE_SUBSCRIPTION_ID}/resourceGroups/${AZURE_RESOURCE_GROUP}/providers/Microsoft.Network/dnszones/${AZURE_DNS_ZONE}"
134+
135+
az role assignment create \
136+
--assignee "${SERVICE_PRINCIPAL_ID}" \
137+
--role "DNS Zone Contributor" \
138+
--scope "/subscriptions/${AZURE_SUBSCRIPTION_ID}/resourceGroups/${AZURE_RESOURCE_GROUP}/providers/Microsoft.Network/dnszones/${AZURE_DNS_ZONE}/TXT/${AZ_RECORD_SET}"
139+
```
140+
141+
#### Azure Managed Identity (with Azure Arc)
142+
143+
The Azure Arc agent provides the ability to use a Managed Identity on resources hosted outside of Azure
144+
(such as on-prem virtual machines, or VMs in another cloud provider).
145+
146+
While the upstream `azidentity` SDK will try to automatically identify and use the Azure Arc metadata service,
147+
if you get `azuredns: DefaultAzureCredential: failed to acquire a token.` error messages,
148+
you may need to set the environment variables:
149+
* `IMDS_ENDPOINT=http://localhost:40342`
150+
* `IDENTITY_ENDPOINT=http://localhost:40342/metadata/identity/oauth2/token`
95151

96152
#### Workload identity for AKS
97153

98-
Workload identity allows workloads running Azure Kubernetes Services (AKS) clusters to authenticate as an Azure AD application identity using federated credentials. \
99-
This must be configured in kubernetes workload deployment in one hand and on the Azure AD application registration in the other hand. \
154+
Workload identity allows workloads running Azure Kubernetes Services (AKS) clusters to authenticate as an Azure AD application identity using federated credentials.
155+
156+
This must be configured in kubernetes workload deployment in one hand and on the Azure AD application registration in the other hand.
100157

101158
Here is a summary of the steps to follow to use it :
102-
* create a `ServiceAccount` resource, add following annotations to reference the targeted Azure AD application registration : `azure.workload.identity/client-id` and `azure.workload.identity/tenant-id`. \
159+
* create a `ServiceAccount` resource, add following annotations to reference the targeted Azure AD application registration : `azure.workload.identity/client-id` and `azure.workload.identity/tenant-id`.
103160
* on the `Deployment` resource you must reference the previous `ServiceAccount` and add the following label : `azure.workload.identity/use: "true"`.
104161
* create a fedreated credentials of type `Kubernetes accessing Azure resources`, add the cluster issuer URL and add the namespace and name of your kubernetes service account.
105162

‎providers/dns/azuredns/azuredns.toml‎

Lines changed: 64 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,45 @@
1-
Name = "AzureDNS"
1+
Name = "Azure DNS"
22
Description = ''''''
33
URL = "https://azure.microsoft.com/services/dns/"
44
Code = "azuredns"
5-
Since = "v0.1.0"
5+
Since = "v4.13.0"
66

77
Example = '''
88
### Using client secret
9+
910
AZURE_CLIENT_ID=<your service principal client ID> \
1011
AZURE_TENANT_ID=<your service principal tenant ID> \
1112
AZURE_CLIENT_SECRET=<your service principal client secret> \
1213
lego --domains example.com --email [email protected] --dns azuredns run
1314
1415
### Using client certificate
16+
1517
AZURE_CLIENT_ID=<your service principal client ID> \
1618
AZURE_TENANT_ID=<your service principal tenant ID> \
1719
AZURE_CLIENT_CERTIFICATE_PATH=<your service principal certificate path> \
1820
lego --domains example.com --email [email protected] --dns azuredns run
1921
2022
### Using Azure CLI
23+
2124
az login \
2225
lego --domains example.com --email [email protected] --dns azuredns run
26+
27+
### Using Managed Identity (Azure VM)
28+
29+
AZURE_TENANT_ID=<your service principal tenant ID> \
30+
AZURE_SUBSCRIPTION_ID=<your target zone subscription ID> \
31+
AZURE_RESOURCE_GROUP=<your target zone resource group name> \
32+
lego --domains example.com --email [email protected] --dns azuredns run
33+
34+
### Using Managed Identity (Azure Arc)
35+
36+
AZURE_TENANT_ID=<your service principal tenant ID> \
37+
AZURE_SUBSCRIPTION_ID=<your target zone subscription ID> \
38+
AZURE_RESOURCE_GROUP=<your target zone resource group name> \
39+
IMDS_ENDPOINT=http://localhost:40342 \
40+
IDENTITY_ENDPOINT=http://localhost:40342/metadata/identity/oauth2/token \
41+
lego --domains example.com --email [email protected] --dns azuredns run
42+
2343
'''
2444

2545
Additional = '''
@@ -39,16 +59,53 @@ Link:
3959
4060
#### Azure Managed Identity
4161
42-
Azure managed identity service allows linking Azure AD identities to Azure resources. \
43-
Workloads running inside compute typed resource can inherit from this configuration to get rights on Azure resources.
62+
The Azure Managed Identity service allows linking Azure AD identities to Azure resources, without needing to manually manage client IDs and secrets.
63+
64+
Workloads with a Managed Identity can manage their own certificates, with permissions on specific domain names set using IAM assignments.
65+
For this to work, the Managed Identity requires the **Reader** role on the target DNS Zone,
66+
and the **DNS Zone Contributor** on the relevant `_acme-challenge` TXT records.
67+
68+
For example, to allow a Managed Identity to create a certificate for "fw01.lab.example.com", using Azure CLI:
69+
70+
```bash
71+
export AZURE_SUBSCRIPTION_ID="00000000-0000-0000-0000-000000000000"
72+
export AZURE_RESOURCE_GROUP="rg1"
73+
export SERVICE_PRINCIPAL_ID="00000000-0000-0000-0000-000000000000"
74+
75+
export AZURE_DNS_ZONE="lab.example.com"
76+
export AZ_HOSTNAME="fw01"
77+
export AZ_RECORD_SET="_acme-challenge.${AZ_HOSTNAME}"
78+
79+
az role assignment create \
80+
--assignee "${SERVICE_PRINCIPAL_ID}" \
81+
--role "Reader" \
82+
--scope "/subscriptions/${AZURE_SUBSCRIPTION_ID}/resourceGroups/${AZURE_RESOURCE_GROUP}/providers/Microsoft.Network/dnszones/${AZURE_DNS_ZONE}"
83+
84+
az role assignment create \
85+
--assignee "${SERVICE_PRINCIPAL_ID}" \
86+
--role "DNS Zone Contributor" \
87+
--scope "/subscriptions/${AZURE_SUBSCRIPTION_ID}/resourceGroups/${AZURE_RESOURCE_GROUP}/providers/Microsoft.Network/dnszones/${AZURE_DNS_ZONE}/TXT/${AZ_RECORD_SET}"
88+
```
89+
90+
#### Azure Managed Identity (with Azure Arc)
91+
92+
The Azure Arc agent provides the ability to use a Managed Identity on resources hosted outside of Azure
93+
(such as on-prem virtual machines, or VMs in another cloud provider).
94+
95+
While the upstream `azidentity` SDK will try to automatically identify and use the Azure Arc metadata service,
96+
if you get `azuredns: DefaultAzureCredential: failed to acquire a token.` error messages,
97+
you may need to set the environment variables:
98+
* `IMDS_ENDPOINT=http://localhost:40342`
99+
* `IDENTITY_ENDPOINT=http://localhost:40342/metadata/identity/oauth2/token`
44100
45101
#### Workload identity for AKS
46102
47-
Workload identity allows workloads running Azure Kubernetes Services (AKS) clusters to authenticate as an Azure AD application identity using federated credentials. \
48-
This must be configured in kubernetes workload deployment in one hand and on the Azure AD application registration in the other hand. \
103+
Workload identity allows workloads running Azure Kubernetes Services (AKS) clusters to authenticate as an Azure AD application identity using federated credentials.
104+
105+
This must be configured in kubernetes workload deployment in one hand and on the Azure AD application registration in the other hand.
49106
50107
Here is a summary of the steps to follow to use it :
51-
* create a `ServiceAccount` resource, add following annotations to reference the targeted Azure AD application registration : `azure.workload.identity/client-id` and `azure.workload.identity/tenant-id`. \
108+
* create a `ServiceAccount` resource, add following annotations to reference the targeted Azure AD application registration : `azure.workload.identity/client-id` and `azure.workload.identity/tenant-id`.
52109
* on the `Deployment` resource you must reference the previous `ServiceAccount` and add the following label : `azure.workload.identity/use: "true"`.
53110
* create a fedreated credentials of type `Kubernetes accessing Azure resources`, add the cluster issuer URL and add the namespace and name of your kubernetes service account.
54111

0 commit comments

Comments
 (0)