Skip to content

Commit 8282d80

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #4978 from jackfrancis/rm-identity-secret-from-sp
remove service principal references from CI
2 parents e6159f8 + f88326a commit 8282d80

25 files changed

+29
-256
lines changed

‎Makefile

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -307,9 +307,6 @@ create-management-cluster: $(KUSTOMIZE) $(ENVSUBST) $(KUBECTL) $(KIND) ## Create
307307
# Install cert manager and wait for availability
308308
./hack/install-cert-manager.sh
309309

310-
# Create secret for AzureClusterIdentity
311-
./hack/create-identity-secret.sh
312-
313310
# Create customized cloud provider configs
314311
./hack/create-custom-cloud-provider-config.sh
315312

@@ -335,7 +332,7 @@ create-management-cluster: $(KUSTOMIZE) $(ENVSUBST) $(KUBECTL) $(KIND) ## Create
335332
timeout --foreground 300 bash -c "until $(KUBECTL) get clusterresourcesets -A; do sleep 3; done"
336333

337334
# install Windows Calico cluster resource set
338-
timeout --foreground 300 bash -c "until $(KUBECTL) create configmap calico-windows-addon --from-file="$(ADDONS_DIR)/windows/calico" --dry-run=client -o yaml | kubectl apply -f -; do sleep 5; done"
335+
timeout --foreground 300 bash -c "until $(KUBECTL) create configmap calico-windows-addon -n default --from-file="$(ADDONS_DIR)/windows/calico" --dry-run=client -o yaml | kubectl apply -f -; do sleep 5; done"
339336
timeout --foreground 300 bash -c "until $(KUBECTL) apply -f templates/addons/windows/calico-resource-set.yaml; do sleep 5; done"
340337

341338
# Wait for CAPZ deployments
@@ -363,10 +360,10 @@ create-workload-cluster: $(ENVSUBST) $(KUBECTL) ## Create a workload cluster.
363360
fi
364361

365362
# Wait for the kubeconfig to become available.
366-
timeout --foreground 1800 bash -c "while ! $(KUBECTL) get secrets | grep $(CLUSTER_NAME)-kubeconfig; do sleep 1; done"
363+
timeout --foreground 1800 bash -c "while ! $(KUBECTL) get secrets -n default | grep $(CLUSTER_NAME)-kubeconfig; do sleep 1; done"
367364
# Get kubeconfig and store it locally.
368-
$(KUBECTL) get secrets $(CLUSTER_NAME)-kubeconfig -o json | jq -r .data.value | base64 --decode > ./kubeconfig
369-
$(KUBECTL) wait --for=condition=Ready --timeout=10m cluster "$(CLUSTER_NAME)"
365+
$(KUBECTL) get secret/$(CLUSTER_NAME)-kubeconfig -n default -o json | jq -r .data.value | base64 --decode > ./kubeconfig
366+
$(KUBECTL) -n default wait --for=condition=Ready --timeout=10m cluster "$(CLUSTER_NAME)"
370367

371368
@echo 'run "$(KUBECTL) --kubeconfig=./kubeconfig ..." to work with the new target cluster'
372369

‎hack/create-custom-cloud-provider-config.sh

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,10 @@ if [[ -n "${CUSTOM_CLOUD_PROVIDER_CONFIG:-}" ]]; then
3232
fi
3333

3434
curl --retry 3 -sL -o tmp_azure_json "${CLOUD_PROVIDER_CONFIG}"
35-
envsubst < tmp_azure_json > azure_json
36-
"${KUBECTL}" delete secret "${CLUSTER_NAME}-control-plane-azure-json" || true
37-
"${KUBECTL}" create secret generic "${CLUSTER_NAME}-control-plane-azure-json" \
35+
"${ENVSUBST}" < tmp_azure_json > azure_json
36+
"${KUBECTL}" delete secret "${CLUSTER_NAME}-control-plane-azure-json" -n default || true
37+
"${KUBECTL}" create secret generic "${CLUSTER_NAME}-control-plane-azure-json" -n default \
3838
--from-file=control-plane-azure.json=azure_json \
3939
--from-file=worker-node-azure.json=azure_json
4040
rm tmp_azure_json azure_json
41+
set +x

‎hack/create-dev-cluster.sh

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -41,14 +41,12 @@ export AZURE_RESOURCE_GROUP=${CLUSTER_NAME}
4141
AZURE_SUBSCRIPTION_ID="${AZURE_SUBSCRIPTION_ID:=}"
4242
AZURE_TENANT_ID="${AZURE_TENANT_ID:=}"
4343
AZURE_CLIENT_ID="${AZURE_CLIENT_ID:=}"
44-
AZURE_CLIENT_SECRET="${AZURE_CLIENT_SECRET:=}"
4544

4645
AZURE_SUBSCRIPTION_ID_B64="$(echo -n "$AZURE_SUBSCRIPTION_ID" | base64 | tr -d '\n')"
4746
AZURE_TENANT_ID_B64="$(echo -n "$AZURE_TENANT_ID" | base64 | tr -d '\n')"
4847
AZURE_CLIENT_ID_B64="$(echo -n "$AZURE_CLIENT_ID" | base64 | tr -d '\n')"
49-
AZURE_CLIENT_SECRET_B64="$(echo -n "$AZURE_CLIENT_SECRET" | base64 | tr -d '\n')"
5048

51-
export AZURE_SUBSCRIPTION_ID_B64 AZURE_TENANT_ID_B64 AZURE_CLIENT_ID_B64 AZURE_CLIENT_SECRET_B64
49+
export AZURE_SUBSCRIPTION_ID_B64 AZURE_TENANT_ID_B64 AZURE_CLIENT_ID_B64
5250

5351
# Machine settings.
5452
export CONTROL_PLANE_MACHINE_COUNT=${CONTROL_PLANE_MACHINE_COUNT:-3}
@@ -59,9 +57,7 @@ export KUBERNETES_VERSION="${KUBERNETES_VERSION:-v1.29.5}"
5957
export CLUSTER_TEMPLATE="${CLUSTER_TEMPLATE:-cluster-template.yaml}"
6058

6159
# identity secret settings.
62-
export AZURE_CLUSTER_IDENTITY_SECRET_NAME="cluster-identity-secret"
6360
export CLUSTER_IDENTITY_NAME=${CLUSTER_IDENTITY_NAME:="cluster-identity"}
64-
export AZURE_CLUSTER_IDENTITY_SECRET_NAMESPACE="default"
6561
export ASO_CREDENTIAL_SECRET_NAME=${ASO_CREDENTIAL_SECRET_NAME:="aso-credentials"}
6662

6763
# Generate SSH key.

‎hack/create-identity-secret.sh

Lines changed: 0 additions & 35 deletions
This file was deleted.

‎hack/ensure-azcli.sh

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ if [[ -z "$(command -v az)" ]]; then
3535
# Use --auth-mode "login" in az storage commands to use RBAC permissions of login identity. This is a well known ENV variable the Azure cli
3636
export AZURE_STORAGE_AUTH_MODE="login"
3737
else
38-
az login --service-principal -u "${AZURE_CLIENT_ID}" -p "${AZURE_CLIENT_SECRET}" --tenant "${AZURE_TENANT_ID}" > /dev/null
38+
echo "AZURE_FEDERATED_TOKEN_FILE environment variable must be set to path location of token file"
39+
exit 1
3940
fi
4041
fi

‎hack/parse-prow-creds.sh

Lines changed: 0 additions & 36 deletions
This file was deleted.

‎scripts/ci-build-azure-ccm.sh

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,6 @@ cd "${REPO_ROOT}" || exit 1
2525

2626
# shellcheck source=hack/ensure-go.sh
2727
source "${REPO_ROOT}/hack/ensure-go.sh"
28-
# shellcheck source=hack/parse-prow-creds.sh
29-
source "${REPO_ROOT}/hack/parse-prow-creds.sh"
3028

3129
: "${AZURE_STORAGE_ACCOUNT:?Environment variable empty or not defined.}"
3230
: "${REGISTRY:?Environment variable empty or not defined.}"

‎scripts/ci-build-kubernetes.sh

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,6 @@ cd "${REPO_ROOT}" || exit 1
2727
source "${REPO_ROOT}/hack/ensure-azcli.sh"
2828
# shellcheck source=hack/ensure-go.sh
2929
source "${REPO_ROOT}/hack/ensure-go.sh"
30-
# shellcheck source=hack/parse-prow-creds.sh
31-
source "${REPO_ROOT}/hack/parse-prow-creds.sh"
3230
# shellcheck source=hack/util.sh
3331
source "${REPO_ROOT}/hack/util.sh"
3432

‎scripts/ci-conformance.sh

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
###############################################################################
1818

1919
# This script is executed by presubmit `pull-cluster-api-provider-azure-e2e`
20-
# To run locally, set AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID, AZURE_TENANT_ID
20+
# To run locally, set AZURE_CLIENT_ID, AZURE_SUBSCRIPTION_ID, AZURE_TENANT_ID
2121

2222
set -o errexit
2323
set -o nounset
@@ -34,16 +34,14 @@ make --directory="${REPO_ROOT}" "${KUBECTL##*/}" "${KIND##*/}" "${KUSTOMIZE##*/}
3434
source "${REPO_ROOT}/hack/ensure-go.sh"
3535
# shellcheck source=hack/ensure-tags.sh
3636
source "${REPO_ROOT}/hack/ensure-tags.sh"
37-
# shellcheck source=hack/parse-prow-creds.sh
38-
source "${REPO_ROOT}/hack/parse-prow-creds.sh"
3937
# shellcheck source=hack/util.sh
4038
source "${REPO_ROOT}/hack/util.sh"
4139

4240
# Verify the required Environment Variables are present.
4341
capz::util::ensure_azure_envs
4442

4543
export LOCAL_ONLY=${LOCAL_ONLY:-"true"}
46-
export USE_LOCAL_KIND_REGISTRY=${USE_LOCAL_KIND_REGISTRY:-${LOCAL_ONLY}}
44+
export USE_LOCAL_KIND_REGISTRY=${USE_LOCAL_KIND_REGISTRY:-${LOCAL_ONLY}}
4745

4846
if [[ "${USE_LOCAL_KIND_REGISTRY}" == "true" ]]; then
4947
export REGISTRY="localhost:5000/ci-e2e"

‎scripts/ci-e2e.sh

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
###############################################################################
1818

1919
# This script is executed by presubmit `pull-cluster-api-provider-azure-e2e`
20-
# To run locally, set AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID, AZURE_TENANT_ID
20+
# To run locally, set AZURE_CLIENT_ID, AZURE_SUBSCRIPTION_ID, AZURE_TENANT_ID
2121

2222
set -o errexit
2323
set -o nounset
@@ -33,16 +33,14 @@ make --directory="${REPO_ROOT}" "${KUBECTL##*/}" "${KIND##*/}"
3333
source "${REPO_ROOT}/hack/ensure-go.sh"
3434
# shellcheck source=hack/ensure-tags.sh
3535
source "${REPO_ROOT}/hack/ensure-tags.sh"
36-
# shellcheck source=hack/parse-prow-creds.sh
37-
source "${REPO_ROOT}/hack/parse-prow-creds.sh"
3836
# shellcheck source=hack/util.sh
3937
source "${REPO_ROOT}/hack/util.sh"
4038

4139
# Verify the required Environment Variables are present.
4240
capz::util::ensure_azure_envs
4341

4442
export LOCAL_ONLY=${LOCAL_ONLY:-"true"}
45-
export USE_LOCAL_KIND_REGISTRY=${USE_LOCAL_KIND_REGISTRY:-${LOCAL_ONLY}}
43+
export USE_LOCAL_KIND_REGISTRY=${USE_LOCAL_KIND_REGISTRY:-${LOCAL_ONLY}}
4644
export BUILD_MANAGER_IMAGE=${BUILD_MANAGER_IMAGE:-"true"}
4745

4846
if [[ "${USE_LOCAL_KIND_REGISTRY}" == "false" ]]; then

0 commit comments

Comments
 (0)