|
1 | | -# ⚠️ |
2 | | -# ⚠️ The grant admin for pagopa.it consent step must be performed manually in the Azure Portal after applying this configuration. |
3 | | -# ⚠️ In App > API permissions > Microsoft Graph > User.Read > Grant admin consent for pagopa.it |
4 | | -# ⚠️ |
5 | | - |
6 | | -# ----------------------------------------------------------------------------- |
7 | | -# Application Registration & Service Principal |
8 | | -# ----------------------------------------------------------------------------- |
9 | | - |
10 | | -resource "azuread_application" "argocd" { |
11 | | - display_name = "${var.prefix}-${var.env}-argocd" |
12 | | - owners = data.azuread_users.argocd_application_owners.object_ids |
13 | | - |
14 | | - web { |
15 | | - redirect_uris = ["https://${local.argocd_hostname}/auth/callback"] |
16 | | - logout_url = "https://${local.argocd_hostname}/logout" |
17 | | - } |
18 | | - |
19 | | - # This configures the "Mobile and desktop applications" platform in Entra ID. |
20 | | - public_client { |
21 | | - redirect_uris = ["http://localhost:8085/auth/callback"] |
22 | | - } |
23 | | - |
24 | | - group_membership_claims = [ |
25 | | - "ApplicationGroup" |
26 | | - ] |
27 | | - |
28 | | - # MODIFICATION: Explicitly define ALL required delegated permissions for the OIDC flow. |
29 | | - required_resource_access { |
30 | | - resource_app_id = data.azuread_service_principal.graph.client_id |
31 | | - |
32 | | - # Permission: User.Read |
33 | | - resource_access { |
34 | | - # Allows the app to sign in users and read their basic profile. |
35 | | - id = "e1fe6dd8-ba31-4d61-89e7-88639da4683d" # User.Read |
36 | | - type = "Scope" |
37 | | - } |
38 | | - } |
39 | | - |
40 | | - optional_claims { |
41 | | - id_token { |
42 | | - name = "groups" |
43 | | - essential = true |
44 | | - source = null |
45 | | - } |
46 | | - } |
47 | | -} |
48 | | - |
49 | | -resource "azuread_service_principal" "sp_argocd" { |
50 | | - client_id = azuread_application.argocd.client_id |
51 | | - owners = data.azuread_users.argocd_application_owners.object_ids |
52 | | -} |
53 | | - |
54 | | -# ----------------------------------------------------------------------------- |
55 | | -# Permissions and Consent |
56 | | -# ----------------------------------------------------------------------------- |
57 | | - |
58 | | -# The claim_values list must now match all the permissions defined above. |
59 | | -resource "azuread_service_principal_delegated_permission_grant" "argocd_user_read_consent" { |
60 | | - # The Object ID of the Service Principal receiving the grant. |
61 | | - service_principal_object_id = azuread_service_principal.sp_argocd.object_id |
62 | | - |
63 | | - # The Object ID of the API being granted access to (Microsoft Graph). |
64 | | - resource_service_principal_object_id = data.azuread_service_principal.graph.object_id |
65 | | - |
66 | | - # The list of permissions (scopes) to grant. Must match what was requested. |
67 | | - claim_values = ["User.Read"] |
68 | | - |
69 | | - # The Object ID of the user/principal granting the consent. |
70 | | - user_object_id = data.azurerm_client_config.current.object_id |
71 | | -} |
72 | | - |
73 | | -# Assigns the specified Entra ID groups to the ArgoCD Enterprise Application. |
74 | | -# This is required because 'group_membership_claims' is set to 'ApplicationGroup'. |
75 | | -resource "azuread_app_role_assignment" "argocd_group_assignments" { |
76 | | - for_each = data.azuread_group.argocd_groups |
77 | | - |
78 | | - app_role_id = "00000000-0000-0000-0000-000000000000" |
79 | | - principal_object_id = each.value.object_id |
80 | | - resource_object_id = azuread_service_principal.sp_argocd.object_id |
81 | | -} |
82 | | - |
83 | | -# ----------------------------------------------------------------------------- |
84 | | -# Workload Identity Federation |
85 | | -# ----------------------------------------------------------------------------- |
86 | | - |
87 | | -resource "azuread_application_federated_identity_credential" "argocd" { |
88 | | - application_id = azuread_application.argocd.id |
89 | | - display_name = "${local.project}-argocd-server-federated-credential" |
90 | | - description = "Federated credential for the ArgoCD server service account" |
91 | | - audiences = ["api://AzureADTokenExchange"] |
92 | | - issuer = data.azurerm_kubernetes_cluster.aks.oidc_issuer_url |
93 | | - subject = "system:serviceaccount:${local.argocd_namespace}:${local.argocd_service_account_name}" |
94 | | -} |
95 | | - |
96 | | -# ----------------------------------------------------------------------------- |
97 | | -# Key Vault Secrets |
98 | | -# ----------------------------------------------------------------------------- |
99 | | - |
100 | | -resource "azurerm_key_vault_secret" "argocd_entra_app_client_id" { |
101 | | - key_vault_id = data.azurerm_key_vault.kv_core_ita.id |
102 | | - name = "argocd-entra-app-workload-client-id" |
103 | | - value = azuread_application.argocd.client_id |
104 | | -} |
105 | | - |
106 | | -resource "azurerm_key_vault_secret" "argocd_entra_app_service_account_name" { |
107 | | - key_vault_id = data.azurerm_key_vault.kv_core_ita.id |
108 | | - name = "argocd-entra-app-workload-service-account-name" |
109 | | - value = local.argocd_service_account_name |
| 1 | +// ⚠️ Manual step required after apply: |
| 2 | +// App > API permissions > Microsoft Graph > User.Read > Grant admin consent |
| 3 | + |
| 4 | +module "argocd_entra" { |
| 5 | + source = "git::https://github.com/pagopa/terraform-azurerm-v4.git//kubernetes_argocd_entra?ref=PAYMCLOUD-231-argocd-creazione-modulo" |
| 6 | + |
| 7 | + name_identifier = local.project |
| 8 | + argocd_hostname = local.argocd_hostname |
| 9 | + entra_app_owners_object_ids = data.azuread_users.argocd_application_owners.object_ids |
| 10 | + entra_group_display_names = var.argocd_entra_groups_allowed |
| 11 | + aks_name = local.kubernetes_cluster_name |
| 12 | + aks_resource_group_name = local.kubernetes_cluster_resource_group_name |
| 13 | + argocd_namespace = local.argocd_namespace |
| 14 | + argocd_service_account_name = local.argocd_service_account_name |
| 15 | + key_vault_id = data.azurerm_key_vault.kv_core_ita.id |
| 16 | + |
| 17 | + tags = module.tag_config.tags |
110 | 18 | } |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?v=4&size=40){kind=avatar}
0 commit comments