Framework Documentation

Use your personal account to create the service principal.

1. Login with your personal account.

   # run az login and follow the instructions
   az login
   

2. Select the subscription to use.

   # List your subscriptions
   az account list --query "[].{name:name,subscription_id:id}" --output table
   # Select your subscription by ID
   read -p "Subscription ID: " SUBSCRIPTION_ID
   

3. Create a service principal and configure role and permissions.

   # Create service principal and assign the contributor role
   AZ_SP_JSON=$(az ad sp create-for-rbac \
      --name="kubestack-automation" \
      --role="Contributor" \
      --scopes="/subscriptions/${SUBSCRIPTION_ID}" \
      --output="json")
   # Also add and grant active directory permissions
   az ad app permission add \
     --id $(echo $AZ_SP_JSON | jq -r .appId) \
     --api 00000002-0000-0000-c000-000000000000 \
     --api-permissions 1cda74f2-2616-4834-b122-5cb1b07f8a59=Role
   az ad app permission grant \
     --id $(echo $AZ_SP_JSON | jq -r .appId) \
     --api 00000002-0000-0000-c000-000000000000 \
     --expires never
   az ad app permission admin-consent \
     --id $(echo $AZ_SP_JSON | jq -r .appId)
   

4. Authenticate as the service principal.

   # For the CLI
   az login --service-principal \
            --username $(echo $AZ_SP_JSON | jq -r .appId) \
            --password $(echo $AZ_SP_JSON | jq -r .password) \
            --tenant $(echo $AZ_SP_JSON | jq -r .tenant)
   

   # For Terraform
   export ARM_CLIENT_ID=$(echo $AZ_SP_JSON | jq -r .appId)
   export ARM_CLIENT_SECRET=$(echo $AZ_SP_JSON | jq -r .password)
   export ARM_SUBSCRIPTION_ID="${SUBSCRIPTION_ID}"
   export ARM_TENANT_ID=$(echo $AZ_SP_JSON | jq -r .tenant)
   

5. Get the storage account access key

   # Select the resource group
   az group list --query "[].{name:name}" --output table
   read -p "Resource group: " RESOURCE_GROUP
   

   # Select the storage account name
   az storage account list --query "[].{name:name}" --output table
   read -p "Storage account name: " STORAGE_ACCOUNT
   

   export ARM_ACCESS_KEY=$(az storage account keys list --account-name ${STORAGE_ACCOUNT} --resource-group ${RESOURCE_GROUP} | jq -r '.[0].value')
   

6. Safe the ARM_* environment variables for CI/CD

   env | grep ARM_ > ~/.azure/KBST_AUTH_AZ
   

Use your personal account to create the service account.

1. Login with your personal account.

   # run gcloud init and follow the instructions
   gcloud init
   

2. Create the service account, assign a role and create keys.

   # Use the current project
   PROJECT=$(gcloud config get-value project)
   # Create the service account
   gcloud iam service-accounts create kubestack-automation \
     --description "SA used for Kubestack Github Actions" \
     --display-name "kubestack-automation"
   # Assign the owner role to the service account
   gcloud projects add-iam-policy-binding ${PROJECT} \
     --member serviceAccount:kubestack-automation@${PROJECT}.iam.gserviceaccount.com \
     --role roles/owner
   # Create service account keys
   gcloud iam service-accounts keys create \
     ~/.config/gcloud/application_default_credentials.json \
     --iam-account kubestack-automation@${PROJECT}.iam.gserviceaccount.com
   

3. Activate the service account and stop using your personal account.

   gcloud auth activate-service-account --key-file ~/.config/gcloud/application_default_credentials.json
   

Run the following commands to create a storage container in Azure blob storage and change the state.tf file to configure Terraform to use the created storage container for remote state.

# Create storage container and configure remote state
STORAGE_CONTAINER=terraform-state-kubestack-`git rev-parse --short HEAD`
az storage container create --name $STORAGE_CONTAINER --account-name $STORAGE_ACCOUNT
cat > state.tf <<EOF
terraform {
  backend "azurerm" {
    storage_account_name = "${STORAGE_ACCOUNT}"
    container_name       = "${STORAGE_CONTAINER}"
    key                  = "tfstate"
  }
}
EOF

Run the following commands to create a bucket in Google cloud storage and change the state.tf file to configure Terraform to use the created bucket for remote state.

# Set the location of your multi-regional bucket
# valid values are `asia`, `eu` or `us`
read -p "Bucket location: " LOCATION

# Create bucket and configure remote state
BUCKET_NAME=terraform-state-kubestack-`git rev-parse --short HEAD`
gsutil mb -l $LOCATION gs://$BUCKET_NAME
gsutil versioning set on gs://$BUCKET_NAME
cat > state.tf <<EOF
terraform {
  backend "gcs" {
    bucket = "${BUCKET_NAME}"
  }
}
EOF

1. Get ops zone name

   # get ops zone name and name_servers
   terraform workspace select ops
   terraform state show module.aks_zero.module.cluster.azurerm_dns_zone.current[0]
   

2. Get apps zone name

   # get zone name and name_servers
   terraform workspace select apps
   terraform state show module.aks_zero.module.cluster.azurerm_dns_zone.current[0]
   

3. Set NS records

   Set NS in the base_domain for both the ops and apps DNS zone. How to set these NS record depends on your DNS provider. Compare the example below to understand the desired outcome.

1. Get ops zone name

   # get ops zone dns_name and name_servers
   terraform workspace select ops
   terraform state show module.gke_zero.module.cluster.google_dns_managed_zone.current[0]
   

2. Get apps zone name

   # get apps zone dns_name and name_servers
   terraform workspace select apps
   terraform state show module.gke_zero.module.cluster.google_dns_managed_zone.current[0]
   

3. Set NS records

   Set NS in the base_domain for both the ops and apps DNS zone. How to set these NS record depends on your DNS provider. Compare the example below to understand the desired outcome.