-
Notifications
You must be signed in to change notification settings - Fork 35
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Migrate custom Key Vault resource to azidentity (#3664)
This PR ended up having three distinct but related parts to it. 1. Migrate the custom KV resource to the new `azidentity` backend. We need to preserve the previous one because it uses a special Autorest authorizer for Key Vault. 2. Use a Key Vault secret in the azure-in-azure integration test. KV secrets need a different authentication audience/scope in the access token and we want to cover this case. 3. A fix that affects master as well: the azure-in-azure test didn't use the correct environment variable for the new backend toggle. [Green run of the azcore workflow using the new backend](https://github.com/pulumi/pulumi-azure-native/actions/runs/11670925535) Fixes #2432
- Loading branch information
Showing
10 changed files
with
173 additions
and
43 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
65 changes: 65 additions & 0 deletions
65
provider/pkg/resources/customresources/custom_keyvault_autorest.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| // Copyright 2021, Pulumi Corporation. All rights reserved. | ||
|
|
||
| package customresources | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
| "net/http" | ||
|
|
||
| "github.com/Azure/azure-sdk-for-go/services/keyvault/2016-10-01/keyvault" | ||
| "github.com/Azure/go-autorest/autorest" | ||
| "github.com/pkg/errors" | ||
| "github.com/pulumi/pulumi/sdk/v3/go/common/resource" | ||
| ) | ||
|
|
||
| // keyVaultSecret_autorest creates a custom resource for Azure KeyVault Secrets, based on the | ||
| // deprecated autorest and go-azure-helpers backend. | ||
| func keyVaultSecret_autorest(keyVaultDNSSuffix string, kvClient *keyvault.BaseClient) *CustomResource { | ||
| return &CustomResource{ | ||
| path: "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.KeyVault/vaults/{vaultName}/secrets/{secretName}", | ||
| Delete: func(ctx context.Context, id string, properties resource.PropertyMap) error { | ||
| vaultName := properties["vaultName"] | ||
| if !vaultName.HasValue() || !vaultName.IsString() { | ||
| return errors.New("vaultName not found in resource state") | ||
| } | ||
| secretName := properties["secretName"] | ||
| if !secretName.HasValue() || !secretName.IsString() { | ||
| return errors.New("secretName not found in resource state") | ||
| } | ||
|
|
||
| vaultUrl := fmt.Sprintf("https://%s.%s", vaultName.StringValue(), keyVaultDNSSuffix) | ||
| _, err := kvClient.DeleteSecret(ctx, vaultUrl, secretName.StringValue()) | ||
| return reportDeletionError_autorest(err) | ||
| }, | ||
| } | ||
| } | ||
|
|
||
| // keyVaultKey_autorest creates a custom resource for Azure KeyVault Keys, based on the | ||
| // deprecated autorest and go-azure-helpers backend. | ||
| func keyVaultKey_autorest(keyVaultDNSSuffix string, kvClient *keyvault.BaseClient) *CustomResource { | ||
| return &CustomResource{ | ||
| path: "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.KeyVault/vaults/{vaultName}/keys/{keyName}", | ||
| Delete: func(ctx context.Context, id string, properties resource.PropertyMap) error { | ||
| vaultName := properties["vaultName"] | ||
| if !vaultName.HasValue() || !vaultName.IsString() { | ||
| return errors.New("vaultName not found in resource state") | ||
| } | ||
| keyName := properties["keyName"] | ||
| if !keyName.HasValue() || !keyName.IsString() { | ||
| return errors.New("keyName not found in resource state") | ||
| } | ||
|
|
||
| vaultUrl := fmt.Sprintf("https://%s.%s", vaultName.StringValue(), keyVaultDNSSuffix) | ||
| _, err := kvClient.DeleteKey(ctx, vaultUrl, keyName.StringValue()) | ||
| return reportDeletionError_autorest(err) | ||
| }, | ||
| } | ||
| } | ||
|
|
||
| func reportDeletionError_autorest(err error) error { | ||
| if detailed, ok := err.(autorest.DetailedError); ok && detailed.StatusCode == http.StatusNotFound { | ||
| return nil | ||
| } | ||
| return err | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.