Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add DNS role assignement #1227

Open
wants to merge 9 commits into
base: main
Choose a base branch
from
Open

Add DNS role assignement #1227

wants to merge 9 commits into from
+72 −11

Conversation

jonathan34c
Copy link
Contributor

What this PR does

We need to allow SafeDnsIntApplication manage DNS zones and record sets in Azure DNS in order for the DelegateChildZone to work

Jira:
Link to demo recording:

Special notes for your reviewer

@jonathan34c jonathan34c marked this pull request as ready for review February 3, 2025 21:57
geoberle
geoberle reviewed Feb 4, 2025
View reviewed changes
dev-infrastructure/templates/global-infra.bicep Outdated
var dnsZoneContributor = subscriptionResourceId('Microsoft.Authorization/roleDefinitions/', 'befefa01-2a29-4197-83a8-272ff33ce314')

// SafeDnsIntApplication object ID use to delegate child DNS
var safeDnsIntAppObjectId = 'c54b6bce-1cd3-4d37-bebe-aa22f4ce4fbc'
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please introduce a new config field for this so we can define this in config per env.
for RH you can use the same ID as we use for aroDevopsMsiId

whober0521
whober0521 requested changes Feb 5, 2025
View reviewed changes
Copy link
Contributor

@whober0521 whober0521 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

update PR title and description

whober0521
whober0521 requested changes Feb 5, 2025
View reviewed changes
dev-infrastructure/templates/global-infra.bicep
@@ -19,6 +19,9 @@ param grafanaAdminGroupPrincipalId string
@description('MSI that will be used during pipeline runs to Azure resources')
param aroDevopsMsiId string

@description('SafeDnsIntApplication object ID use to delegate child DNS')
param safeDnsIntAppObjectId string
Copy link
Contributor

@whober0521 whober0521 Feb 5, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what is safeDnsIntAppObjectId for?

dev-infrastructure/templates/global-infra.bicep
var grafanaAdmin = {
principalId: grafanaAdminGroupPrincipalId
principalType: 'group'
}

resource grafanaInstance 'Microsoft.Dashboard/grafana@2023-09-01' = {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

grafana

dev-infrastructure/templates/global-infra.bicep

// Azure Managed Grafana Workspace Contributor: Can manage Azure Managed Grafana resources, without providing access to the workspaces themselves.
// https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/monitor#azure-managed-grafana-workspace-contributor
var contributor = '5c2d7e57-b7c2-4d8a-be4f-82afa42c6e95'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

grafanaContributor

dev-infrastructure/templates/global-infra.bicep

// Grafana Admin: Perform all Grafana operations, including the ability to manage data sources, create dashboards, and manage role assignments within Grafana.
// https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/monitor#grafana-admin
var admin = '22926164-76b3-42b3-bc55-97df8dab3e41'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

grafanaAdmin

dev-infrastructure/templates/global-infra.bicep
@@ -19,6 +19,9 @@ param grafanaAdminGroupPrincipalId string
@description('MSI that will be used during pipeline runs to Azure resources')
Copy link
Contributor

@whober0521 whober0521 Feb 5, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

line 20 why do we need this? we can output from ev2MSI

whober0521
whober0521 requested changes Feb 5, 2025
View reviewed changes
dev-infrastructure/templates/global-infra.bicep
Comment on lines 72 to 75
var grafanaAdmin = {
principalId: grafanaAdminGroupPrincipalId
principalType: 'group'
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

grafanaAdminGroup

dev-infrastructure/templates/global-infra.bicep
resource grafanaDevopsAccess 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
name: guid(grafanaInstance.id, aroDevopsMsiId, grafanaEditorRole)
resource contributorRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
name: guid(grafanaInstance.id, aroDevopsMsiId, contributor)
scope: grafanaInstance
properties: {
principalId: reference(aroDevopsMsiId, '2023-01-31').principalId
Copy link
Contributor

@whober0521 whober0521 Feb 5, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

line 101 ev2MSI.principalId

whober0521
whober0521 requested changes Feb 5, 2025
View reviewed changes
dev-infrastructure/templates/global-infra.bicep
type: 'SystemAssigned'
}
}

module grafana 'br:arointacr.azurecr.io/grafana.bicep:metrics.20240814.1' = {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

remove line 88 - 95

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@geoberle geoberle geoberle left review comments

@whober0521 whober0521 whober0521 requested changes

@bennerv bennerv Awaiting requested review from bennerv bennerv is a code owner

@janboll janboll Awaiting requested review from janboll janboll is a code owner

@jmelis jmelis Awaiting requested review from jmelis jmelis is a code owner

@SudoBrendan SudoBrendan Awaiting requested review from SudoBrendan SudoBrendan is a code owner

@UlrichSchlueter UlrichSchlueter Awaiting requested review from UlrichSchlueter UlrichSchlueter is a code owner

@weinong weinong Awaiting requested review from weinong weinong is a code owner

@tony-schndr tony-schndr Awaiting requested review from tony-schndr tony-schndr is a code owner

@jfchevrette jfchevrette Awaiting requested review from jfchevrette jfchevrette is a code owner

@mbarnes mbarnes Awaiting requested review from mbarnes mbarnes is a code owner

@mociarain mociarain Awaiting requested review from mociarain mociarain is a code owner

@venkateshsredhat venkateshsredhat Awaiting requested review from venkateshsredhat venkateshsredhat is a code owner

@Nanyte25 Nanyte25 Awaiting requested review from Nanyte25 Nanyte25 is a code owner

@kostola kostola Awaiting requested review from kostola kostola is a code owner

@hbhushan3 hbhushan3 Awaiting requested review from hbhushan3 hbhushan3 is a code owner

Requested changes must be addressed to merge this pull request.

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@jonathan34c @geoberle @whober0521