You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
feat(m365): Use Managed Identity for Getting Application Certificate in Container (#6)
* use managed identity to access app certificate directly from container
* update Terraform providers; change storage urls, add docs for setting subscrption_id
* remove cert rotation
* update readme variables and util file
* fix apply loop with containers by setting ip type to private
* add instruction for setting environment in provider.tf
* change keyvault name on serial number change
Copy file name to clipboardExpand all lines: m365/README.adoc
+15-16Lines changed: 15 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -46,28 +46,31 @@ It is expected that this code is deployed by a user with administrator privledge
46
46
[#deploy]
47
47
=== Deploying with Terraform
48
48
49
+
. Run `az login` if not already done to configure your credentials
49
50
. Prepare a directory for your deployment
50
51
.. Change directories to `m365/terraform/env`
51
52
.. Create a copy of the `example` directory with a name of your choice (e.g., `<myenv>`). **The remaining steps should be completed in this new directory**
52
53
. Update variables and configurations
53
54
.. In your new directory, `<myenv>`, modify the `variables.tfvars` file to configure the deployment for your needs
54
55
... Set `contact_emails` to administrators' emails and set `resource_group_name` to the resource group to create and deploy infrastructure in
55
56
... Review the defaults used for optional variables in <<terraform-variables>>. Some of these may need to be modified depending on your environment
56
-
.. (Optional, but recommended) Modify the `provider.tf` file to configure Terraform to store state in Azure. See external https://developer.hashicorp.com/terraform/language/backend/azurerm[documentation]
57
+
.. In `provider.tf`, replace `<YOUR_SUBSCRIPTION_UUID>` with the Subscription ID you'll be deploying in. The subscription ID can be found in the console, or as the `id` field output by the command `az account show`
58
+
.. If you are deploying in GCC High, update `provider.tf` to replace the two instances of `environment = "public"` with `environment = "usgovernment"`
59
+
.. (Optional, but recommended) Modify the `provider.tf` file to configure Terraform to store state in Azure. See external https://developer.hashicorp.com/terraform/language/backend/azurerm[documentation].
57
60
. Run terraform
58
-
.. Run `az login` if not already done to configure your credentials
59
61
.. In your `<myenv>` directory, Run `terraform init`. This only needs to be done once unless providers are updated
60
62
.. In your `<myenv>` directory, Run `terraform apply -var-file=variables.tfvars`. Confirm changes meet your expectations then type "yes"
61
63
. Onboard a tenant following the guidance in <<onboard>>
62
64
63
65
.Example of completing steps 1-3 in bash
64
66
[source,shell]
65
67
----
68
+
$ az login
66
69
$ cd m365/terraform/env
67
70
m365/terraform/env$ cp -r example myenv
68
71
m365/terraform/env$ cd myenv
69
72
m365/terraform/env/myenv$ vim variables.tfvars
70
-
m365/terraform/env/myenv$ az login
73
+
m365/terraform/env/myenv$ vim provider.tf
71
74
m365/terraform/env/myenv$ terraform init # only needed once
This section provides the description for all terraform variables sorted by their likelihood of being changed.
78
81
For a typical deployment, set `contact_emails` and `resource_group_name` then review the defaults for the optional variables and override in the `tfvars` file as needed.
79
82
80
-
81
83
Required::
82
-
`contact_emails` (string) ::: Emails to notify for alerts and before certificate expiry
84
+
`contact_emails` (list(string)) ::: Emails to notify for alerts and before certificate expiry
83
85
`resource_group_name` (string) ::: Resource group to create and build resources in
84
86
Optional::
85
87
`location` (string) [default=East US]::: Region to build resources in
@@ -92,14 +94,14 @@ Optional::
92
94
`serial_number` (string) [default=01]::: Increment by 1 when re-provisioning with the same resource group name
93
95
`image_path` (string) [default=./cisa_logo.png]::: Path to image used for app logo. Displayed in Azure console on installed tenants
94
96
Advanced::
95
-
`certificate_rotation_period_days` (number) [default=30]::: How many days between when the certificate key should be rotated. Note: rotation requires running terraform
96
97
`create_app` (bool) [default=True]::: If true, the app will be created. If false, the app will be imported
97
98
`prefix_override` (string) [default=None]::: Prefix for resource names. If null, one will be generated from app_name
98
-
`input_storage_container_id` (string) [default=None]::: If not null, input container to read configs from (must give permissions to service account). Otherwise by default will create storage container.
99
-
`output_storage_container_id` (string) [default=None]::: If not null, output container to put results in (must give permissions to service account). Otherwise by default will create storage container.
99
+
`input_storage_container_url` (string) [default=None]::: If not null, input container to read configs from (must give permissions to service account). Otherwise by default will create storage container. Expect an https url pointing to a container
100
+
`output_storage_container_url` (string) [default=None]::: If not null, output container to put results in (must give permissions to service account). Otherwise by default will create storage container. Expect an https url pointing to a container
100
101
`tenants_dir_path` (string) [default=./tenants]::: Relative path to directory containing tenant configuration files in yaml
101
102
`container_registry` (object) [default={'server': 'ghcr.io'}]::: Credentials for logging into registry with container image
102
103
`container_image` (string) [default=ghcr.io/cisagov/scubaconnect-m365:latest]::: Docker image to use for running ScubaGear.
104
+
`container_memory_gb` (number) [default=3]::: Amount of memory to allocate for ScubaGear container. Due to memory leaks in some dependencies, this may need to be increased if running on many tenants
103
105
104
106
[#onboard]
105
107
=== Onboarding a Tenant
@@ -114,7 +116,7 @@ It will perform the following steps (note that the required permissions/roles co
114
116
. Register the ScubaConnect application as a PowerApps Admin
115
117
116
118
117
-
Once completed, upload a ScubaGear configuration file to the `input_storage_container_id` named `<tenant_fqdn>.yaml` (e.g., `myorg.onmicrosoft.com.yaml`).
119
+
Once completed, upload a ScubaGear configuration file to the `input_storage_container_url` named `<tenant_fqdn>.yaml` (e.g., `myorg.onmicrosoft.com.yaml`).
118
120
You may upload the file directly to Azure, or place it in `env/<your_env>/tenants/` and run `terraform apply`.
119
121
Refer to the https://github.com/cisagov/ScubaGear/blob/main/docs/configuration/configuration.md#scuba-compliance-use[ScubaGear Configuration File documentation] for details on creating the configuration file.
120
122
@@ -133,13 +135,10 @@ Looks into the "Last Run Output" logs to determine the cause.
133
135
134
136
=== Maintenance
135
137
136
-
GearConnect's architecture (limited by Managed Identity support in Windows containers) requires exporting the app's certificate as a secret variable in the container.
137
-
To mitigate this, the certificate is short-lived.
138
-
Terraform is set up to automatically generate a new certificate every `certificate_rotation_period_days` (defaults to 30).
139
-
To utilize this mechanism, you must run `terraform apply` on a regular basis.
140
-
This can be done through scheduled CI/CD or manually (an email will be sent one week prior to expiration).
141
-
This will ensure the certificate is always valid.
142
-
138
+
GearConnect utilizes a certificate to authenticate to tenants.
139
+
This certificate is configured to expire after 1 year.
140
+
60 days prior to expiration, an email will be sent.
141
+
Running `terraform apply` will update the certificate for you.
143
142
144
143
The container will be regularly rebuilt and updated overtime to support new versions of ScubaGear.
145
144
No action is required for container updates as Azure Container Instances will grab the latest image by default.
error_message="Rotation period must be between 3 and 60 days"
91
-
}
92
-
}
93
-
94
84
variable"create_app" {
95
85
default=true
96
86
type=bool
@@ -103,16 +93,16 @@ variable "prefix_override" {
103
93
description="Prefix for resource names. If null, one will be generated from app_name"
104
94
}
105
95
106
-
variable"input_storage_container_id" {
96
+
variable"input_storage_container_url" {
107
97
default=null
108
98
type=string
109
-
description="If not null, input container to read configs from (must give permissions to service account). Otherwise by default will create storage container."
99
+
description="If not null, input container to read configs from (must give permissions to service account). Otherwise by default will create storage container. Expect an https url pointing to a container"
110
100
}
111
101
112
-
variable"output_storage_container_id" {
102
+
variable"output_storage_container_url" {
113
103
default=null
114
104
type=string
115
-
description="If not null, output container to put results in (must give permissions to service account). Otherwise by default will create storage container."
105
+
description="If not null, output container to put results in (must give permissions to service account). Otherwise by default will create storage container. Expect an https url pointing to a container"
0 commit comments