Skip to content

Commit

Permalink
chore: update script prereqs
Browse files Browse the repository at this point in the history
  • Loading branch information
hknutsen committed Oct 31, 2024
1 parent 0b73f06 commit b2ec954
Show file tree
Hide file tree
Showing 2 changed files with 16 additions and 29 deletions.
29 changes: 13 additions & 16 deletions scripts/oidc/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,16 +4,25 @@ This directory contains a Bash script `oidc.sh` that will configure OpenID Conne

It will:

1. Create an Azure AD application
1. Create a service principal for the Azure AD application
1. Create federated credentials for the Azure AD application
1. Create an Microsoft Entra application
1. Create a service principal for the Microsoft Entra application
1. Create federated credentials for the Microsoft Entra application
1. Create Azure role assignments for the service principal
1. Set GitHub secrets `AZURE_CLIENT_ID`, `AZURE_SUBSCRIPTION_ID` and `AZURE_TENANT_ID`

The script accepts the following arguments:

1. The path of the JSON file containing the OIDC configuration

## Prerequisites

- [Install Azure CLI](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli) - to create Microsoft Entra application, service principal and Azure role assignments.
- [Install GitHub CLI](https://cli.github.com) - to set GitHub secrets.
- [Install jq](https://stedolan.github.io/jq/download/) - to parse JSON configuration file.
- Microsoft Entra role `Application Developer` - to create Microsoft Entra application and service principal.
- Azure role `Owner` - to create Azure role assignments.
- GitHub repository role `Admin` - to set GitHub secrets.

## Configuration specification

Example configuration:
Expand Down Expand Up @@ -42,7 +51,7 @@ Example configuration:
}
```

This configuration will instruct the script to create an Azure AD application and a service principal with name `my-app` and a federated credential with name `deploy-dev` that'll allow deployments from the `dev` environment in the GitHub repository.
This configuration will instruct the script to create an Microsoft Entra application and a service principal with name `my-app` and a federated credential with name `deploy-dev` that'll allow deployments from the `dev` environment in the GitHub repository.

It'll also assign two Azure roles at the subscription scope to the service principal:

Expand All @@ -55,18 +64,6 @@ It'll also assign two Azure roles at the subscription scope to the service princ
>
> `.roleAssignments[].scope` must start with `/subscriptions/${SUBSCRIPTION_ID}`.
## Prerequisites

- [Install Azure CLI](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli) (latest version as of writing: `2.49.0`) - to create Azure AD application, federated credentials, service principal and Azure role assignments
- [Install GitHub CLI](https://cli.github.com) (latest version as of writing: `2.30.0`) - to set GitHub secrets
- [Install jq](https://stedolan.github.io/jq/download/) (latest version as of writing: `1.6`) - to parse JSON config file
- Activate Azure AD role `Application Developer` - to create Azure AD application, federated credentials and service principal
> **Note:** Not necessary when updating the existing config.
- Activate Azure role `Owner` - to create Azure role assignments
> **Note:** Minimum scope required is what's defined for role assignment in the `oidc.json` config.
- GitHub repository role `Admin` - to set GitHub environment secrets
- If a federated credential is configured with subject `repo:${REPO}:environment:<environment>`, create GitHub environment `<environment>` and set appropriate deployment protection rules.

## Usage

1. Open Bash.
Expand Down
16 changes: 3 additions & 13 deletions scripts/terraform-backend/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,19 +9,9 @@ It accepts the following arguments:

## Prerequisites

- [Install Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) - to create Azure resource group, storage account and container:

```console
winget install Microsoft.AzureCLI
```

- [Install jq](https://stedolan.github.io/jq/download/) - to parse JSON config file:

```console
winget install jqlang.jq
```

- Azure role `Owner` at the subscription scope.
- [Install Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) - to create Azure resource group and Storage account.
- [Install jq](https://stedolan.github.io/jq/download/) - to parse JSON configuration file.
- Azure role `Owner` - to create Azure resource group and Storage account.

## Configuration specification

Expand Down

0 comments on commit b2ec954

Please sign in to comment.