sigs.k8s.io/cluster-api-provider-azure@v1.14.3/azure/services/identities/client.go (about)

     1  /*
     2  Copyright 2022 The Kubernetes Authors.
     3  
     4  Licensed under the Apache License, Version 2.0 (the "License");
     5  you may not use this file except in compliance with the License.
     6  You may obtain a copy of the License at
     7  
     8      http://www.apache.org/licenses/LICENSE-2.0
     9  
    10  Unless required by applicable law or agreed to in writing, software
    11  distributed under the License is distributed on an "AS IS" BASIS,
    12  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    13  See the License for the specific language governing permissions and
    14  limitations under the License.
    15  */
    16  
    17  package identities
    18  
    19  import (
    20  	"context"
    21  
    22  	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi"
    23  	"github.com/pkg/errors"
    24  	"k8s.io/utils/ptr"
    25  	"sigs.k8s.io/cluster-api-provider-azure/azure"
    26  	azureutil "sigs.k8s.io/cluster-api-provider-azure/util/azure"
    27  	"sigs.k8s.io/cluster-api-provider-azure/util/tele"
    28  )
    29  
    30  // Client wraps go-sdk.
    31  type Client interface {
    32  	Get(ctx context.Context, resourceGroupName, name string) (armmsi.Identity, error)
    33  	GetClientID(ctx context.Context, providerID string) (string, error)
    34  }
    35  
    36  // AzureClient contains the Azure go-sdk Client.
    37  type AzureClient struct {
    38  	userAssignedIdentities *armmsi.UserAssignedIdentitiesClient
    39  }
    40  
    41  // NewClient creates a new MSI client from an authorizer.
    42  func NewClient(auth azure.Authorizer) (Client, error) {
    43  	opts, err := azure.ARMClientOptions(auth.CloudEnvironment())
    44  	if err != nil {
    45  		return nil, errors.Wrap(err, "failed to create identities client options")
    46  	}
    47  	factory, err := armmsi.NewClientFactory(auth.SubscriptionID(), auth.Token(), opts)
    48  	if err != nil {
    49  		return nil, errors.Wrap(err, "failed to create armmsi client factory")
    50  	}
    51  	return &AzureClient{factory.NewUserAssignedIdentitiesClient()}, nil
    52  }
    53  
    54  // NewClientBySub creates a new MSI client with a given subscriptionID.
    55  func NewClientBySub(auth azure.Authorizer, subscriptionID string) (Client, error) {
    56  	opts, err := azure.ARMClientOptions(auth.CloudEnvironment())
    57  	if err != nil {
    58  		return nil, errors.Wrap(err, "failed to create identities client options")
    59  	}
    60  	factory, err := armmsi.NewClientFactory(subscriptionID, auth.Token(), opts)
    61  	if err != nil {
    62  		return nil, errors.Wrap(err, "failed to create armmsi client factory")
    63  	}
    64  	return &AzureClient{factory.NewUserAssignedIdentitiesClient()}, nil
    65  }
    66  
    67  // Get returns a managed service identity.
    68  func (ac *AzureClient) Get(ctx context.Context, resourceGroupName, name string) (armmsi.Identity, error) {
    69  	ctx, _, done := tele.StartSpanWithLogger(ctx, "identities.AzureClient.Get")
    70  	defer done()
    71  
    72  	resp, err := ac.userAssignedIdentities.Get(ctx, resourceGroupName, name, nil)
    73  	if err != nil {
    74  		return armmsi.Identity{}, err
    75  	}
    76  	return resp.Identity, nil
    77  }
    78  
    79  // GetClientID returns the client ID of a managed service identity, given its full URL identifier.
    80  func (ac *AzureClient) GetClientID(ctx context.Context, providerID string) (string, error) {
    81  	ctx, _, done := tele.StartSpanWithLogger(ctx, "identities.AzureClient.GetClientID")
    82  	defer done()
    83  
    84  	parsed, err := azureutil.ParseResourceID(providerID)
    85  	if err != nil {
    86  		return "", err
    87  	}
    88  	ident, err := ac.Get(ctx, parsed.ResourceGroupName, parsed.Name)
    89  	if err != nil {
    90  		return "", err
    91  	}
    92  	return ptr.Deref(ident.Properties.ClientID, ""), nil
    93  }