Comments (10)
yes I have. Thank you
from ipam.
Sorry for the delayed response. I'm actually hinting at extending the Terraform provider to not only work with an access token and also accept a service principal id and secret to authenticate against the API, similar to the azurerm provider. (and equally support this through env variables
export ARM_CLIENT_ID="00000000-0000-0000-0000-000000000000" export ARM_CLIENT_SECRET="12345678-0000-0000-0000-000000000000" export ARM_TENANT_ID="10000000-0000-0000-0000-000000000000" export ARM_SUBSCRIPTION_ID="20000000-0000-0000-0000-000000000000"
see here for examples: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/guides/service_principal_client_secret
In the meantime it would not hurt to include examples for retrieving the token through az cli or the curl command I provided (powershell should also be possible instead of curl, didn't investigated that option though)
from ipam.
@DCMattyG We are also looking for something like this. We use Service principal for all automation and in our case we allocate IP address block. Would like to see how access can be granted to an SP which can get the token and reserve the IP address. Is this possible with the current implementation?
from ipam.
Thank you @dejoost for the example above (and thank you @jeevanions for confirming the need here).
I'm just looking for some clarification on the desired outcome from this open issue. Would you like me to add an official "example" with the above mechanism of retrieving a token via API (cURL or some other mechanism)? If so, is this something you'd like to see in the official docs, the examples folder, or both?
Always appreciate the feedback, keep it coming!
from ipam.
@DCMattyG I have gone through the documentation, and it is possible to get the token through CLI, but a user need to use their credentials to sign in to the CLI first to get the access token. Is there something like a Personal access token that we can generate from the IPAM application and use that to fire the IP reservation endpoint? It would make things simple in our automation script.
from ipam.
@DCMattyG I figured out this. We use a SP (we call it as master SP) to provision these App Reg. Though this SP is not allowed to access the frontend application, it can invoke the backend API.
Steps to do this
- Login using Azure cli using the credentials for your SP
- Get the resource URL from your app reg for IPAM engine. You can find it here. Find the App reg->Under manage -> "Expose an API" -> Application ID URI
- Then run this command
az account get-access-token --resource $resource_url | jq -r '.accessToken'
- Then use the access token to fire the Ip reservation endpoint.
from ipam.
Hi @jeevanions, I believe you have what you need for this particular issue (based on the above). Would it be alright if we closed this issue and added your provided steps to our public documentation for others to reference moving forward?
from ipam.
@dejoost, there is a customer whom is currently working on the "official" Terraform provider for Azure IPAM.
You can review the progress here
We'll work in integrating the finalized Terraform Provider into this project upon completion. Hopefully it will be ready to go relatively soon!
from ipam.
And apologies @dejoost, I neglected to recognize that you were the one who created the issue, so definitely want to make sure you are satisfied before closing it out 😉
from ipam.
As this issue is quite old now I'm going to close it out. Just for completeness the "official" Azure IPAM provider for Terraform is available to all and can be found here:
https://registry.terraform.io/providers/XtratusCloud/azureipam/latest/docs
We'll be adding some additional documentation with examples into the official Azure IPAM documentation in the near future as well.
Should you have any additional questions on this topic or need any additional support, please don't hesitate to re-open this issue or create or create a new one. We hope you're enjoying Azure IPAM!
from ipam.
Related Issues (20)
- deploy.ps1 error while deploying appServiceModule HOT 2
- IP Planner Tool does not display the available ranges /28 - /30 correctly HOT 9
- Export data?
- Virtual networks not discoverable HOT 5
- vNets in Block becoming unassociated and duplicated HOT 5
- Running AppOnly with AsFunction returns error HOT 3
- Errors on Engine pods after setting up ipam on AKS HOT 9
- Releases and versioning HOT 1
- Add next available vNet CIDR to GUI HOT 5
- Engine 502 and seems not working HOT 6
- Provide some option to limit which principals can create reservations HOT 1
- Implement using Private endpoint HOT 4
- Reservations for External networks HOT 5
- Operation returned an invalid status code 'Forbidden HOT 4
- Support setting up IPAM at management groups other than the tenant root HOT 2
- Forward Slash in block names HOT 4
- block reservation with 2 vnets HOT 7
- Block filter in VNETS page is case sensitive HOT 3
- Access denied to "Configure" page HOT 5
- Welcome to Azure IPAM Discussions! HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ipam.