azure: find zones via serviceDiscovery (or allow multiple values for AZURE_RESOURCE_GROUP) about lego HOT 7 CLOSED

Create a certificate with multiple SANs using Azure DNS zones which are in multiple resourceGroups or subscriptions.

As a user i expect that Lego finds the DNS zones automatically in my subscriptions based on the assigned roleAssignments of the serviceprincipal. It should not need a AZURE_SUBSCRIPTION_ID or AZURE_RESOURCE_GROUP but could be possible to filter service discovery.

without AZURE_SUBSCRIPTION_ID and AZURE_RESOURCE_GROUP:
(find all DNS zones in visible scope)

resources
| where type =~ "microsoft.network/dnszones"
| project id, subscriptionId, resourceGroup, name

with only AZURE_SUBSCRIPTION_ID:
(find all DNS zones in one subscription)

resources
| where type =~ "microsoft.network/dnszones"
| where subscriptionId =~ "${AZURE_SUBSCRIPTION_ID}"
| project id, subscriptionId, resourceGroup, name

with AZURE_SUBSCRIPTION_ID and AZURE_RESOURCE_GROUP:
(find all DNS zones in a specific resourcegroup)

resources
| where type =~ "microsoft.network/dnszones"
| where subscriptionId =~ "${AZURE_SUBSCRIPTION_ID}" and resourceGroup =~ "${AZURE_RESOURCE_GROUP}"
| project id, subscriptionId, resourceGroup, name

This would make Azure DNS provider more flexible and easier to use.

I'm willing to create a PR if you are ok with this feature using resourceGraph for service discovery.

from lego.

@pchanvallon

implemented a first working preview (tested only with public zones)

as another idea we can also implement an AZURE_SERVICEDISCOVERY_FILTER env var for additional filtering, eg:

resources
| where type =~ "microsoft.network/dnszones"
| where subscriptionId =~ "${AZURE_SUBSCRIPTION_ID}" and resourceGroup =~ "${AZURE_RESOURCE_GROUP}"
| ${AZURE_SERVICEDISCOVERY_FILTER}
| project id, subscriptionId, resourceGroup, name

this could allow validating zones eg. by resourcegroup tags via Kusto subquery

from lego.

Nothing special, but we're actually waiting for this feature because it makes everything easier.
We're currently using a forked build and would like to get rid of it.

from lego.

@pchanvallon do you have any thoughts on this issue?

from lego.

Hello @mblaschke ,

I am a bit confused about the underlying use-case.
Can you explain a bit more what you attend to do with this new feature ?

from lego.

@ldez any chance we get a new release with this feature in the next days?

from lego.

Just out of curiosity, why in the next days?

from lego.