使用Terraform更新服务原则密码

Question

使用Terraform根据何时过期更新服务原则密码

第一次使用密码设置服务原则是完美的，但是，我希望密码到期，如果密码即将过期，新的密码会生成并用它更新服务原则，我不完全确定在Terraform做条件因为我还是Terraform的新手，文档并没有真正谈论更新服务原则只是创建它而且没有数据对象可以在它到期时获取

到目前为止，我有这个（完全披露这是我正在帮助的更大的terraform基础的一部分）：

resource "azuread_application" "current" {
  name = "test"
}

resource "azuread_service_principal" "current" {
  application_id = "${azuread_application.current.application_id}"
}

resource "random_string" "password" {
  length  = 64
  special = true
}

resource "azuread_service_principal_password" "current" {
  service_principal_id = "${azuread_service_principal.current.id}"
  value                = "${random_string.password.result}"
  end_date_relative    = "2160h"   # valid for 90 days
}

由于密码仅在90天内有效，我希望在到期之前运行terraform apply并更新密码

更新1：

似乎确实你改变了azuread_service_principal_password资源，它被视为依赖树的一个变化，并重新创建你附加服务原则的资源，这意味着没有办法在Terraform中保持服务原则凭证的状态如果他们需要更新

更新2：

我试图执行以下操作，但是这样做的缺点是每次运行terraform时它都会运行：

terraform脚本：

resource "azuread_application" "current" {
  name = "${var.metadata_name}"
}

resource "azuread_service_principal" "current" {
  application_id = "${azuread_application.current.application_id}"
}
resource "random_string" "password" {
  length  = 64
  special = true
}

resource "azuread_service_principal_password" "current" {
  service_principal_id = "${azuread_service_principal.current.id}"
  value                = "${random_string.password.result}"
  end_date_relative    = "2160h"                                   # valid for 90 days
}


resource "null_resource" "password_updater" {
  # Updates everytime you run terraform apply so it will run this script everytime
  triggers {
    timestamp = "${timestamp()}"
  }

  provisioner "local-exec" {
    command = "sh ${path.module}/update_service_password.sh ${azuread_service_principal.current.id} ${var.resource_group} ${azurerm_kubernetes_cluster.current.name}"
  }
}

脚本：

#!/bin/sh
service_principle_id=$1
resource_group=$2
cluster_name=$3

# get service password expiration
expiration=$(az ad sp list --filter="objectId eq '$service_principle_id'" | jq '.[].passwordCredentials' | jq '.[].endDate' | cut -d'T' -f 1 | cut -d'"' -f 2)

# Format date for condition
now=$(date  +%Y%m%d%H%M%S)
expiration_date=$(date -d "$expiration - 30 days"  +%Y%m%d%H%M%S)


# Compare today with expiration date
if [ ${now} -ge ${expiration_date} ];
then
    # IF expiration date in the next 30 days rest password
    sp_id=$(az aks show -g ${resource_group} -n ${cluster_name} --query servicePrincipalProfile.clientId -o tsv)
    service_principle_secret=$(az ad sp credential reset --name ${sp_id} --end-date $(date -d "+ 90 days"  +%Y-%m-%d) --query password -o tsv)

    # Update cluster with new password
    az aks update-credentials \
    --resource-group ${resource_group} \
    --name ${cluster_name} \
    --reset-service-principal \
    --service-principal ${sp_id} \
    --client-secret ${service_principle_secret}
fi

Answer 1

对于服务主体，可以通过Azure CLI az ad sp reset重置密码，但是您需要拥有执行此操作的权限。

Answer 2

我只是将其设置为答案，因为在与服务原理terraform模块的开发人员交谈后，他们告诉我，如果找到更好的方法，则不可能有任何其他方式请注释：

回答：

使用null_resource提供程序运行运行更新的脚本 -

resource "azuread_application" "current" {
  name = "${var.metadata_name}"
}

resource "azuread_service_principal" "current" {
  application_id = "${azuread_application.current.application_id}"
}
resource "random_string" "password" {
  length  = 64
  special = true
}

resource "azuread_service_principal_password" "current" {
  service_principal_id = "${azuread_service_principal.current.id}"
  value                = "${random_string.password.result}"
  end_date_relative    = "2160h"                                   # valid for 90 days
}


resource "null_resource" "password_updater" {
  # Updates everytime you run terraform apply so it will run this script everytime
  triggers {
    timestamp = "${timestamp()}"
  }

  provisioner "local-exec" {
    command = "sh ${path.module}/update_service_password.sh ${azuread_service_principal.current.id} ${var.resource_group} ${azurerm_kubernetes_cluster.current.name}"
  }
}

脚本：

#!/bin/sh
service_principle_id=$1
resource_group=$2
cluster_name=$3

# get service password expiration
expiration=$(az ad sp list --filter="objectId eq '$service_principle_id'" | jq '.[].passwordCredentials' | jq '.[].endDate' | cut -d'T' -f 1 | cut -d'"' -f 2)

# Format date for condition
now=$(date  +%Y%m%d%H%M%S)
expiration_date=$(date -d "$expiration - 30 days"  +%Y%m%d%H%M%S)


# Compare today with expiration date
if [ ${now} -ge ${expiration_date} ];
then
    # IF expiration date in the next 30 days rest password
    sp_id=$(az aks show -g ${resource_group} -n ${cluster_name} --query servicePrincipalProfile.clientId -o tsv)
    service_principle_secret=$(az ad sp credential reset --name ${sp_id} --end-date $(date -d "+ 90 days"  +%Y-%m-%d) --query password -o tsv)

    # Update cluster with new password
    az aks update-credentials \
    --resource-group ${resource_group} \
    --name ${cluster_name} \
    --reset-service-principal \
    --service-principal ${sp_id} \
    --client-secret ${service_principle_secret}
fi