Skip to content

Commit 4286347

Browse files
pchanvallonldez
pchanvallon
and
ldez
authored
azure: new implementation based on the new API client (go-acme#1830)
Co-authored-by: Fernandez Ludovic <[email protected]>
1 parent b4a2913 commit 4286347

17 files changed

+956
-46
lines changed

‎README.md

+29-28
Large diffs are not rendered by default.

‎cmd/zz_gen_cmd_dnshelp.go

+28-1
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ func allDNSCodes() string {
2121
"auroradns",
2222
"autodns",
2323
"azure",
24+
"azuredns",
2425
"bindman",
2526
"bluecat",
2627
"brandit",
@@ -267,7 +268,7 @@ func displayDNSHelp(w io.Writer, name string) error {
267268

268269
case "azure":
269270
// generated from: providers/dns/azure/azure.toml
270-
ew.writeln(`Configuration for Azure.`)
271+
ew.writeln(`Configuration for Azure (deprecated).`)
271272
ew.writeln(`Code: 'azure'`)
272273
ew.writeln(`Since: 'v0.4.0'`)
273274
ew.writeln()
@@ -293,6 +294,32 @@ func displayDNSHelp(w io.Writer, name string) error {
293294
ew.writeln()
294295
ew.writeln(`More information: https://go-acme.github.io/lego/dns/azure`)
295296

297+
case "azuredns":
298+
// generated from: providers/dns/azuredns/azuredns.toml
299+
ew.writeln(`Configuration for AzureDNS.`)
300+
ew.writeln(`Code: 'azuredns'`)
301+
ew.writeln(`Since: 'v0.1.0'`)
302+
ew.writeln()
303+
304+
ew.writeln(`Credentials:`)
305+
ew.writeln(` - "AZURE_CLIENT_ID": Client ID`)
306+
ew.writeln(` - "AZURE_CLIENT_SECRET": Client secret`)
307+
ew.writeln(` - "AZURE_RESOURCE_GROUP": DNS zone resource group`)
308+
ew.writeln(` - "AZURE_SUBSCRIPTION_ID": DNS zone subscription ID`)
309+
ew.writeln(` - "AZURE_TENANT_ID": Tenant ID`)
310+
ew.writeln()
311+
312+
ew.writeln(`Additional Configuration:`)
313+
ew.writeln(` - "AZURE_ENVIRONMENT": Azure environment, one of: public, usgovernment, and china`)
314+
ew.writeln(` - "AZURE_POLLING_INTERVAL": Time between DNS propagation check`)
315+
ew.writeln(` - "AZURE_PRIVATE_ZONE": Set to true to use Azure Private DNS Zones and not public`)
316+
ew.writeln(` - "AZURE_PROPAGATION_TIMEOUT": Maximum waiting time for DNS propagation`)
317+
ew.writeln(` - "AZURE_TTL": The TTL of the TXT record used for the DNS challenge`)
318+
ew.writeln(` - "AZURE_ZONE_NAME": Zone name to use inside Azure DNS service to add the TXT record in`)
319+
320+
ew.writeln()
321+
ew.writeln(`More information: https://go-acme.github.io/lego/dns/azuredns`)
322+
296323
case "bindman":
297324
// generated from: providers/dns/bindman/bindman.toml
298325
ew.writeln(`Configuration for Bindman.`)

‎docs/content/dns/zz_gen_azure.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
title: "Azure"
2+
title: "Azure (deprecated)"
33
date: 2019-03-03T16:39:46+01:00
44
draft: false
55
slug: azure
@@ -14,7 +14,7 @@ dnsprovider:
1414
<!-- THIS DOCUMENTATION IS AUTO-GENERATED. PLEASE DO NOT EDIT. -->
1515

1616

17-
Configuration for [Azure](https://azure.microsoft.com/services/dns/).
17+
Configuration for [Azure (deprecated)](https://azure.microsoft.com/services/dns/).
1818

1919

2020
<!--more-->

‎docs/content/dns/zz_gen_azuredns.md

+119
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
---
2+
title: "AzureDNS"
3+
date: 2019-03-03T16:39:46+01:00
4+
draft: false
5+
slug: azuredns
6+
dnsprovider:
7+
since: "v0.1.0"
8+
code: "azuredns"
9+
url: "https://azure.microsoft.com/services/dns/"
10+
---
11+
12+
<!-- THIS DOCUMENTATION IS AUTO-GENERATED. PLEASE DO NOT EDIT. -->
13+
<!-- providers/dns/azuredns/azuredns.toml -->
14+
<!-- THIS DOCUMENTATION IS AUTO-GENERATED. PLEASE DO NOT EDIT. -->
15+
16+
17+
Configuration for [AzureDNS](https://azure.microsoft.com/services/dns/).
18+
19+
20+
<!--more-->
21+
22+
- Code: `azuredns`
23+
- Since: v0.1.0
24+
25+
26+
Here is an example bash command using the AzureDNS provider:
27+
28+
```bash
29+
### Using client secret
30+
AZURE_CLIENT_ID=<your service principal client ID> \
31+
AZURE_TENANT_ID=<your service principal tenant ID> \
32+
AZURE_CLIENT_SECRET=<your service principal client secret> \
33+
lego --domains example.com --email [email protected] --dns azuredns run
34+
35+
### Using client certificate
36+
AZURE_CLIENT_ID=<your service principal client ID> \
37+
AZURE_TENANT_ID=<your service principal tenant ID> \
38+
AZURE_CLIENT_CERTIFICATE_PATH=<your service principal certificate path> \
39+
lego --domains example.com --email [email protected] --dns azuredns run
40+
41+
### Using Azure CLI
42+
az login \
43+
lego --domains example.com --email [email protected] --dns azuredns run
44+
```
45+
46+
47+
48+
49+
## Credentials
50+
51+
| Environment Variable Name | Description |
52+
|-----------------------|-------------|
53+
| `AZURE_CLIENT_ID` | Client ID |
54+
| `AZURE_CLIENT_SECRET` | Client secret |
55+
| `AZURE_RESOURCE_GROUP` | DNS zone resource group |
56+
| `AZURE_SUBSCRIPTION_ID` | DNS zone subscription ID |
57+
| `AZURE_TENANT_ID` | Tenant ID |
58+
59+
The environment variable names can be suffixed by `_FILE` to reference a file instead of a value.
60+
More information [here]({{< ref "dns#configuration-and-credentials" >}}).
61+
62+
63+
## Additional Configuration
64+
65+
| Environment Variable Name | Description |
66+
|--------------------------------|-------------|
67+
| `AZURE_ENVIRONMENT` | Azure environment, one of: public, usgovernment, and china |
68+
| `AZURE_POLLING_INTERVAL` | Time between DNS propagation check |
69+
| `AZURE_PRIVATE_ZONE` | Set to true to use Azure Private DNS Zones and not public |
70+
| `AZURE_PROPAGATION_TIMEOUT` | Maximum waiting time for DNS propagation |
71+
| `AZURE_TTL` | The TTL of the TXT record used for the DNS challenge |
72+
| `AZURE_ZONE_NAME` | Zone name to use inside Azure DNS service to add the TXT record in |
73+
74+
The environment variable names can be suffixed by `_FILE` to reference a file instead of a value.
75+
More information [here]({{< ref "dns#configuration-and-credentials" >}}).
76+
77+
## Description
78+
79+
Azure Credentials are automatically detected in the following locations and prioritized in the following order:
80+
81+
1. Environment variables for client secret: `AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, `AZURE_CLIENT_SECRET`
82+
2. Environment variables for client certificate: `AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, `AZURE_CLIENT_CERTIFICATE_PATH`
83+
3. Workload identity for resources hosted in Azure environment (see below)
84+
4. Shared credentials file (defaults to `~/.azure`), used by Azure CLI
85+
86+
Link:
87+
- [Azure Authentication](https://learn.microsoft.com/en-us/azure/developer/go/azure-sdk-authentication)
88+
89+
### Workload identity
90+
91+
#### Azure Managed Identity
92+
93+
Azure managed identity service allows linking Azure AD identities to Azure resources. \
94+
Workloads running inside compute typed resource can inherit from this configuration to get rights on Azure resources.
95+
96+
#### Workload identity for AKS
97+
98+
Workload identity allows workloads running Azure Kubernetes Services (AKS) clusters to authenticate as an Azure AD application identity using federated credentials. \
99+
This must be configured in kubernetes workload deployment in one hand and on the Azure AD application registration in the other hand. \
100+
101+
Here is a summary of the steps to follow to use it :
102+
* create a `ServiceAccount` resource, add following annotations to reference the targeted Azure AD application registration : `azure.workload.identity/client-id` and `azure.workload.identity/tenant-id`. \
103+
* on the `Deployment` resource you must reference the previous `ServiceAccount` and add the following label : `azure.workload.identity/use: "true"`.
104+
* create a fedreated credentials of type `Kubernetes accessing Azure resources`, add the cluster issuer URL and add the namespace and name of your kubernetes service account.
105+
106+
Link :
107+
- [Azure AD Workload identity](https://azure.github.io/azure-workload-identity/docs/topics/service-account-labels-and-annotations.html)
108+
109+
110+
111+
112+
## More information
113+
114+
- [API documentation](https://docs.microsoft.com/en-us/go/azure/)
115+
- [Go client](https://github.com/Azure/azure-sdk-for-go)
116+
117+
<!-- THIS DOCUMENTATION IS AUTO-GENERATED. PLEASE DO NOT EDIT. -->
118+
<!-- providers/dns/azuredns/azuredns.toml -->
119+
<!-- THIS DOCUMENTATION IS AUTO-GENERATED. PLEASE DO NOT EDIT. -->

‎docs/data/zz_cli_help.toml

+1-1
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ To display the documentation for a specific DNS provider, run:
136136
$ lego dnshelp -c code
137137
138138
Supported DNS providers:
139-
acme-dns, alidns, allinkl, arvancloud, auroradns, autodns, azure, bindman, bluecat, brandit, bunny, checkdomain, civo, clouddns, cloudflare, cloudns, cloudxns, conoha, constellix, derak, desec, designate, digitalocean, dnshomede, dnsimple, dnsmadeeasy, dnspod, dode, domeneshop, dreamhost, duckdns, dyn, dynu, easydns, edgedns, efficientip, epik, exec, exoscale, freemyip, gandi, gandiv5, gcloud, gcore, glesys, godaddy, googledomains, hetzner, hostingde, hosttech, httpreq, hurricane, hyperone, ibmcloud, iij, iijdpf, infoblox, infomaniak, internetbs, inwx, ionos, iwantmyname, joker, liara, lightsail, linode, liquidweb, loopia, luadns, manual, mydnsjp, mythicbeasts, namecheap, namedotcom, namesilo, nearlyfreespeech, netcup, netlify, nicmanager, nifcloud, njalla, nodion, ns1, oraclecloud, otc, ovh, pdns, plesk, porkbun, rackspace, rcodezero, regru, rfc2136, rimuhosting, route53, safedns, sakuracloud, scaleway, selectel, servercow, simply, sonic, stackpath, tencentcloud, transip, ultradns, variomedia, vegadns, vercel, versio, vinyldns, vkcloud, vscale, vultr, websupport, wedos, yandex, yandexcloud, zoneee, zonomi
139+
acme-dns, alidns, allinkl, arvancloud, auroradns, autodns, azure, azuredns, bindman, bluecat, brandit, bunny, checkdomain, civo, clouddns, cloudflare, cloudns, cloudxns, conoha, constellix, derak, desec, designate, digitalocean, dnshomede, dnsimple, dnsmadeeasy, dnspod, dode, domeneshop, dreamhost, duckdns, dyn, dynu, easydns, edgedns, efficientip, epik, exec, exoscale, freemyip, gandi, gandiv5, gcloud, gcore, glesys, godaddy, googledomains, hetzner, hostingde, hosttech, httpreq, hurricane, hyperone, ibmcloud, iij, iijdpf, infoblox, infomaniak, internetbs, inwx, ionos, iwantmyname, joker, liara, lightsail, linode, liquidweb, loopia, luadns, manual, mydnsjp, mythicbeasts, namecheap, namedotcom, namesilo, nearlyfreespeech, netcup, netlify, nicmanager, nifcloud, njalla, nodion, ns1, oraclecloud, otc, ovh, pdns, plesk, porkbun, rackspace, rcodezero, regru, rfc2136, rimuhosting, route53, safedns, sakuracloud, scaleway, selectel, servercow, simply, sonic, stackpath, tencentcloud, transip, ultradns, variomedia, vegadns, vercel, versio, vinyldns, vkcloud, vscale, vultr, websupport, wedos, yandex, yandexcloud, zoneee, zonomi
140140
141141
More information: https://go-acme.github.io/lego/dns
142142
"""

‎go.mod

+11-4
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,13 @@ go 1.19
55
// github.com/exoscale/egoscale v1.19.0 => It is an error, please don't use it.
66
require (
77
cloud.google.com/go/compute/metadata v0.2.3
8-
github.com/Azure/azure-sdk-for-go v32.4.0+incompatible
8+
github.com/Azure/azure-sdk-for-go v68.0.0+incompatible
9+
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.6.0
10+
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0
11+
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/dns/armdns v1.1.0
12+
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/privatedns/armprivatedns v1.1.0
913
github.com/Azure/go-autorest/autorest v0.11.24
10-
github.com/Azure/go-autorest/autorest/azure/auth v0.5.11
14+
github.com/Azure/go-autorest/autorest/azure/auth v0.5.12
1115
github.com/Azure/go-autorest/autorest/to v0.4.0
1216
github.com/BurntSushi/toml v1.3.2
1317
github.com/OpenDNS/vegadns2client v0.0.0-20180418235048-a3fa4a771d87
@@ -74,13 +78,14 @@ require (
7478

7579
require (
7680
cloud.google.com/go/compute v1.18.0 // indirect
81+
github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0 // indirect
7782
github.com/Azure/go-autorest v14.2.0+incompatible // indirect
7883
github.com/Azure/go-autorest/autorest/adal v0.9.18 // indirect
7984
github.com/Azure/go-autorest/autorest/azure/cli v0.4.5 // indirect
8085
github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
81-
github.com/Azure/go-autorest/autorest/validation v0.3.1 // indirect
8286
github.com/Azure/go-autorest/logger v0.2.1 // indirect
8387
github.com/Azure/go-autorest/tracing v0.6.0 // indirect
88+
github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0 // indirect
8489
github.com/andres-erbsen/clock v0.0.0-20160526145045-9e14626cd129 // indirect
8590
github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
8691
github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
@@ -92,7 +97,7 @@ require (
9297
github.com/ghodss/yaml v1.0.0 // indirect
9398
github.com/go-errors/errors v1.0.1 // indirect
9499
github.com/go-resty/resty/v2 v2.7.0 // indirect
95-
github.com/golang-jwt/jwt/v4 v4.2.0 // indirect
100+
github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
96101
github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e // indirect
97102
github.com/golang/protobuf v1.5.2 // indirect
98103
github.com/google/uuid v1.3.0 // indirect
@@ -105,13 +110,15 @@ require (
105110
github.com/json-iterator/go v1.1.12 // indirect
106111
github.com/k0kubun/go-ansi v0.0.0-20180517002512-3bf9e2903213 // indirect
107112
github.com/kolo/xmlrpc v0.0.0-20220921171641-a4b6fa1dd06b // indirect
113+
github.com/kylelemons/godebug v1.1.0 // indirect
108114
github.com/labbsr0x/goh v1.0.1 // indirect
109115
github.com/liquidweb/go-lwApi v0.0.5 // indirect
110116
github.com/liquidweb/liquidweb-cli v0.6.9 // indirect
111117
github.com/mitchellh/go-homedir v1.1.0 // indirect
112118
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
113119
github.com/modern-go/reflect2 v1.0.2 // indirect
114120
github.com/patrickmn/go-cache v2.1.0+incompatible // indirect
121+
github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 // indirect
115122
github.com/pkg/errors v0.9.1 // indirect
116123
github.com/pmezard/go-difflib v1.0.0 // indirect
117124
github.com/russross/blackfriday/v2 v2.1.0 // indirect

0 commit comments

Comments
 (0)