Set up Azure authentication with cert for ARO HCP

This commit passes the needed environment variables for CNCC to authenticate with client certificate for ARO HCP deployments. Signed-off-by: Bryan Cox <[email protected]>
openshift · Oct 19, 2024 · 9a56946 · 9a56946
1 parent 2669a4a
commit 9a56946
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 1 deletion.
diff --git a/bindata/cloud-network-config-controller/managed/controller.yaml b/bindata/cloud-network-config-controller/managed/controller.yaml
@@ -184,6 +184,14 @@ spec:
 {{ if .NO_PROXY }}
         - name: "NO_PROXY"
           value: "{{ .NO_PROXY}}"
+{{ end }}
+{{- if not (eq .AroHcpSecretProviderClass "")}}
+        - name: "ARO_HCP_MI_CLIENT_ID"
+          value: "{{ .AroHcpClientID}}"
+        - name: "ARO_HCP_TENANT_ID"
+          value: "{{ .AroHcpTenantID}}"
+        - name: "ARO_HCP_CLIENT_CERTIFICATE_PATH"
+          value: "{{ .AroHcpCertPath}}"
 {{ end }}
         resources:
           requests:
@@ -203,6 +211,11 @@ spec:
         - name: cloud-token
           mountPath: /var/run/secrets/openshift/serviceaccount
           readOnly: true
+{{- if not (eq .AroHcpSecretProviderClass "")}}
+        - name: cncc-cert
+          mountPath: /mnt/certs
+          readOnly: true
+{{- end }}
         terminationMessagePolicy: FallbackToLogsOnError
       tolerations:
     {{- if .HCPTolerations }}
@@ -244,3 +257,11 @@ spec:
       - name: kube-cloud-config
         configMap:
           name: cloud-network-config-controller-kube-cloud-config
+{{- if not (eq .AroHcpSecretProviderClass "")}}
+      - name: cncc-cert
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            - "secretProviderClass":{{.AroHcpSecretProviderClass}}
+{{- end }}
diff --git a/pkg/network/cloud_network.go b/pkg/network/cloud_network.go
@@ -102,7 +102,10 @@ func renderCloudNetworkConfigController(conf *operv1.NetworkSpec, bootstrapResul
 		data.Data["HTTP_PROXY"] = os.Getenv("MGMT_HTTP_PROXY")
 		data.Data["HTTPS_PROXY"] = os.Getenv("MGMT_HTTPS_PROXY")
 		data.Data["NO_PROXY"] = os.Getenv("MGMT_NO_PROXY")
-		data.Data["AzureMSIAuthentication"] = os.Getenv("AZURE_MSI_AUTHENTICATION")
+		data.Data["AroHcpClientID"] = os.Getenv("ARO_HCP_MI_CLIENT_ID")
+		data.Data["AroHcpTenantID"] = os.Getenv("ARO_HCP_TENANT_ID")
+		data.Data["AroHcpCertPath"] = os.Getenv("ARO_HCP_CLIENT_CERTIFICATE_PATH")
+		data.Data["AroHcpSecretProviderClass"] = os.Getenv("ARO_HCP_SECRET_PROVIDER_CLASS")
 		caOverride.ObjectMeta = metav1.ObjectMeta{
 			Namespace:   hcpCfg.Namespace,
 			Name:        "cloud-network-config-controller-kube-cloud-config",