diff --git a/themes/default/content/registry/packages/azure-native/how-to-guides/azure-py-oidc-provider-pulumi-cloud.md b/themes/default/content/registry/packages/azure-native/how-to-guides/azure-py-oidc-provider-pulumi-cloud.md index 312677610c..f3537c7df0 100644 --- a/themes/default/content/registry/packages/azure-native/how-to-guides/azure-py-oidc-provider-pulumi-cloud.md +++ b/themes/default/content/registry/packages/azure-native/how-to-guides/azure-py-oidc-provider-pulumi-cloud.md @@ -66,7 +66,9 @@ Next, to deploy the application and its infrastructure, follow these steps: This next section will walk you through validating your OIDC configuration using [Pulumi ESC](https://www.pulumi.com/docs/pulumi-cloud/esc/). -Start by [creating a new Pulumi ESC environment](https://www.pulumi.com/docs/pulumi-cloud/esc/get-started/#create-an-environment). Then, copy the template definition from the output in the CLI and paste it into your environment. Save your environment file and run the `pulumi env open /` command in the CLI. You should see output similar to the following: +1. Start by [creating a new Pulumi ESC environment](https://www.pulumi.com/docs/pulumi-cloud/esc/get-started/#create-an-environment). +2. Then, copy the template definition from the output in the CLI and paste it into your environment. +3. Save your environment file and run the `pulumi env open /` command in the CLI. You should see output similar to the following: ```bash $ pulumi env open myOrg/myEnvironment @@ -83,8 +85,6 @@ $ pulumi env open myOrg/myEnvironment }, "environmentVariables": { "ARM_CLIENT_ID": "b537....", - "ARM_OIDC_REQUEST_TOKEN": "eeyJh....", - "ARM_OIDC_REQUEST_URL": "https://api.pulumi.com/oidc", "ARM_OIDC_TOKEN": "eyJh....", "ARM_SUBSCRIPTION_ID": "0282....", "ARM_TENANT_ID": "7061....", @@ -93,6 +93,11 @@ $ pulumi env open myOrg/myEnvironment } ``` +If your identity provider does not offer an ID token directly but it does offer a way to exchange a local bearer token for an ID token, you will need to replace the `ARM_OIDC_TOKEN` environment variable with both of the following: + +- `ARM_OIDC_REQUEST_TOKEN` +- `ARM_OIDC_REQUEST_URL` + ## Clean-Up Resources Once you are done, you can destroy all of the resources as well as the stack: diff --git a/themes/default/content/registry/packages/azure-native/how-to-guides/azure-ts-oidc-provider-pulumi-cloud.md b/themes/default/content/registry/packages/azure-native/how-to-guides/azure-ts-oidc-provider-pulumi-cloud.md new file mode 100644 index 0000000000..0faf0305c3 --- /dev/null +++ b/themes/default/content/registry/packages/azure-native/how-to-guides/azure-ts-oidc-provider-pulumi-cloud.md @@ -0,0 +1,107 @@ +--- +title: "Provisioning an OIDC Provider in Azure for Pulumi Cloud | TypeScript" +h1: "Provisioning an OIDC Provider in Azure for Pulumi Cloud" +linktitle: "Provisioning an OIDC Provider in Azure for Pulumi Cloud" +meta_desc: "Provisioning an OIDC Provider in Azure for Pulumi Cloud How-to Guide using TypeScript" +no_edit_this_page: true +cloud: azure +language: ts +layout: package +--- + + + + +

+ + View Code + +

+ + +This example will create OIDC configuration between Pulumi Cloud and Azure, specifically demonstrating connectivity with [Pulumi ESC](https://www.pulumi.com/docs/pulumi-cloud/esc/). The program automates the process detailed in the Azure documentation for the following activities: + +- [Create a Microsoft Entra application and service principal that can access resources](https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal) +- [Create federated credentials](https://azure.github.io/azure-workload-identity/docs/topics/federated-identity-credential.html#federated-identity-credential-for-an-azure-ad-application-1) + +## Prerequisites + +* [Install Pulumi](https://www.pulumi.com/docs/get-started/install/) +* [Configure Pulumi to Use Azure](https://www.pulumi.com/docs/clouds/azure/get-started/begin/) + +## Running the Example + +Clone [the examples repo](https://github.com/pulumi/examples) and navigate to the folder for this example. + +```bash +git clone https://github.com/pulumi/examples.git +cd examples/azure-ts-oidc-provider-pulumi-cloud +``` + +Next, to deploy the application and its infrastructure, follow these steps: + +1. Create a new stack, which is an isolated deployment target for this example: + + ```bash + pulumi stack init dev + ``` + +1. Set your Pulumi ESC environment name and desired Azure region: + + ```bash + pulumi config set environmentName # replace with your environment name + pulumi config set azure-native:location WestUS2 # any valid Azure region will work + ``` + +1. Install requirements. + + ```bash + npm install + ``` + +1. Run `pulumi up -y`. Once the program completes, it will output a YAML template for you to use in the next step. + +## Validating the OIDC Configuration + +This next section will walk you through validating your OIDC configuration using [Pulumi ESC](https://www.pulumi.com/docs/pulumi-cloud/esc/). + +1. Start by [creating a new Pulumi ESC environment](https://www.pulumi.com/docs/pulumi-cloud/esc/get-started/#create-an-environment). +2. Then, copy the template definition from the output in the CLI and paste it into your environment. +3. Save your environment file and run the `pulumi env open /` command in the CLI. You should see output similar to the following: + +```bash +$ pulumi env open myOrg/myEnvironment +{ + "azure": { + "login": { + "clientId": "b537....", + "oidc": { + "token": "eyJh...." + }, + "subscriptionId": "0282....", + "tenantId": "7061...." + } + }, + "environmentVariables": { + "ARM_CLIENT_ID": "b537....", + "ARM_OIDC_TOKEN": "eyJh....", + "ARM_SUBSCRIPTION_ID": "0282....", + "ARM_TENANT_ID": "7061....", + "ARM_USE_OIDC": "true" + } +} +``` + +If your identity provider does not offer an ID token directly but it does offer a way to exchange a local bearer token for an ID token, you will need to replace the `ARM_OIDC_TOKEN` environment variable with both of the following: + +- `ARM_OIDC_REQUEST_TOKEN` +- `ARM_OIDC_REQUEST_URL` + +## Clean-Up Resources + +Once you are done, you can destroy all of the resources as well as the stack: + +```bash +$ pulumi destroy +$ pulumi stack rm +```