-
Notifications
You must be signed in to change notification settings - Fork 58
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[draft] setting up event grid namespaces infrastructure and access
this PR introduces a bicep template to create an Azure Event Grid Namespaces instance in the same RG as the AKS cluster for development purposes. this template implements certificate based authn and topic template based authz as proposed in SD-DDR-0024. entra based authn/z is under investigation and first results can be found here - https://issues.redhat.com/browse/ARO-7244 this PR incomplete and lacks deployment scripts for a Maestro Server and Agent interacting with Event Grid. this will be added soon. Signed-off-by: Gerd Oberlechner <[email protected]>
- Loading branch information
Showing
6 changed files
with
197 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,158 @@ | ||
| param eventGridNamespaceName string = '${resourceGroup().name}-maestro-eventgrid' | ||
| param location string | ||
|
|
||
| param serverCertThumbprint string | ||
| param agentCertThumbprint string | ||
|
|
||
|
|
||
| // create an event grid namespace with MQTT enabled | ||
| resource eventGridNamespace 'Microsoft.EventGrid/namespaces@2023-12-15-preview' = { | ||
| name: eventGridNamespaceName | ||
| location: location | ||
| sku: { | ||
| name: 'Standard' | ||
| } | ||
| properties: { | ||
| publicNetworkAccess: 'Enabled' | ||
| topicSpacesConfiguration: { | ||
| state: 'Enabled' | ||
| } | ||
| } | ||
| } | ||
|
|
||
| // | ||
| // M A E S T R O S E R V E R | ||
| // | ||
|
|
||
| resource maestroServerMqttClient 'Microsoft.EventGrid/namespaces/clients@2023-12-15-preview' = { | ||
| name: 'maestro-server' | ||
| parent: eventGridNamespace | ||
| properties: { | ||
| authenticationName: 'maestro-server' | ||
| attributes: { | ||
| role: 'server' | ||
| } | ||
| clientCertificateAuthentication: { | ||
| allowedThumbprints: [ | ||
| serverCertThumbprint | ||
| ] | ||
| validationScheme: 'ThumbprintMatch' | ||
| } | ||
| state: 'Enabled' | ||
| } | ||
| } | ||
|
|
||
| // a client group to hold the maestro server client | ||
| resource maestroServerMqttClientGroup 'Microsoft.EventGrid/namespaces/clientGroups@2023-12-15-preview' = { | ||
| name: 'maestro-server' | ||
| parent: eventGridNamespace | ||
| properties: { | ||
| query: 'attributes.role IN [\'server\']' | ||
| } | ||
| } | ||
|
|
||
| // create a topic space for the maestro server | ||
| resource maestroServerTopicspace 'Microsoft.EventGrid/namespaces/topicSpaces@2023-12-15-preview' = { | ||
| name: 'maestro-server' | ||
| parent: eventGridNamespace | ||
| properties: { | ||
| topicTemplates: [ | ||
| '*' | ||
| ] | ||
| } | ||
| } | ||
|
|
||
| resource maestroServerPermissionBindingPublish 'Microsoft.EventGrid/namespaces/permissionBindings@2023-12-15-preview' = { | ||
| name: 'maestroServerPublish' | ||
| parent: eventGridNamespace | ||
| properties: { | ||
| clientGroupName: maestroServerMqttClientGroup.name | ||
| permission: 'Publisher' | ||
| topicSpaceName: maestroServerTopicspace.name | ||
| } | ||
| } | ||
|
|
||
| resource maestroServerPermissionBindingSubscribe 'Microsoft.EventGrid/namespaces/permissionBindings@2023-12-15-preview' = { | ||
| name: 'maestroServerSubscribe' | ||
| parent: eventGridNamespace | ||
| properties: { | ||
| clientGroupName: maestroServerMqttClientGroup.name | ||
| permission: 'Subscriber' | ||
| topicSpaceName: maestroServerTopicspace.name | ||
| } | ||
| } | ||
|
|
||
|
|
||
| // | ||
| // M A E S T R O A G E N T | ||
| // | ||
|
|
||
| resource maestroAgentMqttClient 'Microsoft.EventGrid/namespaces/clients@2023-12-15-preview' = { | ||
| name: 'maestro-agent' | ||
| parent: eventGridNamespace | ||
| properties: { | ||
| authenticationName: 'consumer-1' | ||
| attributes: { | ||
| role: 'agent' | ||
| consumerName: 'consumer-1' | ||
| } | ||
| clientCertificateAuthentication: { | ||
| allowedThumbprints: [ | ||
| agentCertThumbprint | ||
| ] | ||
| validationScheme: 'ThumbprintMatch' | ||
| } | ||
| state: 'Enabled' | ||
| } | ||
| } | ||
|
|
||
| // a client group to hold the maestro server client | ||
| resource maestroAgentMqttClientGroup 'Microsoft.EventGrid/namespaces/clientGroups@2023-12-15-preview' = { | ||
| name: 'maestro-agent' | ||
| parent: eventGridNamespace | ||
| properties: { | ||
| query: 'attributes.role IN [\'agent\']' | ||
| } | ||
| } | ||
|
|
||
| // create a topic space for agent source events | ||
| resource maestroAgentSourceEventsTopicspace 'Microsoft.EventGrid/namespaces/topicSpaces@2023-12-15-preview' = { | ||
| name: 'maestro-agent-source-events' | ||
| parent: eventGridNamespace | ||
| properties: { | ||
| topicTemplates: [ | ||
| 'sources/maestro/consumers/{client.properties.consumerName}/sourceevents' | ||
| ] | ||
| } | ||
| } | ||
|
|
||
| resource maestroAgentSourceEventsPermissions 'Microsoft.EventGrid/namespaces/permissionBindings@2023-12-15-preview' = { | ||
| name: 'maestroAgentSubscriber' | ||
| parent: eventGridNamespace | ||
| properties: { | ||
| clientGroupName: maestroServerMqttClientGroup.name | ||
| permission: 'Subscriber' | ||
| topicSpaceName: maestroAgentSourceEventsTopicspace.name | ||
| } | ||
| } | ||
|
|
||
| // create a topic space for agent events | ||
| resource maestroAgentEventsTopicspace 'Microsoft.EventGrid/namespaces/topicSpaces@2023-12-15-preview' = { | ||
| name: 'maestro-agent-events' | ||
| parent: eventGridNamespace | ||
| properties: { | ||
| topicTemplates: [ | ||
| 'sources/maestro/consumers/{client.properties.consumerName}/sourceevents' | ||
| ] | ||
| } | ||
| } | ||
|
|
||
| resource maestroAgentEventsPermissions 'Microsoft.EventGrid/namespaces/permissionBindings@2023-12-15-preview' = { | ||
| name: 'maestroAgentPublisher' | ||
| parent: eventGridNamespace | ||
| properties: { | ||
| clientGroupName: maestroServerMqttClientGroup.name | ||
| permission: 'Publisher' | ||
| topicSpaceName: maestroAgentEventsTopicspace.name | ||
| } | ||
| } |