2

Right now I have several ideas in theory, but they all have problems. My setup is:

  • Azure DevOps Services
  • Azure Cloud
  • A powerful service principal connection with which I run the pipeline

Idea #1

  1. Pipeline deploys an AKS cluster, AAD Pod Identity and Argo CD.
  2. Pipeline configures a Managed Identity for the Argo CD service.
  3. Pipeline adds the ArgoCD Managed Identity as a user to Azure Repos

The Problem - could not find a way to add a managed identity as a user to Azure Repos.

Idea #2

  1. Pipeline deploys an AKS cluster, Argo CD and generates SSH public/private keys.
  2. Pipeline registers the public SSH key with the Azure DevOps Services.
  3. Argo CD would use the generated private SSH key to access Azure DevOps under the identity of the pipeline account.

The Problem - there is no REST API to register a public SSH key with the Azure DevOps Services. Another problem is that we need to manage the SSH private key storage (be it in the terraform remote state or in an Azure KV or both)

Idea #3

  1. Manually register SSH public key with Azure DevOps. The respective private key is uploaded as a secure file in the Pipelines Library.
  2. Pipeline deploys an AKS cluster, an Azure Key Vault and Argo CD.
  3. Pipeline uploads the SSH private key to the Azure Key Vault
  4. Pipeline configures ArgoCD to read the SSH private key from the Azure Key Vault and use it to authenticate with the Azure Repos.

The Problem - How to make ArgoCD get the secrets from the Azure Key Vault? There seem to be multiple ways:

And the question is - which one is the most mature and the safest?

I wonder how folks have resolved this question. What is your approach to this problem?

Improve this question

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.