diff --git a/CHANGELOG.md b/CHANGELOG.md index a6804b8..66a57c1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -23,6 +23,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), --> +## v0.4.1 + +### Others +- Upgrade `terraform` and `azurerm` version, so the provider functions normalise_resource_id and parse_resource_id are available to use. + ## v0.4.0 ### Added diff --git a/README.md b/README.md index 8acfd6f..988b5db 100644 --- a/README.md +++ b/README.md @@ -106,15 +106,15 @@ Examples are availabe in `examples` directory. | Name | Version | |------|---------| -| [terraform](#requirement\_terraform) | >= 1.3 | -| [azurerm](#requirement\_azurerm) | ~> 3.55 | +| [terraform](#requirement\_terraform) | >= 1.8 | +| [azurerm](#requirement\_azurerm) | ~> 4.15 | | [kubernetes](#requirement\_kubernetes) | ~>2.24 | ## Providers | Name | Version | |------|---------| -| [azurerm](#provider\_azurerm) | ~> 3.55 | +| [azurerm](#provider\_azurerm) | ~> 4.15 | | [kubernetes](#provider\_kubernetes) | ~>2.24 | ## Modules @@ -155,7 +155,7 @@ No modules. | [namespace](#input\_namespace) | (optional) The namespace where service account will be created. New will be created if value is not equeal to kube-sytem and default.Required when `create_github_actions_credential` is set to `false`. | `string` | `""` | no | | [namespace\_annotations](#input\_namespace\_annotations) | (optional) Annotations for namespace created via terraform-kubernetes-provider resource. | `map(string)` | `{}` | no | | [namespace\_labels](#input\_namespace\_labels) | (optional) Labels for namespace created via terraform-kubernetes-provider resource. | `map(string)` | `{}` | no | -| [role\_assignments](#input\_role\_assignments) | (optional) The role assignments for the service account.

`role_definition_name`: The name of a role which either needs to be used (azure built-in) or new one you want to create.
`name` : A unique UUID/GUID for this Role Assignment - one will be generated if not specified. Changing this forces a new resource to be created.
`condition`: The condition that limits the resources that the role can be assigned to. Changing this forces a new resource to be created.
`condition_version`: (Optional) The version of the condition. Possible values are 1.0 or 2.0. Changing this forces a new resource to be created.
`create_custom_role` : Whether or not to create a custom role. If set to true, then any of the custom\_role\_actions,custom\_role\_data\_actions, custom\_role\_not\_actions, custom\_role\_not\_data\_actions, custom\_role\_assignable\_scopes are required.
`scope` : The scope at which the role assignment or custom role will be created.
`custom_role_definition_id`: (Optional) A unique UUID/GUID which identifies this role - one will be generated if not specified. Changing this forces a new resource to be created.Only valid for custom role.
`custom_role_actions`: One or more Allowed Actions, such as *, Microsoft.Resources/subscriptions/resourceGroups/read. See [Azure Resource Manager resource provider operations](https://learn.microsoft.com/en-gb/azure/role-based-access-control/resource-provider-operations) for details. Only valid for custom role.
`custom_role_data_actions` : One or more Allowed Data Actions, such as *, Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read. See [Azure Resource Manager resource provider operations](https://learn.microsoft.com/en-gb/azure/role-based-access-control/resource-provider-operations) for details. Only valid for custom role.
`custom_role_not_actions` : One or more Denied Actions, such as Microsoft.Compute/virtualMachines/write.See [Azure Resource Manager resource provider operations](https://learn.microsoft.com/en-gb/azure/role-based-access-control/resource-provider-operations) for details. Only valid for custom role.
`custom_role_not_data_actions` : One or more Disallowed Data Actions, such as *, Microsoft.Resources/subscriptions/resourceGroups/read
`custom_role_assignable_scopes` : One or more assignable scopes for this Role Definition. The value for scope is automatically included in this list if no other values supplied
`custom_role_description` : A description of the role. Only valid for custom role definition. |
set(object({
role_definition_name = optional(string)
name = optional(string, null)
create_custom_role = optional(bool, false)
condition = optional(string, null)
condition_version = optional(string, null)
scope = optional(string)
custom_role_description = optional(string)
custom_role_definition_id = optional(string, null)
custom_role_actions = optional(set(string), [])
custom_role_data_actions = optional(set(string), [])
custom_role_not_actions = optional(set(string), [])
custom_role_not_data_actions = optional(set(string), [])
custom_role_assignable_scopes = optional(set(string), null)
}))
| `[]` | no | +| [role\_assignments](#input\_role\_assignments) | (optional) The role assignments for the service account.

`role_definition_name`: The name of a role which either needs to be used (azure built-in) or new one you want to create.
`name` : A unique UUID/GUID for this Role Assignment - one will be generated if not specified. Changing this forces a new resource to be created.
`condition`: The condition that limits the resources that the role can be assigned to. Changing this forces a new resource to be created.
`condition_version`: (Optional) The version of the condition. Possible values are 1.0 or 2.0. Changing this forces a new resource to be created.
`create_custom_role` : Whether or not to create a custom role. If set to true, then any of the custom\_role\_actions,custom\_role\_data\_actions, custom\_role\_not\_actions, custom\_role\_not\_data\_actions, custom\_role\_assignable\_scopes are required.
`scope` : The scope at which the role assignment or custom role will be created.
`custom_role_definition_id`: (Optional) A unique UUID/GUID which identifies this role - one will be generated if not specified. Changing this forces a new resource to be created.Only valid for custom role.
`custom_role_actions`: One or more Allowed Actions, such as *, Microsoft.Resources/subscriptions/resourceGroups/read. See [Azure Resource Manager resource provider operations](https://learn.microsoft.com/en-gb/azure/role-based-access-control/resource-provider-operations) for details. Only valid for custom role.
`custom_role_data_actions` : One or more Allowed Data Actions, such as *, Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read. See [Azure Resource Manager resource provider operations](https://learn.microsoft.com/en-gb/azure/role-based-access-control/resource-provider-operations) for details. Only valid for custom role.
`custom_role_not_actions` : One or more Denied Actions, such as Microsoft.Compute/virtualMachines/write.See [Azure Resource Manager resource provider operations](https://learn.microsoft.com/en-gb/azure/role-based-access-control/resource-provider-operations) for details. Only valid for custom role.
`custom_role_not_data_actions` : One or more Disallowed Data Actions, such as *, Microsoft.Resources/subscriptions/resourceGroups/read
`custom_role_assignable_scopes` : One or more assignable scopes for this Role Definition. The value for scope is automatically included in this list if no other values supplied
`custom_role_description` : A description of the role. Only valid for custom role definition. |
set(object({
role_definition_name = optional(string)
name = optional(string, null)
create_custom_role = optional(bool, false)
condition = optional(string, null)
condition_version = optional(string, null)
scope = optional(string)
custom_role_description = optional(string)
custom_role_definition_id = optional(string, null)
custom_role_actions = optional(set(string), [])
custom_role_data_actions = optional(set(string), [])
custom_role_not_actions = optional(set(string), [])
custom_role_not_data_actions = optional(set(string), [])
custom_role_assignable_scopes = optional(set(string), null)
}))
| `[]` | no | | [service\_account\_name](#input\_service\_account\_name) | (optional) The name of the service account which is using the workload identity. Required when `create_github_actions_credential` is set to `false`. | `string` | `""` | no | | [service\_account\_token\_expiration\_seconds](#input\_service\_account\_token\_expiration\_seconds) | (optional) Represents the expirationSeconds field for the projected service account token | `number` | `86400` | no | | [tags](#input\_tags) | (Optional) A mapping of tags which should be assigned to the User Assigned Identity. | `map(string)` | `{}` | no | diff --git a/versions.tf b/versions.tf index 39983c6..6f73cae 100644 --- a/versions.tf +++ b/versions.tf @@ -2,12 +2,12 @@ terraform { required_providers { azurerm = { source = "hashicorp/azurerm" - version = "~> 3.55" + version = "~> 4.15" } kubernetes = { source = "hashicorp/kubernetes" version = "~>2.24" } } - required_version = ">= 1.3" + required_version = ">= 1.8" }