@@ -6,50 +6,52 @@ import * as resources from "@pulumi/azure-native/resources";
6
6
import * as pulumi from "@pulumi/pulumi" ;
7
7
8
8
import { AuthorizationManagementClient } from "@azure/arm-authorization" ;
9
- import { TokenCredentials } from "@azure/ms-rest-js " ;
9
+ import { DefaultAzureCredential } from "@azure/identity " ;
10
10
11
11
async function getAuthorizationManagementClient ( ) : Promise < AuthorizationManagementClient > {
12
- const config = await authorization . getClientConfig ( ) ;
13
- const token = await authorization . getClientToken ( ) ;
14
- const credentials = new TokenCredentials ( token . token ) ;
15
- // Note: reuse the credentials and/or the client in case your scenario needs
16
- // multiple calls to Azure SDKs.
17
- return new AuthorizationManagementClient ( credentials , config . subscriptionId ) ;
12
+ const config = await authorization . getClientConfig ( ) ;
13
+ const credentials = new DefaultAzureCredential ( ) ;
14
+ // Note: reuse the credentials and/or the client in case your scenario needs
15
+ // multiple calls to Azure SDKs.
16
+ return new AuthorizationManagementClient ( credentials , config . subscriptionId ) ;
18
17
}
19
18
20
19
async function getRoleIdByName ( roleName : string , scope ?: string ) : Promise < string > {
21
- const client = await getAuthorizationManagementClient ( ) ;
22
- const roles = await client . roleDefinitions . list (
23
- scope || "" ,
24
- {
25
- filter : `roleName eq '${ roleName } '` ,
26
- } ,
27
- ) ;
28
- if ( roles . length === 0 ) {
29
- throw new Error ( `role "${ roleName } " not found at scope "${ scope } "` ) ;
30
- }
31
- if ( roles . length > 1 ) {
32
- throw new Error ( `too many roles "${ roleName } " found at scope "${ scope } ". Found: ${ roles . length } ` ) ;
33
- }
34
- const role = roles [ 0 ] ;
35
- return role . id ! ;
20
+ const client = await getAuthorizationManagementClient ( ) ;
21
+ const roles = [ ] ;
22
+ for await ( const role of client . roleDefinitions . list (
23
+ scope || "" ,
24
+ {
25
+ filter : `roleName eq '${ roleName } '` ,
26
+ } ,
27
+ ) ) {
28
+ roles . push ( role ) ;
29
+ }
30
+ if ( roles . length === 0 ) {
31
+ throw new Error ( `role "${ roleName } " not found at scope "${ scope } "` ) ;
32
+ }
33
+ if ( roles . length > 1 ) {
34
+ throw new Error ( `too many roles "${ roleName } " found at scope "${ scope } ". Found: ${ roles . length } ` ) ;
35
+ }
36
+ const role = roles [ 0 ] ;
37
+ return role . id ! ;
36
38
}
37
39
38
40
const resourceGroup = new resources . ResourceGroup ( "registryrg" ) ;
39
41
40
42
const registry = new containerregistry . Registry ( "registry" , {
41
- resourceGroupName : resourceGroup . name ,
42
- sku : {
43
- name : "Basic" ,
44
- } ,
45
- adminUserEnabled : true ,
43
+ resourceGroupName : resourceGroup . name ,
44
+ sku : {
45
+ name : "Basic" ,
46
+ } ,
47
+ adminUserEnabled : true ,
46
48
} ) ;
47
49
48
50
const currentServicePrincipalId = pulumi . output ( authorization . getClientConfig ( ) ) . objectId ;
49
51
50
52
const grantPull = new authorization . RoleAssignment ( "access-from-cluster" , {
51
- principalId : currentServicePrincipalId ,
52
- principalType : authorization . PrincipalType . ServicePrincipal , // adjust the type if you are running as a user
53
- roleDefinitionId : getRoleIdByName ( "AcrPull" ) ,
54
- scope : registry . id ,
53
+ principalId : currentServicePrincipalId ,
54
+ principalType : authorization . PrincipalType . ServicePrincipal , // adjust the type if you are running as a user
55
+ roleDefinitionId : getRoleIdByName ( "AcrPull" ) ,
56
+ scope : registry . id ,
55
57
} ) ;
0 commit comments