-
Notifications
You must be signed in to change notification settings - Fork 112
/
kube-prep-steps.ps1
53 lines (29 loc) · 1.54 KB
/
kube-prep-steps.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
#### Parameters
$keyvaultname = "xxxxx"
$location = "xxxxx"
$keyvaultrg = "xxxxxx"
$sshkeysecret = "xxxxx"
$spnclientid = "xxxxxx"
$clientidkvsecretname = "xxxxxx"
$spnclientsecret = "xxxxxx"
$spnkvsecretname = "xxxxx"
$spobjectID = "xxxxx"
$userobjectid = "xxxxx"
#### Create Key Vault
New-AzResourceGroup -Name $keyvaultrg -Location $location
New-AzKeyVault -Name $keyvaultname -ResourceGroupName $keyvaultrg -Location $location
Set-AzKeyVaultAccessPolicy -VaultName $keyvaultname -UserPrincipalName $userobjectid -PermissionsToSecrets get,set,delete,list
#### create an ssh key for setting up password-less login between agent nodes.
ssh-keygen -f ~/.ssh/id_rsa_terraform
#### Add SSH Key in Azure Key vault secret
$pubkey = cat ~/.ssh/id_rsa_terraform.pub
$Secret = ConvertTo-SecureString -String $pubkey -AsPlainText -Force
Set-AzKeyVaultSecret -VaultName $keyvaultname -Name $sshkeysecret -SecretValue $Secret
#### Store service principal Client id in Azure KeyVault
$Secret = ConvertTo-SecureString -String $spnclientid -AsPlainText -Force
Set-AzKeyVaultSecret -VaultName $keyvaultname -Name $clientidkvsecretname -SecretValue $Secret
#### Store service principal Secret in Azure KeyVault
$Secret = ConvertTo-SecureString -String $spnclientsecret -AsPlainText -Force
Set-AzKeyVaultSecret -VaultName $keyvaultname -Name $spnkvsecretname -SecretValue $Secret
#### Provide Keyvault secret access to SPN using Keyvault access policy
Set-AzKeyVaultAccessPolicy -VaultName $keyvaultname -ServicePrincipalName $spobjectID -PermissionsToSecrets Get,Set