fix: Add perms for ingress to update the public subnet as well (#28)

wandb · Oct 4, 2023 · 959c50f · 959c50f
1 parent f790dd9
commit 959c50f
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 0 deletions.
diff --git a/main.tf b/main.tf
@@ -67,6 +67,7 @@ module "app_aks" {
   location       = azurerm_resource_group.default.location
 
   gateway           = module.app_lb.gateway
+  public_subnet     = module.networking.public_subnet
   cluster_subnet_id = module.networking.private_subnet.id
 
   tags = var.tags

diff --git a/modules/app_aks/main.tf b/modules/app_aks/main.tf
@@ -56,3 +56,9 @@ resource "azurerm_role_assignment" "resource_group" {
   role_definition_name = "Reader"
   principal_id         = local.ingress_gateway_principal_id
 }
+
+resource "azurerm_role_assignment" "gateway" {
+  scope                = var.public_subnet.id
+  role_definition_name = "Contributor"
+  principal_id         = local.ingress_gateway_principal_id
+}
diff --git a/modules/app_aks/variables.tf b/modules/app_aks/variables.tf
@@ -22,6 +22,10 @@ variable "gateway" {
   type = object({ id = string })
 }
 
+variable "public_subnet" {
+  type = object({ id = string })
+}
+
 variable "tags" {
   default     = {}
   type        = map(string)