DTSPO-19027 installing flux on auto cluster

azure-pipelines.yml

@@ -277,6 +277,22 @@ stages:
         jobs:
           - job: BootStrap
             steps:
+              - script: |
+                  # get kubelogin
+                  if ! kubelogin --version  &> /dev/null
+                  then
+                      wget -q https://github.com/Azure/kubelogin/releases/download/v0.0.9/kubelogin-linux-amd64.zip
+                      unzip kubelogin-linux-amd64.zip &> /dev/null
+                      sudo mv bin/linux_amd64/kubelogin /usr/bin
+                      kubelogin convert-kubeconfig -l azurecli
+                  fi
+                displayName: 'Install kubelogin'
+                condition: eq('${{ component.env }}', 'sbox')
+              - template: pipeline-steps/bootstrap.yaml
+                parameters:
+                  environment: ${{ component.env }}
+                  cluster: ${{ parameters.cluster }}
+                  serviceConnection: ${{ component.serviceConnection }}
               - template: pipeline-steps/bootstrap.yaml
                 parameters:
                   environment: ${{ component.env }}

bootstrap/get-aks-credentials.sh

@@ -10,5 +10,4 @@ echo  "Get aks credentials "
 az aks get-credentials \
     --resource-group "${PROJECT}"-"${ENVIRONMENT}"-"${CLUSTER_NAME}"-rg \
     --name "${PROJECT}"-"${ENVIRONMENT}"-"${CLUSTER_NAME}"-"${SERVICE}" \
-    --admin \
     --overwrite-existing

components/aks/aks.tf

@@ -281,7 +281,7 @@ resource "azapi_resource" "managedCluster" {
           vmSize = "Standard_D4ds_v5"
         },
         {
-          count                  = 0
+          count                  = 2
           enableEncryptionAtHost = false
           enableCustomCATrust    = false
           enableFIPS             = false
@@ -318,3 +318,24 @@ resource "azapi_resource" "managedCluster" {
     }
   })
 }
+
+resource "azapi_resource" "service_operator_credential" {
+
+  count                     = var.cluster_automatic ? 1 : 0
+  schema_validation_enabled = false
+  name                      = "ss-sbox-01-aks"
+  parent_id                 = data.azurerm_user_assigned_identity.aks.id
+  type                      = "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials@2022-01-31-preview"
+  location                  = var.location
+  body = jsonencode({
+    properties = {
+      issuer = "https://uksouth.oic.prod-aks.azure.com/a8140a9e-f1b0-481f-a4de-09e2ee23f7ab/8c44a4cc-f514-43fc-bc82-da3bdd3dfacc"
+
+      subject   = "system:serviceaccount:azureserviceoperator-system:azureserviceoperator-default"
+      audiences = ["api://AzureADTokenExchange"]
+    }
+  })
+  lifecycle {
+    ignore_changes = [location]
+  }
+}