Service Bus

Example: azure-service-bus-queue resource based on Azure Service Bus Queue #

Configuration #

This example configures a azure-service-bus-queue Resource Definition using Azure Service Bus, with two different access policies:

• basic-publisher (allowed to send messages)
• basic-consumer (allowed to receive messages)

Those Resource Definitions can be used in your Score file using:

resources:
  ...
  queue:
    type: azure-service-bus-queue
    class: basic-publisher

Infrastructure setup #

The workload service account will automatically be assigned the necessary Azure Role.

graph TD;
    subgraph Resource Group
        subgraph account["Azure Service Bus"]
            queue["Azure Service Bus Queue"]
        end
        k8s-service-account[K8s Service Account] -- azure federated identity --> azure-managed-identity[Azure Managed identity]
        azure-managed-identity -- publisher role --> queue
        subgraph AKS Cluster
            workload-pod[Workload Pod] --> k8s-service-account
            workload-pod -- operations --> queue
        end
    end

Orchestrator setup #

The Resource Graph is using delegator resources to expose shared resources with different access policies.

graph TD;
    workload_1 --> k8s_sa_1["k8s_service_account_1, resource_type: k8s-service-account"]:::policy
    workload_1 --> queue_delegator_1["delegator_1, resource_type: azure-service-bus-queue"]
    queue_delegator_1 --> shared_queue_1["shared.queue_1, resource_type: azure-service-bus-queue"]

    az_fi_1["azure_federated_identity, resource_type: azure-federated-identity"]:::policy --> k8s_sa_1
    az_fi_1 --> az_mi_1["azure_managed_identity, resource_type: azure-managed-identity"]:::policy
    
    az_ra_1["azure_role_assignments, resource_type: azure-role-assignments"]:::policy --> az_mi_1
    az_ra_1 --> az_rd_1["azure_role_definition, resource_type: azure-role-definition"]:::policy
    az_rd_1 -- publisher --> queue_delegator_1

    workload_2 --> p_2["identities & roles setup similar to workload 1"]:::policy
    workload_2 --> queue_delegator_2["delegator_2, resource_type: azure-service-bus-queue"]
    p_2 -- consumer --> queue_delegator_2
    queue_delegator_2 --> shared_queue_1

    classDef policy fill:#f96

Terraform docs #

Requirements #

Providers #

Modules #

Resources #

Inputs #

main.tf (view on GitHub) :

# Service principal used by Humanitec to provision resources
data "azurerm_resource_group" "main" {
  name = var.resource_group_name
}

resource "azuread_application" "humanitec_provisioner" {
  display_name = var.name
}

resource "azuread_service_principal" "humanitec_provisioner" {
  client_id = azuread_application.humanitec_provisioner.client_id
}

resource "azuread_service_principal_password" "humanitec_provisioner" {
  service_principal_id = azuread_service_principal.humanitec_provisioner.object_id
}

resource "azurerm_role_assignment" "resource_group_workload" {
  scope                = data.azurerm_resource_group.main.id
  role_definition_name = "Owner"
  principal_id         = azuread_service_principal.humanitec_provisioner.object_id
}

resource "humanitec_resource_account" "humanitec_provisioner" {
  id   = var.name
  name = var.name
  type = "azure"

  credentials = jsonencode({
    "appId" : azuread_service_principal.humanitec_provisioner.client_id,
    "displayName" : azuread_application.humanitec_provisioner.display_name,
    "password" : azuread_service_principal_password.humanitec_provisioner.value,
    "tenant" : azuread_service_principal.humanitec_provisioner.application_tenant_id
  })

  depends_on = [
    # Otherwise the account looses permissions before the resources are deleted
    azurerm_role_assignment.resource_group_workload
  ]
}

# Example application and resource definition criteria
resource "humanitec_application" "example" {
  id   = var.name
  name = var.name
}

locals {
  # Classes used to build the resource definition graph
  service_bus_basic_class            = "basic"
  service_bus_publisher_policy_class = "service-bus-basic-publisher"
  service_bus_consumer_policy_class  = "service-bus-basic-consumer"

  # Classes that developers can select from
  service_bus_publisher_class = "basic-publisher"
  service_bus_consumer_class  = "basic-consumer"

  service_bus_scope = "/subscriptions/${var.subscription_id}/resourceGroups/${var.resource_group_name}/providers/Microsoft.ServiceBus/namespaces/$${resources['azure-service-bus-queue.${local.service_bus_basic_class}'].outputs.namespace}/queues/$${resources['azure-service-bus-queue.${local.service_bus_basic_class}'].outputs.queue}"

  # Azure build in role ids: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
  build_in_azure_service_bus_data_receiver_role_id = "/providers/Microsoft.Authorization/roleDefinitions/4f6d3b9b-027b-4f4c-9142-0e5a2a2247e0"
  build_in_azure_service_bus_data_sender_role_id   = "/providers/Microsoft.Authorization/roleDefinitions/69a216fc-b8fb-44d8-bc22-1f3c2cd27a39"
}

module "service_bus" {
  source = "github.com/humanitec-architecture/resource-packs-azure//humanitec-resource-defs/azure-service-bus-queue/basic"

  resource_packs_azure_url = var.resource_packs_azure_url
  resource_packs_azure_rev = var.resource_packs_azure_rev
  append_logs_to_error     = true
  driver_account           = humanitec_resource_account.humanitec_provisioner.id
  subscription_id          = var.subscription_id
  resource_group_name      = var.resource_group_name
  prefix                   = var.prefix
  sku                      = var.sku
}

resource "humanitec_resource_definition_criteria" "service_bus" {
  resource_definition_id = module.service_bus.id
  app_id                 = humanitec_application.example.id
  class                  = local.service_bus_basic_class
}

// Publisher shared

// Exposed delegator resource definition
module "service_bus_publisher" {
  source = "github.com/humanitec-architecture/resource-packs-azure//humanitec-resource-defs/azure-service-bus-queue/delegator"

  prefix                     = "${var.prefix}publisher-"
  policy_resource_class      = local.service_bus_publisher_policy_class
  service_bus_resource_class = local.service_bus_basic_class
}

resource "humanitec_resource_definition_criteria" "service_bus_publisher" {
  resource_definition_id = module.service_bus_publisher.id
  app_id                 = humanitec_application.example.id
  class                  = local.service_bus_publisher_class
}

module "role_definition_publisher" {
  source = "github.com/humanitec-architecture/resource-packs-azure//humanitec-resource-defs/azure-role-definition/echo"

  prefix = "${var.prefix}publisher-"

  role_definition_id    = local.build_in_azure_service_bus_data_sender_role_id
  role_definition_scope = local.service_bus_scope
}

resource "humanitec_resource_definition_criteria" "role_definition_publisher" {
  resource_definition_id = module.role_definition_publisher.id
  app_id                 = humanitec_application.example.id
  class                  = local.service_bus_publisher_policy_class
}

// Consumer shared

// Exposed delegator resource definition
module "service_bus_consumer" {
  source = "github.com/humanitec-architecture/resource-packs-azure//humanitec-resource-defs/azure-service-bus-queue/delegator"

  prefix                     = "${var.prefix}consumer-"
  policy_resource_class      = local.service_bus_consumer_policy_class
  service_bus_resource_class = local.service_bus_basic_class
}

resource "humanitec_resource_definition_criteria" "service_bus_consumer" {
  resource_definition_id = module.service_bus_consumer.id
  app_id                 = humanitec_application.example.id
  class                  = local.service_bus_consumer_class
}

module "role_definition_consumer" {
  source = "github.com/humanitec-architecture/resource-packs-azure//humanitec-resource-defs/azure-role-definition/echo"

  prefix = "${var.prefix}consumer-"

  role_definition_id    = local.build_in_azure_service_bus_data_receiver_role_id
  role_definition_scope = local.service_bus_scope
}

resource "humanitec_resource_definition_criteria" "role_definition_consumer" {
  resource_definition_id = module.role_definition_consumer.id
  app_id                 = humanitec_application.example.id
  class                  = local.service_bus_consumer_policy_class
}

// Workload based

module "workload" {
  source = "github.com/humanitec-architecture/resource-packs-azure//humanitec-resource-defs/workload/service-account"

  prefix = var.prefix
}

resource "humanitec_resource_definition_criteria" "workload" {
  resource_definition_id = module.workload.id
  app_id                 = humanitec_application.example.id
}

module "k8s_service_account" {
  source = "github.com/humanitec-architecture/resource-packs-azure//humanitec-resource-defs/k8s/service-account"

  prefix = var.prefix
}

resource "humanitec_resource_definition_criteria" "k8s_service_account" {
  resource_definition_id = module.k8s_service_account.id
  app_id                 = humanitec_application.example.id
}

module "federated_identity" {
  source = "github.com/humanitec-architecture/resource-packs-azure//humanitec-resource-defs/azure-federated-identity/basic"

  resource_packs_azure_url = var.resource_packs_azure_url
  resource_packs_azure_rev = var.resource_packs_azure_rev
  append_logs_to_error     = true
  driver_account           = humanitec_resource_account.humanitec_provisioner.id
  subscription_id          = var.subscription_id

  prefix = var.prefix

  resource_group_name = var.resource_group_name
  audience            = ["api://AzureADTokenExchange"]
  issuer              = var.aks_cluster_issuer_url
  parent_id           = "$${resources.azure-managed-identity.outputs.id}"
  subject             = "system:serviceaccount:$${resources.k8s-namespace.outputs.namespace}:$${resources.k8s-service-account.outputs.name}"
}

resource "humanitec_resource_definition_criteria" "federated_identity" {
  resource_definition_id = module.federated_identity.id
  app_id                 = humanitec_application.example.id
}

module "managed_identity" {
  source = "github.com/humanitec-architecture/resource-packs-azure//humanitec-resource-defs/azure-managed-identity/basic"

  resource_packs_azure_url = var.resource_packs_azure_url
  resource_packs_azure_rev = var.resource_packs_azure_rev
  append_logs_to_error     = true
  driver_account           = humanitec_resource_account.humanitec_provisioner.id
  subscription_id          = var.subscription_id

  prefix              = var.prefix
  resource_group_name = var.resource_group_name
}

resource "humanitec_resource_definition_criteria" "managed_identity" {
  resource_definition_id = module.managed_identity.id
  app_id                 = humanitec_application.example.id
}

module "role_assignment" {
  source = "github.com/humanitec-architecture/resource-packs-azure//humanitec-resource-defs/azure-role-assignments/basic"

  resource_packs_azure_url = var.resource_packs_azure_url
  resource_packs_azure_rev = var.resource_packs_azure_rev
  append_logs_to_error     = true
  driver_account           = humanitec_resource_account.humanitec_provisioner.id
  subscription_id          = var.subscription_id

  prefix              = var.prefix
  role_definition_ids = "$${resources.workload>azure-role-definition.outputs.id}"
  scopes              = "$${resources.workload>azure-role-definition.outputs.scope}"
  principal_id        = "$${resources.azure-managed-identity.outputs.principal_id}"
}

resource "humanitec_resource_definition_criteria" "role_assignment" {
  resource_definition_id = module.role_assignment.id
  app_id                 = humanitec_application.example.id
}

providers.tf (view on GitHub) :

terraform {
  required_providers {
    azuread = {
      source  = "hashicorp/azuread"
      version = "~> 2.47"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.91"
    }
    humanitec = {
      source  = "humanitec/humanitec"
      version = "~> 1.0"
    }
  }

  required_version = ">= 1.3.0"
}

provider "humanitec" {
}

provider "azuread" {
}

provider "azurerm" {
  features {}

  subscription_id = var.subscription_id
}

terraform.tfvars.example (view on GitHub) :

# AKS OIDC Issuer URL
aks_cluster_issuer_url = ""

# Specifies the Name for created example application.
name = "hum-rp-service-bus-example"

# Specifies the prefix used in default name for created resources.
prefix = "hum-rp-service-bus-ex-"

# Specifies the Name of the Resource Group within which created resources will reside.
resource_group_name = ""

# Azure Resource Pack git branch.
resource_packs_azure_rev = "refs/heads/main"

# Azure Resource Pack git url.
resource_packs_azure_url = "https://github.com/humanitec-architecture/resource-packs-azure.git"

# Defines which tier to use.
sku = "Standard"

# The Subscription ID which should be used.
subscription_id = ""

variables.tf (view on GitHub) :

variable "resource_packs_azure_url" {
  description = "Azure Resource Pack git url."
  type        = string
  default     = "https://github.com/humanitec-architecture/resource-packs-azure.git"
}

variable "resource_packs_azure_rev" {
  description = "Azure Resource Pack git branch."
  type        = string
  default     = "refs/heads/main"
}

variable "subscription_id" {
  description = "The Subscription ID which should be used."
  type        = string
}

variable "resource_group_name" {
  description = "Specifies the Name of the Resource Group within which created resources will reside."
  type        = string
}

variable "name" {
  description = "Specifies the Name for created example application."
  type        = string
  default     = "hum-rp-service-bus-example"
}

variable "prefix" {
  description = "Specifies the prefix used in default name for created resources."
  type        = string
  default     = "hum-rp-service-bus-ex-"
}

variable "sku" {
  description = "Defines which tier to use."
  type        = string
  default     = "Standard"
}

variable "aks_cluster_issuer_url" {
  description = "AKS OIDC Issuer URL"
  type        = string
}