You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| <aname="input_create_hub_service_principal_name"></a> [create\_hub\_service\_principal\_name](#input\_create\_hub\_service\_principal\_name)| name of a separate service principal to create for hub VNet peering (least privilege) |`string`|`null`| no |
53
+
| <aname="input_create_service_principal_name"></a> [create\_service\_principal\_name](#input\_create\_service\_principal\_name)| name of a service principal to create and grant permissions to deploy the building block |`string`|`null`| no |
54
+
| <aname="input_existing_hub_principal_ids"></a> [existing\_hub\_principal\_ids](#input\_existing\_hub\_principal\_ids)| set of existing principal ids that will be granted permissions to peer with the hub VNet |`set(string)`|`[]`| no |
55
+
| <aname="input_existing_principal_ids"></a> [existing\_principal\_ids](#input\_existing\_principal\_ids)| set of existing principal ids that will be granted permissions to deploy the building block |`set(string)`|`[]`| no |
56
+
| <aname="input_hub_scope"></a> [hub\_scope](#input\_hub\_scope)| Scope for hub VNet peering permissions (management group or subscription). Typically a hub subscription, but can be a management group containing hub resources. |`string`| n/a | yes |
57
+
| <aname="input_hub_workload_identity_federation"></a> [hub\_workload\_identity\_federation](#input\_hub\_workload\_identity\_federation)| Configuration for workload identity federation for hub service principal. If not provided, an application password will be created instead. | <pre>object({<br> issuer = string<br> subject = string<br> })</pre> |`null`| no |
35
58
| <aname="input_name"></a> [name](#input\_name)| name of the building block, used for naming resources |`string`|`"aks"`| no |
36
-
| <aname="input_principal_ids"></a> [principal\_ids](#input\_principal\_ids)|set of principal ids that will be granted permissions to deploy the building block |`set(string)`| n/a | yes |
37
-
| <aname="input_scope"></a> [scope](#input\_scope)|Scope where the building block should be deployable, typically the parent of all Landing Zones. |`string`| n/a|yes|
59
+
| <aname="input_scope"></a> [scope](#input\_scope)|Scope where the building block should be deployable (management group or subscription), typically the parent of all Landing Zones. |`string`| n/a | yes |
60
+
| <aname="input_workload_identity_federation"></a> [workload\_identity\_federation](#input\_workload\_identity\_federation)|Configuration for workload identity federation. If not provided, an application password will be created instead. |<pre>object({<br> issuer = string<br> subject = string<br> })</pre>|`null`| no|
38
61
39
62
## Outputs
40
63
41
64
| Name | Description |
42
65
|------|-------------|
66
+
| <aname="output_application_password"></a> [application\_password](#output\_application\_password)| Information about the created application password (excludes the actual password value for security). |
67
+
| <aname="output_created_application"></a> [created\_application](#output\_created\_application)| Information about the created Azure AD application. |
68
+
| <aname="output_created_hub_application"></a> [created\_hub\_application](#output\_created\_hub\_application)| Information about the created hub Azure AD application. |
69
+
| <aname="output_created_hub_service_principal"></a> [created\_hub\_service\_principal](#output\_created\_hub\_service\_principal)| Information about the created hub service principal. |
70
+
| <aname="output_created_service_principal"></a> [created\_service\_principal](#output\_created\_service\_principal)| Information about the created service principal. |
43
71
| <aname="output_documentation_md"></a> [documentation\_md](#output\_documentation\_md)| Markdown documentation with information about the AKS Building Block building block backplane |
44
-
| <aname="output_hub_role_assignment_ids"></a> [hub\_role\_assignment\_ids](#output\_hub\_role\_assignment\_ids)| The IDs of the hub role assignments for the service principals. |
45
-
| <aname="output_hub_role_assignment_principal_ids"></a> [hub\_role\_assignment\_principal\_ids](#output\_hub\_role\_assignment\_principal\_ids)| The principal IDs of the service principals that have been assigned the hub role. |
72
+
| <aname="output_hub_application_password"></a> [hub\_application\_password](#output\_hub\_application\_password)| Information about the created hub application password (excludes the actual password value for security). |
73
+
| <aname="output_hub_role_assignment_ids"></a> [hub\_role\_assignment\_ids](#output\_hub\_role\_assignment\_ids)| The IDs of the hub role assignments for all service principals. |
74
+
| <aname="output_hub_role_assignment_principal_ids"></a> [hub\_role\_assignment\_principal\_ids](#output\_hub\_role\_assignment\_principal\_ids)| The principal IDs of all service principals that have been assigned the hub role. |
46
75
| <aname="output_hub_role_definition_id"></a> [hub\_role\_definition\_id](#output\_hub\_role\_definition\_id)| The ID of the role definition that enables deployment of the building block to the hub. |
47
76
| <aname="output_hub_role_definition_name"></a> [hub\_role\_definition\_name](#output\_hub\_role\_definition\_name)| The name of the role definition that enables deployment of the building block to the hub. |
48
-
| <aname="output_role_assignment_ids"></a> [role\_assignment\_ids](#output\_role\_assignment\_ids)| The IDs of the role assignments for the service principals. |
49
-
| <aname="output_role_assignment_principal_ids"></a> [role\_assignment\_principal\_ids](#output\_role\_assignment\_principal\_ids)| The principal IDs of the service principals that have been assigned the role. |
50
-
| <aname="output_role_definition_id"></a> [role\_definition\_id](#output\_role\_definition\_id)| The ID of the role definition that enables deployment of the building block to subscriptions. |
51
-
| <aname="output_role_definition_name"></a> [role\_definition\_name](#output\_role\_definition\_name)| The name of the role definition that enables deployment of the building block to subscriptions. |
77
+
| <aname="output_hub_scope"></a> [hub\_scope](#output\_hub\_scope)| The scope (management group or subscription) where VNet peering role is applied. |
78
+
| <aname="output_hub_workload_identity_federation"></a> [hub\_workload\_identity\_federation](#output\_hub\_workload\_identity\_federation)| Information about the created hub workload identity federation credential. |
79
+
| <aname="output_provider_tf"></a> [provider\_tf](#output\_provider\_tf)| Ready-to-use provider.tf configuration for buildingblock deployment |
80
+
| <aname="output_role_assignment_ids"></a> [role\_assignment\_ids](#output\_role\_assignment\_ids)| The IDs of the role assignments for all service principals. |
81
+
| <aname="output_role_assignment_principal_ids"></a> [role\_assignment\_principal\_ids](#output\_role\_assignment\_principal\_ids)| The principal IDs of all service principals that have been assigned the role. |
82
+
| <aname="output_role_definition_id"></a> [role\_definition\_id](#output\_role\_definition\_id)| The ID of the role definition that enables deployment of the building block. |
83
+
| <aname="output_role_definition_name"></a> [role\_definition\_name](#output\_role\_definition\_name)| The name of the role definition that enables deployment of the building block. |
52
84
| <aname="output_scope"></a> [scope](#output\_scope)| The scope where the role definition and role assignments are applied. |
85
+
| <aname="output_workload_identity_federation"></a> [workload\_identity\_federation](#output\_workload\_identity\_federation)| Information about the created workload identity federation credential. |
0 commit comments