azure: find zones via serviceDiscovery (or allow multiple values for AZURE_RESOURCE_GROUP)

[mblaschke]

azure: find zones via serviceDiscovery (or allow multiple values for AZURE_RESOURCE_GROUP)

[mblaschke]

Create a certificate with multiple SANs using Azure DNS zones which are in multiple resourceGroups or subscriptions.

As a user i expect that Lego finds the DNS zones automatically in my subscriptions based on the assigned roleAssignments of the serviceprincipal. It should not need a AZURE_SUBSCRIPTION_ID or AZURE_RESOURCE_GROUP but could be possible to filter service discovery.

without AZURE_SUBSCRIPTION_ID and AZURE_RESOURCE_GROUP:
(find all DNS zones in visible scope)

resources
| where type =~ "microsoft.network/dnszones"
| project id, subscriptionId, resourceGroup, name

with only AZURE_SUBSCRIPTION_ID:
(find all DNS zones in one subscription)

resources
| where type =~ "microsoft.network/dnszones"
| where subscriptionId =~ "${AZURE_SUBSCRIPTION_ID}"
| project id, subscriptionId, resourceGroup, name

with AZURE_SUBSCRIPTION_ID and AZURE_RESOURCE_GROUP:
(find all DNS zones in a specific resourcegroup)

resources
| where type =~ "microsoft.network/dnszones"
| where subscriptionId =~ "${AZURE_SUBSCRIPTION_ID}" and resourceGroup =~ "${AZURE_RESOURCE_GROUP}"
| project id, subscriptionId, resourceGroup, name

This would make Azure DNS provider more flexible and easier to use.

I'm willing to create a PR if you are ok with this feature using resourceGraph for service discovery.

[mblaschke]

@pchanvallon

implemented a first working preview (tested only with public zones)

as another idea we can also implement an AZURE_SERVICEDISCOVERY_FILTER env var for additional filtering, eg:

resources
| where type =~ "microsoft.network/dnszones"
| where subscriptionId =~ "${AZURE_SUBSCRIPTION_ID}" and resourceGroup =~ "${AZURE_RESOURCE_GROUP}"
| ${AZURE_SERVICEDISCOVERY_FILTER}
| project id, subscriptionId, resourceGroup, name

this could allow validating zones eg. by resourcegroup tags via Kusto subquery

[ldez]

@pchanvallon do you have any thoughts on this issue?

[pchanvallon]

Hello @mblaschke ,

I am a bit confused about the underlying use-case.
Can you explain a bit more what you attend to do with this new feature ?