To use Azure DNS and TLS, permissions must be granted to have cert-manager managing the DNS challenge for the Let’s Encrypt service.

Procedure

  1. Set the variable for the domain:

    AZURE_CERT_MANAGER_DNS_NAME=azr.my-ide.cloud

  2. Generate the secrets:

    AZURE_CERT_MANAGER_SP_APP_ID=$(az ad sp create-for-rbac --name cert-manager-eclipse-che --query "appId" --output tsv)
AZURE_CERT_MANAGER_SP_PASSWORD=$(az ad sp create-for-rbac --name cert-manager-eclipse-che --query "password" --output tsv)

  3. Lower the permissions of the service principal (SP):

    $ az role assignment delete --assignee $AZURE_CERT_MANAGER_SP_APP_ID --role Contributor

  4. Give access to the DNS zone:

    DNS_ID=$(az network dns zone show --name $AZURE_CERT_MANAGER_DNS_NAME --resource-group eclipseCheResourceGroup --query "id" --output tsv)

$ az role assignment create --assignee $AZURE_CERT_MANAGER_SP_APP_ID \
  --role "DNS Zone Contributor" --scope $DNS_ID

  5. Check the permissions:

    $ az role assignment list --assignee $AZURE_CERT_MANAGER_SP_APP_ID

  6. Get the Service Principal App ID and password for the configuration:

    $ echo ID=$AZURE_CERT_MANAGER_SP_APP_ID
$ echo PASSWORD=$AZURE_CERT_MANAGER_SP_PASSWORD