Azure Provider

# Azure CLI (recommended for local development)
az login

# Service Principal (for CI/CD)
export AZURE_CLIENT_ID="your-client-id"
export AZURE_CLIENT_SECRET="your-client-secret"
export AZURE_TENANT_ID="your-tenant-id"

# Managed Identity (when running in Azure)
# Credentials are automatically retrieved

# Sync from default subscription
ctrlc sync azure aks

# Sync from a specific subscription
ctrlc sync azure aks --subscription-id 00000000-0000-0000-0000-000000000000

# Continuous sync
ctrlc sync azure aks --interval 5m

identifier: /subscriptions/xxx/resourceGroups/prod-rg/providers/Microsoft.ContainerService/managedClusters/prod-cluster
name: prod-cluster
kind: Azure/AKS
metadata:
  subscription: 00000000-0000-0000-0000-000000000000
  resource_group: prod-rg
  location: eastus
  environment: production  # from Azure tag
  team: platform           # from Azure tag
config:
  fqdn: prod-cluster-xxxxx.hcp.eastus.azmk8s.io
  kubernetes_version: "1.28.3"

# Sync from default subscription
ctrlc sync azure networks

# Sync from a specific subscription
ctrlc sync azure networks --subscription-id 00000000-0000-0000-0000-000000000000

identifier: /subscriptions/xxx/resourceGroups/prod-rg/providers/Microsoft.Network/virtualNetworks/prod-vnet
name: prod-vnet
kind: Azure/VNet
metadata:
  subscription: 00000000-0000-0000-0000-000000000000
  resource_group: prod-rg
  location: eastus
config:
  address_space: ["10.0.0.0/16"]

az container create \
  --resource-group ctrlplane-rg \
  --name ctrlplane-sync \
  --image ghcr.io/ctrlplanedev/cli:latest \
  --command-line "ctrlc sync azure aks --interval 5m" \
  --environment-variables \
    CTRLPLANE_API_KEY=your-api-key \
    CTRLPLANE_WORKSPACE=your-workspace-id \
  --assign-identity

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ctrlplane-azure-sync
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ctrlplane-azure-sync
  template:
    metadata:
      labels:
        app: ctrlplane-azure-sync
        azure.workload.identity/use: "true"
    spec:
      serviceAccountName: ctrlplane-sync
      containers:
        - name: sync
          image: ghcr.io/ctrlplanedev/cli:latest
          command:
            - ctrlc
            - sync
            - azure
            - aks
            - --interval
            - "5m"
          env:
            - name: CTRLPLANE_API_KEY
              valueFrom:
                secretKeyRef:
                  name: ctrlplane-credentials
                  key: api-key
            - name: CTRLPLANE_WORKSPACE
              value: your-workspace-id
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ctrlplane-sync
  annotations:
    azure.workload.identity/client-id: your-client-id

# Assign Reader role at subscription level
az role assignment create \
  --assignee <identity-principal-id> \
  --role "Reader" \
  --scope /subscriptions/<subscription-id>

# Or at resource group level
az role assignment create \
  --assignee <identity-principal-id> \
  --role "Reader" \
  --scope /subscriptions/<subscription-id>/resourceGroups/<resource-group>

# All production AKS clusters
type: Environment
name: Production AKS
resourceSelector: |
  resource.kind == "Azure/AKS" &&
  resource.metadata["environment"] == "production"

# East US resources
type: Environment
name: East US
resourceSelector: |
  resource.metadata["location"] == "eastus"

# Specific resource group
type: Environment
name: Production Resource Group
resourceSelector: |
  resource.metadata["resource_group"] == "prod-rg"

az aks update \
  --resource-group prod-rg \
  --name prod-cluster \
  --tags environment=production team=platform tier=critical

# Production subscription
ctrlc sync azure aks \
  --subscription-id prod-subscription-id \
  --interval 5m &

# Staging subscription
ctrlc sync azure aks \
  --subscription-id staging-subscription-id \
  --interval 5m &