__main__.py

"""A program to demonstrate accessing Azure Python SDK"""

from azure.core.credentials import AccessToken
from azure.mgmt.authorization import AuthorizationManagementClient
from pulumi_azure_native import authorization, containerregistry, resources


class TokenCred:
    def __init__(self, token):
        self.token = token

    def get_token(self, *scopes, **kwargs) -> "AccessToken":
        return AccessToken(token=self.token, expires_on=-1)


def get_role_id_by_name(name, scope=""):
    config = authorization.get_client_config()
    client_token = authorization.get_client_token()
    client = AuthorizationManagementClient(TokenCred(client_token.token), config.subscription_id)
    def_pages = client.role_definitions.list(scope, filter=f"roleName eq '{name}'")
    role = None
    for x in def_pages:
        role = x.id
        break
    if role is None:
        raise Exception(f"role '{name}' not found at scope '{scope}'")
    return role


# Create an Azure Resource Group
resource_group = resources.ResourceGroup("resource_group")

# Create a container registry
container_registry = containerregistry.Registry(
    "registry",
    resource_group_name=resource_group.name,
    sku=containerregistry.SkuArgs(name="Basic"),
    admin_user_enabled=True,
)

client_config = authorization.get_client_config()
current_principal = client_config.object_id

roledef = get_role_id_by_name("AcrPull")

authorization.RoleAssignment(
    "access-from-cluster",
    principal_id=current_principal,
    # adjust this if running as user
    principal_type=authorization.PrincipalType.SERVICE_PRINCIPAL,
    role_definition_id=roledef,
    scope=container_registry.id,
)