# WORKAROUND: Multi-step process required until HAS adapts to GitOps objects.
#
# 1. Initialize Service Principal:
#    az ad sp create-for-rbac --name "[my-federated-connection]" --create-password false --query "{CLIENT_ID:appId, TENANT_ID:tenant}" --output table
#
# 2. Create Connection (First Pass):
#    - Comment out 'directoryId', 'applicationId', and 'objectid'.
#    - Run: dtctl apply -f azure_connection_federatedIdentityCredential.yaml
#
# 3. Configure Federated Credential in Azure:
#    - Use the OBJECT_ID from the previous step output.
#    - Run:
#      az ad app federated-credential create --id "<CLIENT_ID>" --parameters "{'name': 'fd-Federated-Credential', 'issuer': 'https://[environment-id].live.dynatrace.com', 'subject': 'dt:connection-id/OBJECT_ID', 'audiences': ['[environment-id].live.dynatrace.com/svc-id/com.dynatrace.da']}"
#
# 4. Finalize Configuration:
#    - Uncomment and fill in 'directoryId', 'applicationId', and 'objectid'.
#    - Run: dtctl apply -f azure_connection_federatedIdentityCredential.yaml
schemaId: builtin:hyperscaler-authentication.connections.azure
scope: environment
# objectid: <PASTE_OBJECT_ID_HERE_FOR_STEP_4>
value:
  # Connection Name (e.g., Subscription Name)
  name: my-federated-connection
  
  # Type: 'federatedIdentityCredential' or 'clientSecret'
  type: federatedIdentityCredential
  
  federatedIdentityCredential:
    # Azure Entra Tenant ID (Uncomment for Step 4)
    # directoryId: "00000000-0000-0000-0000-000000000000"
    
    # Azure Entra Service Principal Application ID (Uncomment for Step 4)
    # applicationId: "00000000-0000-0000-0000-000000000000"

    # Consumer — which Dynatrace integration may use this connection.
    #
    # IMPORTANT: the schema enforces maxObjects=1 — exactly ONE consumer per
    # connection. The FIC subject in step 3 above MUST match the consumer
    # (the 'svc-id/<consumer>' segment of the audience must equal the value
    # below, e.g. svc-id/com.dynatrace.da for SVC:com.dynatrace.da). To wire
    # the same Azure SP into multiple consumers, create one connection per
    # consumer AND add a matching federated credential for each in Azure.
    #
    # Allowed values for federatedIdentityCredential (schema enum
    # ConsumersOfFederatedIdentityCredential) — uncomment exactly one:
    consumers:
      - SVC:com.dynatrace.da                       # Data Acquisition (default)
      # - SVC:com.dynatrace.bo                     # Business Observability
      # - SVC:com.dynatrace.openpipeline           # OpenPipeline
      # - SVC:com.dynatrace.grail                  # Grail
      # - APP:dynatrace.microsoft.azure.connector  # Microsoft Azure Connector app
