XEnterpriseApp¶
Experimental
This API is experimental and may change without notice.
A single-tenant Entra ID application registration and enterprise service principal with web redirect URIs and an automatically rotated client credential. The credential is written to a Kubernetes connection Secret; consumers should copy it into their own secret store.
API¶
| Property | Value |
|---|---|
| Group | entraid.platform.example.org |
| Kind | XEnterpriseApp |
| Plural | xenterpriseapps |
| Scope | Namespaced |
| Versions | v1alpha1 (referenceable) |
| Source | compositions/apis/entraid/enterpriseapp/schema.yaml |
Spec¶
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
credentialValidity |
string |
no | 1440h |
Validity of each generated client secret. Defaults to 60 days to tolerate a delayed rotation reconciliation. Constraints: pattern: ^[1-9][0-9]*h$. |
name immutable |
string |
yes | — | Display name of the Entra ID application. Constraints: minLength: 1. |
redirectUris |
[]string |
yes | — | OAuth web redirect URIs allowed for the app. Constraints: minItems: 1. |
rotationInterval |
string |
no | 720h |
How often External Secrets changes the password rotation trigger. Defaults to 30 days. Constraints: pattern: ^[1-9][0-9]*h$. |
Fields marked immutable are fixed once the resource is created; changing one is rejected by the API server. An immutable object pins the fields nested under it too. To change one, delete the resource and create it again.
Status¶
Populated by Crossplane once the underlying Azure resources exist. Every
composite in this repository exposes the provisioned Azure resource ID as
status.id.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
clientId |
string |
no | — | Application (client) ID. |
connectionSecretName |
string |
no | — | Kubernetes Secret containing the generated client secret under the value key. |
id |
string |
no | — | Provider ID of the Entra application. |
objectId |
string |
no | — | Object ID of the application registration. |
rotationRevision |
string |
no | — | Non-secret revision that changes whenever credential rotation is triggered. |
servicePrincipalId |
string |
no | — | Object ID of the enterprise service principal. |
Common problems¶
The Application or Principal reports Authorization_RequestDenied.
Cause. The Crossplane service principal lacks the Microsoft Graph application permission Application.ReadWrite.All, or admin consent is missing.
Fix. Re-run the bootstrap script as a Global Administrator or Privileged Role Administrator, or grant Application.ReadWrite.All manually.
The Application, Password, or Principal is never created.
Cause. The corresponding provider-azuread MRD is not activated.
Fix. Add applications.applications.azuread.m.upbound.io, passwords.applications.azuread.m.upbound.io, and principals.serviceprincipals.azuread.m.upbound.io to the managed resource activation policy.
The client credential does not rotate.
Cause. External Secrets is not reconciling the rotation ExternalSecret, or its generated Secret is missing.
Fix. Check the ExternalSecret and Password generator in the XR namespace. A new generator value changes rotateWhenChanged every 720 hours.