diff --git a/Home/aks-azure-key-vault-csi.md.save b/Home/aks-azure-key-vault-csi.md.save new file mode 100644 index 0000000000..062893762e --- /dev/null +++ b/Home/aks-azure-key-vault-csi.md.save @@ -0,0 +1,357 @@ +--- +title: "Azure Key Vault AKS integration with CSI Driver" +date: "2023-03-08" +thumbnail: "img/aks2.webp" +disable_myintraments: false # Optional, disable Disqus myintraments if true +authorbox: true # Optional, enable authorbox for specific post +toc: true # Optional, enable Table of Contents for specific post +mathjax: true # Optional, enable MathJax for specific post +tags: + - "Azure" + - "AKS" + - "Kubernetes" + - "K8S" +draft: false +coffeebox: yes +keywords: + - "Azure" + - "AKS" + - "streaming" +--- + + +In this Post I will show you how you can use CSI Driver to mount secrets from Azure Key Vault to AKS. + + +## Create key vault and add keys + +First we need to create a key vault + +```bash +az aks enable-addons \ +--addons=azure-keyvault-secrets-provider \ +--name=$CLUSTER \ +--resource-group=$RG + +# create the key vault and turn on Azure RBAC; we will grant a managed identity access to this key vault below +az keyvault create \ +--name $KV \ +--resource-group $RG \ +--location westeurope \ +--enable-rbac-authorization true + +# get the subscription id +SUBSCRIPTION_ID=$(az account show --query id -o tsv) + +# get your user object id +USER_OBJECT_ID=$(az ad signed-in-user show --query objectId -o tsv) + +# grant yourself access to key vault +az role assignment create \ +--assignee-object-id $USER_OBJECT_ID \ +--role "Key Vault Administrator" \ +--scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RG/providers/Microsoft.KeyVault/vaults/$KV + +# add a secret to the key vault +az keyvault secret set --vault-name $KV --name $SECRET --value $VALUE +``` + +Create secret in keyvault: + +```bash +az keyvault secret set \ +--vault-name "$KV" \ +--name "sqldatabase" \ +--value 'kvdemo' + +az keyvault secret set \ +--vault-name "$KV" \ +--name "sqlusername" \ +--value 'root' + +az keyvault secret set \ +--vault-name "$KV" \ +--name "sqlpassword" \ +--value 'Password1' +``` + +## Acces key vault with AKS's managed identity + +If you created your AKS cluster with managed identity you need to grant access to a managed identity: + +```bash +# grab the managed identity principalId assuming it is in the default +# MC_ group for your cluster and resource group +IDENTITY_ID=$(az identity show -g MC\_$RG\_$CLUSTER\_westeurope --name azurekeyvaultsecretsprovider-$CLUSTER --query principalId -o tsv) + +# grant access rights on Key Vault +az role assignment create \ +--assignee-object-id $IDENTITY_ID \ +--role "Key Vault Administrator" \ +--scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RG/providers/Microsoft.KeyVault/vaults/$KV +``` + +Create a SecretProviderClass: + +```bash +AZURE_TENANT_ID=$(az account show --query tenantId -o tsv) +CLIENT_ID=$(az aks show -g $RG -n $CLUSTER --query addonProfiles.azureKeyvaultSecretsProvider.identity.clientId -o tsv) +``` + +```yaml +cat < - 2024-10-14T13:44:33+00:00 + 2024-10-18T14:22:41+00:00 diff --git a/cloud/aks-azure-key-vault-csi.md.save b/cloud/aks-azure-key-vault-csi.md.save new file mode 100644 index 0000000000..062893762e --- /dev/null +++ b/cloud/aks-azure-key-vault-csi.md.save @@ -0,0 +1,357 @@ +--- +title: "Azure Key Vault AKS integration with CSI Driver" +date: "2023-03-08" +thumbnail: "img/aks2.webp" +disable_myintraments: false # Optional, disable Disqus myintraments if true +authorbox: true # Optional, enable authorbox for specific post +toc: true # Optional, enable Table of Contents for specific post +mathjax: true # Optional, enable MathJax for specific post +tags: + - "Azure" + - "AKS" + - "Kubernetes" + - "K8S" +draft: false +coffeebox: yes +keywords: + - "Azure" + - "AKS" + - "streaming" +--- + + +In this Post I will show you how you can use CSI Driver to mount secrets from Azure Key Vault to AKS. + + +## Create key vault and add keys + +First we need to create a key vault + +```bash +az aks enable-addons \ +--addons=azure-keyvault-secrets-provider \ +--name=$CLUSTER \ +--resource-group=$RG + +# create the key vault and turn on Azure RBAC; we will grant a managed identity access to this key vault below +az keyvault create \ +--name $KV \ +--resource-group $RG \ +--location westeurope \ +--enable-rbac-authorization true + +# get the subscription id +SUBSCRIPTION_ID=$(az account show --query id -o tsv) + +# get your user object id +USER_OBJECT_ID=$(az ad signed-in-user show --query objectId -o tsv) + +# grant yourself access to key vault +az role assignment create \ +--assignee-object-id $USER_OBJECT_ID \ +--role "Key Vault Administrator" \ +--scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RG/providers/Microsoft.KeyVault/vaults/$KV + +# add a secret to the key vault +az keyvault secret set --vault-name $KV --name $SECRET --value $VALUE +``` + +Create secret in keyvault: + +```bash +az keyvault secret set \ +--vault-name "$KV" \ +--name "sqldatabase" \ +--value 'kvdemo' + +az keyvault secret set \ +--vault-name "$KV" \ +--name "sqlusername" \ +--value 'root' + +az keyvault secret set \ +--vault-name "$KV" \ +--name "sqlpassword" \ +--value 'Password1' +``` + +## Acces key vault with AKS's managed identity + +If you created your AKS cluster with managed identity you need to grant access to a managed identity: + +```bash +# grab the managed identity principalId assuming it is in the default +# MC_ group for your cluster and resource group +IDENTITY_ID=$(az identity show -g MC\_$RG\_$CLUSTER\_westeurope --name azurekeyvaultsecretsprovider-$CLUSTER --query principalId -o tsv) + +# grant access rights on Key Vault +az role assignment create \ +--assignee-object-id $IDENTITY_ID \ +--role "Key Vault Administrator" \ +--scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RG/providers/Microsoft.KeyVault/vaults/$KV +``` + +Create a SecretProviderClass: + +```bash +AZURE_TENANT_ID=$(az account show --query tenantId -o tsv) +CLIENT_ID=$(az aks show -g $RG -n $CLUSTER --query addonProfiles.azureKeyvaultSecretsProvider.identity.clientId -o tsv) +``` + +```yaml +cat <Azure Key Vault AKS integration with CSI Driver @@ -254,8 +255,8 @@

Create key vault and add keys

--vault-name "$KV" \ --name "sqlpassword" \ --value 'Password1' -

Acces key vault with managed identity

-

If you created your AKS cluster with managed identity you need to grant access to a managed identity:

+

Acces key vault with system-assigned managed identity

+

If you created your AKS cluster with managed identity you can go to grant access to a managed identity:

# grab the managed identity principalId assuming it is in the default
 # MC_ group for your cluster and resource group
 IDENTITY_ID=$(az identity show -g MC\_$RG\_$CLUSTER\_westeurope --name azurekeyvaultsecretsprovider-$CLUSTER --query principalId -o tsv)
@@ -265,6 +266,11 @@ 
Create key vault and add keys

 --assignee-object-id $IDENTITY_ID \
 --role "Key Vault Administrator" \
 --scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RG/providers/Microsoft.KeyVault/vaults/$KV
+

If not yet enabled you need to enable system-assigned managed identity on AKS:

+
az aks update \
+--resource-group $RG \
+--name  $CLUSTER \
+--enable-managed-identity

Create a SecretProviderClass:

AZURE_TENANT_ID=$(az account show --query tenantId -o tsv)
 CLIENT_ID=$(az aks show -g $RG -n $CLUSTER --query addonProfiles.azureKeyvaultSecretsProvider.identity.clientId -o tsv)
@@ -316,6 +322,7 @@ 
Create key vault and add keys

   labels:
     app: secretpods
   name: secretpods
+  namespace: default
 spec:
   replicas: 1
   selector:
@@ -367,7 +374,7 @@ 
Create key vault and add keys

 --name http://secrets-store-test --query 'password' -otsv)
 
 export CLIENT_ID=$(az ad sp show --id http://secrets-store-test --query 'appId' -otsv)
-

Provide the identity to access the Azure key vault

+

Provide policy to the identity to access the Azure key vault

az keyvault set-policy -n $KV --secret-permissions get --spn $CLIENT_ID

Create the Kubernetes secret with credentials

cat <<EOF | kubectl apply -f -
@@ -429,6 +436,7 @@ 
Create key vault and add keys

   labels:
     app: secretpods
   name: secretpods
+  namespace: default
 spec:
   replicas: 1
   selector:
@@ -476,9 +484,146 @@ 
Create key vault and add keys

             nodePublishSecretRef:
               name: secrets-store-creds
 EOF
+

Acces key vault with federated workload identity

+

https://medium.com/@er.singh.nitin/integrate-azure-keyvault-with-aks-using-workload-identity-51e92d0e5063

+

This scanario is similar to the previous one, but instead of using managed identities we use the AKS cluster’s workload identity to authenticate. In normal situation the identity is autenticates with a password. Password authentication is not the safest option. Instad we will use a federation to authenticate with OIDC SSO authentication.

+

Enable OIDC issuer and Workload identity in an existing AKS cluster.

+
az aks update \
+--resource-group $RG \
+--name  $CLUSTER \
+--enable-oidc-issuer \
+--enable-workload-identity
+

Create a managed identity:

+
az identity create \
+--name secrets-store-test \
+--resource-group $RG \
+--location $RG_LOCATION \
+--subscription $SUBSCRIPTION
+

Get the OIDC issuer url and export it as an environment variable.

+
export AKS_OIDC_ISSUER=$(az aks show --name $CLUSTER --resource-group $RG --query "oidcIssuerProfile.issuerUrl" -o tsv)
+

Export managed identity variable. We will assign this to the AKS service account.

+
export USER_ASSIGNED_CLIENT_ID=$(az identity show --resource-group $RG --name secrets-store-test --query 'clientId' -otsv)
+export IDENTITY_TENANT=$(az aks show --name $CLUSTER --resource-group $RG)
+

Create AKS service account and we will assign the Managed Identity ClientID to it using azure.workload.identity/client-id annotation.

+
az aks get-credentials -n $CLUSTER -g $RG
+
+cat <<EOF | kubectl apply -f -
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations:
+    azure.workload.identity/client-id: ${USER_ASSIGNED_CLIENT_ID}
+  labels:
+    azure.workload.identity/use: "true"
+  name: keyvault-sa
+  namespace: default
+EOF
+

Create the federated identity credential between the managed identity, service account issuer and subject.

+
export FEDERATED_IDENTITY_NAME="aksfederatedidentity" # can be changed as needed
+az identity federated-credential create \
+--name $FEDERATED_IDENTITY_NAME \
+--identity-name secrets-store-test \
+--resource-group $RG \
+--issuer ${AKS_OIDC_ISSUER} \
+--subject system:serviceaccount:default:keyvault-sa
+

Provide policy to the identity to access the Azure key vault

+
az keyvault set-policy -n $KV --secret-permissions get --spn $USER_ASSIGNED_CLIENT_ID
+

Create a SecretProviderClass:

+
AZURE_TENANT_ID=$(az account show --query tenantId -o tsv)
+
cat <<EOF | kubectl apply -f -
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: demo-secret
+  namespace: default
+spec:
+  provider: azure
+  parameters:
+    # use managed identity
+    useVMManagedIdentity: "false"
+    clientID: "$USER_ASSIGNED_CLIENT_ID"
+    tenantId: "$AZURE_TENANT_ID"
+    keyvaultName: "$KV"
+    # name and type in keyvault
+    objects: |
+      array:
+        - |
+          objectName: "sqldatabase"
+          objectType: secret
+        - |
+          objectName: "sqlusername"
+          objectType: secret
+        - |
+          objectName: "sqlpassword"
+          objectType: secret      
+  secretObjects:
+  - secretName: databasesecrets
+    type: Opaque
+    # name and key in secret
+    data:
+    - objectName: "sqldatabase"
+      key: sqldatabase
+    - objectName: "sqlusername"
+      key: sqlusername
+    - objectName: "sqlpassword"
+      key: sqlpassword
+EOF
+
cat <<EOF | kubectl apply -f -
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: secretpods
+  name: secretpods
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: secretpods
+  template:
+    metadata:
+      labels:
+        app: secretpods
+    spec:
+      serviceAccountName: keyvault-sa
+      containers:
+      - image: nginx
+        name: nginx
+        # get as environment variables
+        env:
+          - name:  sqldatabase
+            valueFrom:
+              secretKeyRef:
+                name:  databasesecrets
+                key:  sqldatabase
+          - name:  sqlusername
+            valueFrom:
+              secretKeyRef:
+                name:  databasesecrets
+                key:  sqlusername
+          - name:  sqlpassword
+            valueFrom:
+              secretKeyRef:
+                name:  databasesecrets
+                key:  sqlpassword
+        # mount as file
+        volumeMounts:
+          - name:  secret-store
+            mountPath:  "mnt/secret-store"
+            readOnly: true
+      # get the SecretProviderClass object
+      volumes:
+        - name:  secret-store
+          csi:
+            driver: secrets-store.csi.k8s.io
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: "demo-secret"
+EOF

Demo time

Now we you can werify the secret in the pod:

-
export POD_NAME=$(kubectl get pods -l "app=secretpods" -o jsonpath="{.items[0].metadata.name}")
+
export POD_NAME=$(kubectl get pods -n default -l "app=secretpods" -o jsonpath="{.items[0].metadata.name}")
  
 # if this does not work, check the status of the pod
 # if still in ContainerCreating there might be an issue
diff --git a/cloud/atom.xml b/cloud/atom.xml
index f2f191c1a0..269372a37e 100644
--- a/cloud/atom.xml
+++ b/cloud/atom.xml
@@ -9,7 +9,7 @@
             
             
             
-    2024-10-14T13:44:33+00:00
+    2024-10-18T14:22:41+00:00
     
     
     
diff --git a/devops/atom.xml b/devops/atom.xml
index 690869c342..d3a9f1f0b8 100644
--- a/devops/atom.xml
+++ b/devops/atom.xml
@@ -9,7 +9,7 @@
             
             
             
-    2024-10-14T13:44:33+00:00
+    2024-10-18T14:22:41+00:00
     
     
     
diff --git a/home/aks-azure-key-vault-csi/index.html b/home/aks-azure-key-vault-csi/index.html
index 1ab761284b..60af9c35a9 100644
--- a/home/aks-azure-key-vault-csi/index.html
+++ b/home/aks-azure-key-vault-csi/index.html
@@ -29,7 +29,7 @@
     "datePublished": "2023-03-08",
     "dateModified" : "2023-03-08",
     "url" : "https://devopstales.github.io/home/aks-azure-key-vault-csi/",
-    "wordCount" : "856",
+    "wordCount" : "1357",
     "keywords" : [ "devops", "tales", "Azure", "AKS", "streaming", "Blog" ]
     
 }
@@ -203,8 +203,9 @@ 
Azure Key Vault AKS integration with CSI Driver

 		
@@ -254,8 +255,8 @@ 
Create key vault and add keys

 --vault-name "$KV" \
 --name "sqlpassword" \
 --value 'Password1'
-
Acces key vault with managed identity

-
If you created your AKS cluster with managed identity you need to grant access to a managed identity:

+

Acces key vault with system-assigned managed identity

+

If you created your AKS cluster with managed identity you can go to grant access to a managed identity:

# grab the managed identity principalId assuming it is in the default
 # MC_ group for your cluster and resource group
 IDENTITY_ID=$(az identity show -g MC\_$RG\_$CLUSTER\_westeurope --name azurekeyvaultsecretsprovider-$CLUSTER --query principalId -o tsv)
@@ -265,6 +266,11 @@ 
Create key vault and add keys

 --assignee-object-id $IDENTITY_ID \
 --role "Key Vault Administrator" \
 --scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RG/providers/Microsoft.KeyVault/vaults/$KV
+

If not yet enabled you need to enable system-assigned managed identity on AKS:

+
az aks update \
+--resource-group $RG \
+--name  $CLUSTER \
+--enable-managed-identity

Create a SecretProviderClass:

AZURE_TENANT_ID=$(az account show --query tenantId -o tsv)
 CLIENT_ID=$(az aks show -g $RG -n $CLUSTER --query addonProfiles.azureKeyvaultSecretsProvider.identity.clientId -o tsv)
@@ -316,6 +322,7 @@ 
Create key vault and add keys

   labels:
     app: secretpods
   name: secretpods
+  namespace: default
 spec:
   replicas: 1
   selector:
@@ -367,7 +374,7 @@ 
Create key vault and add keys

 --name http://secrets-store-test --query 'password' -otsv)
 
 export CLIENT_ID=$(az ad sp show --id http://secrets-store-test --query 'appId' -otsv)
-

Provide the identity to access the Azure key vault

+

Provide policy to the identity to access the Azure key vault

az keyvault set-policy -n $KV --secret-permissions get --spn $CLIENT_ID

Create the Kubernetes secret with credentials

cat <<EOF | kubectl apply -f -
@@ -429,6 +436,7 @@ 
Create key vault and add keys

   labels:
     app: secretpods
   name: secretpods
+  namespace: default
 spec:
   replicas: 1
   selector:
@@ -476,9 +484,146 @@ 
Create key vault and add keys

             nodePublishSecretRef:
               name: secrets-store-creds
 EOF
+

Acces key vault with federated workload identity

+

https://medium.com/@er.singh.nitin/integrate-azure-keyvault-with-aks-using-workload-identity-51e92d0e5063

+

This scanario is similar to the previous one, but instead of using managed identities we use the AKS cluster’s workload identity to authenticate. In normal situation the identity is autenticates with a password. Password authentication is not the safest option. Instad we will use a federation to authenticate with OIDC SSO authentication.

+

Enable OIDC issuer and Workload identity in an existing AKS cluster.

+
az aks update \
+--resource-group $RG \
+--name  $CLUSTER \
+--enable-oidc-issuer \
+--enable-workload-identity
+

Create a managed identity:

+
az identity create \
+--name secrets-store-test \
+--resource-group $RG \
+--location $RG_LOCATION \
+--subscription $SUBSCRIPTION
+

Get the OIDC issuer url and export it as an environment variable.

+
export AKS_OIDC_ISSUER=$(az aks show --name $CLUSTER --resource-group $RG --query "oidcIssuerProfile.issuerUrl" -o tsv)
+

Export managed identity variable. We will assign this to the AKS service account.

+
export USER_ASSIGNED_CLIENT_ID=$(az identity show --resource-group $RG --name secrets-store-test --query 'clientId' -otsv)
+export IDENTITY_TENANT=$(az aks show --name $CLUSTER --resource-group $RG)
+

Create AKS service account and we will assign the Managed Identity ClientID to it using azure.workload.identity/client-id annotation.

+
az aks get-credentials -n $CLUSTER -g $RG
+
+cat <<EOF | kubectl apply -f -
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations:
+    azure.workload.identity/client-id: ${USER_ASSIGNED_CLIENT_ID}
+  labels:
+    azure.workload.identity/use: "true"
+  name: keyvault-sa
+  namespace: default
+EOF
+

Create the federated identity credential between the managed identity, service account issuer and subject.

+
export FEDERATED_IDENTITY_NAME="aksfederatedidentity" # can be changed as needed
+az identity federated-credential create \
+--name $FEDERATED_IDENTITY_NAME \
+--identity-name secrets-store-test \
+--resource-group $RG \
+--issuer ${AKS_OIDC_ISSUER} \
+--subject system:serviceaccount:default:keyvault-sa
+

Provide policy to the identity to access the Azure key vault

+
az keyvault set-policy -n $KV --secret-permissions get --spn $USER_ASSIGNED_CLIENT_ID
+

Create a SecretProviderClass:

+
AZURE_TENANT_ID=$(az account show --query tenantId -o tsv)
+
cat <<EOF | kubectl apply -f -
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: demo-secret
+  namespace: default
+spec:
+  provider: azure
+  parameters:
+    # use managed identity
+    useVMManagedIdentity: "false"
+    clientID: "$USER_ASSIGNED_CLIENT_ID"
+    tenantId: "$AZURE_TENANT_ID"
+    keyvaultName: "$KV"
+    # name and type in keyvault
+    objects: |
+      array:
+        - |
+          objectName: "sqldatabase"
+          objectType: secret
+        - |
+          objectName: "sqlusername"
+          objectType: secret
+        - |
+          objectName: "sqlpassword"
+          objectType: secret      
+  secretObjects:
+  - secretName: databasesecrets
+    type: Opaque
+    # name and key in secret
+    data:
+    - objectName: "sqldatabase"
+      key: sqldatabase
+    - objectName: "sqlusername"
+      key: sqlusername
+    - objectName: "sqlpassword"
+      key: sqlpassword
+EOF
+
cat <<EOF | kubectl apply -f -
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: secretpods
+  name: secretpods
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: secretpods
+  template:
+    metadata:
+      labels:
+        app: secretpods
+    spec:
+      serviceAccountName: keyvault-sa
+      containers:
+      - image: nginx
+        name: nginx
+        # get as environment variables
+        env:
+          - name:  sqldatabase
+            valueFrom:
+              secretKeyRef:
+                name:  databasesecrets
+                key:  sqldatabase
+          - name:  sqlusername
+            valueFrom:
+              secretKeyRef:
+                name:  databasesecrets
+                key:  sqlusername
+          - name:  sqlpassword
+            valueFrom:
+              secretKeyRef:
+                name:  databasesecrets
+                key:  sqlpassword
+        # mount as file
+        volumeMounts:
+          - name:  secret-store
+            mountPath:  "mnt/secret-store"
+            readOnly: true
+      # get the SecretProviderClass object
+      volumes:
+        - name:  secret-store
+          csi:
+            driver: secrets-store.csi.k8s.io
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: "demo-secret"
+EOF

Demo time

Now we you can werify the secret in the pod:

-
export POD_NAME=$(kubectl get pods -l "app=secretpods" -o jsonpath="{.items[0].metadata.name}")
+
export POD_NAME=$(kubectl get pods -n default -l "app=secretpods" -o jsonpath="{.items[0].metadata.name}")
  
 # if this does not work, check the status of the pod
 # if still in ContainerCreating there might be an issue
diff --git a/home/atom.xml b/home/atom.xml
index 7d0ddbac2e..3f5f27c424 100644
--- a/home/atom.xml
+++ b/home/atom.xml
@@ -9,7 +9,7 @@
             
             
             
-    2024-10-14T13:44:33+00:00
+    2024-10-18T14:22:41+00:00
     
     
     
@@ -7437,8 +7437,8 @@ az keyvault secret set \
 --vault-name "$KV" \
 --name "sqlpassword" \
 --value 'Password1'
-
Acces key vault with managed identity

-
If you created your AKS cluster with managed identity you need to grant access to a managed identity:

+

Acces key vault with system-assigned managed identity

+

If you created your AKS cluster with managed identity you can go to grant access to a managed identity:

# grab the managed identity principalId assuming it is in the default
 # MC_ group for your cluster and resource group
 IDENTITY_ID=$(az identity show -g MC\_$RG\_$CLUSTER\_westeurope --name azurekeyvaultsecretsprovider-$CLUSTER --query principalId -o tsv)
@@ -7448,6 +7448,11 @@ az role assignment create \
 --assignee-object-id $IDENTITY_ID \
 --role "Key Vault Administrator" \
 --scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RG/providers/Microsoft.KeyVault/vaults/$KV
+

If not yet enabled you need to enable system-assigned managed identity on AKS:

+
az aks update \
+--resource-group $RG \
+--name  $CLUSTER \
+--enable-managed-identity

Create a SecretProviderClass:

AZURE_TENANT_ID=$(az account show --query tenantId -o tsv)
 CLIENT_ID=$(az aks show -g $RG -n $CLUSTER --query addonProfiles.azureKeyvaultSecretsProvider.identity.clientId -o tsv)
@@ -7499,6 +7504,7 @@ CLIENT_ID=$(labels:
     app: secretpods
   name: secretpods
+  namespace: default
 spec:
   replicas: 1
   selector:
@@ -7550,7 +7556,7 @@ CLIENT_ID=$(--name http://secrets-store-test --query 'password' -otsv)
 
 export CLIENT_ID=$(az ad sp show --id http://secrets-store-test --query 'appId' -otsv)
-

Provide the identity to access the Azure key vault

+

Provide policy to the identity to access the Azure key vault

az keyvault set-policy -n $KV --secret-permissions get --spn $CLIENT_ID

Create the Kubernetes secret with credentials

cat <<EOF | kubectl apply -f -
@@ -7612,6 +7618,7 @@ export CLIENT_ID=
   labels:
     app: secretpods
   name: secretpods
+  namespace: default
 spec:
   replicas: 1
   selector:
@@ -7659,9 +7666,146 @@ export CLIENT_ID=
             nodePublishSecretRef:
               name: secrets-store-creds
 EOF
+

Acces key vault with federated workload identity

+

https://medium.com/@er.singh.nitin/integrate-azure-keyvault-with-aks-using-workload-identity-51e92d0e5063

+

This scanario is similar to the previous one, but instead of using managed identities we use the AKS cluster’s workload identity to authenticate. In normal situation the identity is autenticates with a password. Password authentication is not the safest option. Instad we will use a federation to authenticate with OIDC SSO authentication.

+

Enable OIDC issuer and Workload identity in an existing AKS cluster.

+
az aks update \
+--resource-group $RG \
+--name  $CLUSTER \
+--enable-oidc-issuer \
+--enable-workload-identity
+

Create a managed identity:

+
az identity create \
+--name secrets-store-test \
+--resource-group $RG \
+--location $RG_LOCATION \
+--subscription $SUBSCRIPTION
+

Get the OIDC issuer url and export it as an environment variable.

+
export AKS_OIDC_ISSUER=$(az aks show --name $CLUSTER --resource-group $RG --query "oidcIssuerProfile.issuerUrl" -o tsv)
+

Export managed identity variable. We will assign this to the AKS service account.

+
export USER_ASSIGNED_CLIENT_ID=$(az identity show --resource-group $RG --name secrets-store-test --query 'clientId' -otsv)
+export IDENTITY_TENANT=$(az aks show --name $CLUSTER --resource-group $RG)
+

Create AKS service account and we will assign the Managed Identity ClientID to it using azure.workload.identity/client-id annotation.

+
az aks get-credentials -n $CLUSTER -g $RG
+
+cat <<EOF | kubectl apply -f -
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations:
+    azure.workload.identity/client-id: ${USER_ASSIGNED_CLIENT_ID}
+  labels:
+    azure.workload.identity/use: "true"
+  name: keyvault-sa
+  namespace: default
+EOF
+

Create the federated identity credential between the managed identity, service account issuer and subject.

+
export FEDERATED_IDENTITY_NAME="aksfederatedidentity" # can be changed as needed
+az identity federated-credential create \
+--name $FEDERATED_IDENTITY_NAME \
+--identity-name secrets-store-test \
+--resource-group $RG \
+--issuer ${AKS_OIDC_ISSUER} \
+--subject system:serviceaccount:default:keyvault-sa
+

Provide policy to the identity to access the Azure key vault

+
az keyvault set-policy -n $KV --secret-permissions get --spn $USER_ASSIGNED_CLIENT_ID
+

Create a SecretProviderClass:

+
AZURE_TENANT_ID=$(az account show --query tenantId -o tsv)
+
cat <<EOF | kubectl apply -f -
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: demo-secret
+  namespace: default
+spec:
+  provider: azure
+  parameters:
+    # use managed identity
+    useVMManagedIdentity: "false"
+    clientID: "$USER_ASSIGNED_CLIENT_ID"
+    tenantId: "$AZURE_TENANT_ID"
+    keyvaultName: "$KV"
+    # name and type in keyvault
+    objects: |
+      array:
+        - |
+          objectName: "sqldatabase"
+          objectType: secret
+        - |
+          objectName: "sqlusername"
+          objectType: secret
+        - |
+          objectName: "sqlpassword"
+          objectType: secret      
+  secretObjects:
+  - secretName: databasesecrets
+    type: Opaque
+    # name and key in secret
+    data:
+    - objectName: "sqldatabase"
+      key: sqldatabase
+    - objectName: "sqlusername"
+      key: sqlusername
+    - objectName: "sqlpassword"
+      key: sqlpassword
+EOF
+
cat <<EOF | kubectl apply -f -
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: secretpods
+  name: secretpods
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: secretpods
+  template:
+    metadata:
+      labels:
+        app: secretpods
+    spec:
+      serviceAccountName: keyvault-sa
+      containers:
+      - image: nginx
+        name: nginx
+        # get as environment variables
+        env:
+          - name:  sqldatabase
+            valueFrom:
+              secretKeyRef:
+                name:  databasesecrets
+                key:  sqldatabase
+          - name:  sqlusername
+            valueFrom:
+              secretKeyRef:
+                name:  databasesecrets
+                key:  sqlusername
+          - name:  sqlpassword
+            valueFrom:
+              secretKeyRef:
+                name:  databasesecrets
+                key:  sqlpassword
+        # mount as file
+        volumeMounts:
+          - name:  secret-store
+            mountPath:  "mnt/secret-store"
+            readOnly: true
+      # get the SecretProviderClass object
+      volumes:
+        - name:  secret-store
+          csi:
+            driver: secrets-store.csi.k8s.io
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: "demo-secret"
+EOF

Demo time

Now we you can werify the secret in the pod:

-
export POD_NAME=$(kubectl get pods -l "app=secretpods" -o jsonpath="{.items[0].metadata.name}")
+
export POD_NAME=$(kubectl get pods -n default -l "app=secretpods" -o jsonpath="{.items[0].metadata.name}")
  
 # if this does not work, check the status of the pod
 # if still in ContainerCreating there might be an issue
@@ -8270,8 +8414,8 @@ notAfter=Aug 29
                 
-                
                 
+                
                 
             
                 https://devopstales.github.io/home/openshift4-buildconfig/
diff --git a/kubernetes/atom.xml b/kubernetes/atom.xml
index fd47a8387d..cdb4869f25 100644
--- a/kubernetes/atom.xml
+++ b/kubernetes/atom.xml
@@ -9,7 +9,7 @@
             
             
             
-    2024-10-14T13:44:33+00:00
+    2024-10-18T14:22:41+00:00
     
     
     
diff --git a/linux/atom.xml b/linux/atom.xml
index efaf4d0ea2..d99bb5032b 100644
--- a/linux/atom.xml
+++ b/linux/atom.xml
@@ -9,7 +9,7 @@
             
             
             
-    2024-10-14T13:44:33+00:00
+    2024-10-18T14:22:41+00:00
     
     
     
diff --git a/mikrotik/atom.xml b/mikrotik/atom.xml
index a900f85af6..e522ae8e7c 100644
--- a/mikrotik/atom.xml
+++ b/mikrotik/atom.xml
@@ -9,7 +9,7 @@
             
             
             
-    2024-10-14T13:44:33+00:00
+    2024-10-18T14:22:41+00:00
     
     
     
diff --git a/monitoring/atom.xml b/monitoring/atom.xml
index 5e683d664f..e513ebe595 100644
--- a/monitoring/atom.xml
+++ b/monitoring/atom.xml
@@ -9,7 +9,7 @@
             
             
             
-    2024-10-14T13:44:33+00:00
+    2024-10-18T14:22:41+00:00
     
     
     
diff --git a/sso/atom.xml b/sso/atom.xml
index 02e2ec6e6f..d287c43edf 100644
--- a/sso/atom.xml
+++ b/sso/atom.xml
@@ -9,7 +9,7 @@
             
             
             
-    2024-10-14T13:44:33+00:00
+    2024-10-18T14:22:41+00:00
     
     
     
diff --git a/virtualization/atom.xml b/virtualization/atom.xml
index c5fc57785c..b04bf245e6 100644
--- a/virtualization/atom.xml
+++ b/virtualization/atom.xml
@@ -9,7 +9,7 @@
             
             
             
-    2024-10-14T13:44:33+00:00
+    2024-10-18T14:22:41+00:00
     
     
     
diff --git a/windows/atom.xml b/windows/atom.xml
index 3b86a61b73..9b4b9448b1 100644
--- a/windows/atom.xml
+++ b/windows/atom.xml
@@ -9,7 +9,7 @@
             
             
             
-    2024-10-14T13:44:33+00:00
+    2024-10-18T14:22:41+00:00