Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Migrate to Azure AD Workload Identities (once User Managed Identity support is in Preview) #111

Closed
ckittel opened this issue Nov 13, 2020 · 8 comments
Closed

Migrate to Azure AD Workload Identities (once User Managed Identity support is in Preview) #111

ckittel opened this issue Nov 13, 2020 · 8 comments
Assignees
@ckittel
Labels
enhancement New feature or request

Comments

@ckittel
Copy link
Member

ckittel commented Nov 13, 2020

Today we install AAD Pod Identity ourselves to make it available to our workloads. AAD Pod Identity is coming as a managed add-on to eliminate this manual step.

  1. Remove the .yaml file from the flux configuration
  2. Update the workload deployment steps that use AAD Pod Identity to reference the built-in solution (should be no change in instructions though)
  3. Update the main page to move that from the OOS list to the features list
@ckittel ckittel added the enhancement New feature or request label Nov 13, 2020
@ckittel ckittel mentioned this issue Nov 13, 2020
Closed
@ckittel
Copy link
Member Author

ckittel commented Jan 25, 2021

Cluster has been moved to user-managed identity as a pre-req for this.

@ckittel
Copy link
Member Author

ckittel commented Apr 2, 2021

This is implemented in the Regulated Workloads cluster, waiting a bit yet before we can backport it to baseline.

@ckittel ckittel changed the title Migrate to AAD Pod Identity add-on (once GA) Migrate to AAD Pod Identity v2 add-on (once GA) Sep 17, 2021
@ckittel
Copy link
Member Author

ckittel commented Sep 17, 2021

We'll want to wait until v2. v1 is not currently template friendly (in that you have to deploy the cluster twice to associate your first identity)

@ckittel
Copy link
Member Author

ckittel commented Jan 4, 2022

The OIDC Issuer feature needs to be enabled on the cluster for this to work. That work is being spiked out in #274

@ckittel ckittel changed the title Migrate to AAD Pod Identity v2 add-on (once GA) Migrate to Azure AD Workload Identities (once GA) Feb 1, 2022
@ckittel
Copy link
Member Author

ckittel commented Feb 1, 2022

OIDC Issuer is included in the implementation now, that's the first part of this feature.

@ckittel
Copy link
Member Author

ckittel commented May 3, 2022

While we could move to workload identities now, we'd have to create the app registration in Azure AD by hand. I'm thinking it'll make more sense to wait until managed identity support ships, so we can keep this a native azure experience, akin to what we have now with pod identity

@ckittel ckittel self-assigned this May 3, 2022
@ckittel
Copy link
Member Author

ckittel commented May 27, 2022

We are tracking development of workload identity, with user managed identity support, closely. A lot is still "in flight" at the moment, but we took the time to explore the change in a "placeholder" PR. If you're interested in seeing the current direction of things, you can follow along in: #326

@ckittel ckittel changed the title Migrate to Azure AD Workload Identities (once GA) Migrate to Azure AD Workload Identities (once User Managed Identity support is in Preview) May 27, 2022
@ckittel
Copy link
Member Author

ckittel commented Oct 7, 2022

This is now complete with the work done in #326, which has been merged.

@ckittel ckittel closed this as completed Oct 7, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ckittel ckittel

Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@ckittel