Migrate from AAD Pod Identity to Workload Identity (Supported by User Managed Identities) & Update AKS Version #326
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
hallihan
approved these changes
Oct 7, 2022
04-networking.md
Outdated
| @@ -85,7 +85,7 @@ The following two resource groups will be created and populated with networking | |||
| The spoke creation will emit the following: | |||
|
|
|||
| * `appGwPublicIpAddress` - The Public IP address of the Azure Application Gateway (WAF) that will receive traffic for your workload. | |||
| * `clusterVnetResourceId` - The resource ID of the VNet that the cluster will land in. E.g. `/subscriptions/[id]/resourceGroups/rg-enterprise-networking-spokes/providers/Microsoft.Network/virtualNetworks/vnet-spoke-BU0001A0008-00` | |||
| * `clusterVnetResourceId` - The resource ID of the Virtual network that the cluster, App Gateway, and related will be deployed in. E.g. `/subscriptions/[id]/resourceGroups/rg-enterprise-networking-spokes/providers/Microsoft.Network/virtualNetworks/vnet-spoke-BU0001A0008-00` | |||
There was a problem hiding this comment.
Suggested change
| * `clusterVnetResourceId` - The resource ID of the Virtual network that the cluster, App Gateway, and related will be deployed in. E.g. `/subscriptions/[id]/resourceGroups/rg-enterprise-networking-spokes/providers/Microsoft.Network/virtualNetworks/vnet-spoke-BU0001A0008-00` | |
| * `clusterVnetResourceId` - The resource ID of the Virtual network where the cluster, App Gateway, and related will be deployed. E.g. `/subscriptions/[id]/resourceGroups/rg-enterprise-networking-spokes/providers/Microsoft.Network/virtualNetworks/vnet-spoke-BU0001A0008-00` |
There was a problem hiding this comment.
Good reword, update will be coming shortly.
cluster-stamp.bicep
Outdated
| @@ -1558,7 +1546,7 @@ resource kvPodMiIngressControllerSecretsUserRole_roleAssignment 'Microsoft.Autho | |||
| } | |||
| } | |||
|
|
|||
| // Grant the AKS cluster ingress controller pod managed identity with key vault reader role permissions; this allows our ingress controller to pull certificates | |||
| // Grant the AKS cluster ingress controller managed workload identity with key vault reader role permissions; this allows our ingress controller to pull certificates | |||
There was a problem hiding this comment.
For consistency with above:
Suggested change
| // Grant the AKS cluster ingress controller managed workload identity with key vault reader role permissions; this allows our ingress controller to pull certificates | |
| // Grant the AKS cluster ingress controller's managed workload identity with key vault reader role permissions; this allows our ingress controller to pull certificates. |
RobBagby
reviewed
Oct 7, 2022
04-networking.md
Outdated
| @@ -85,7 +85,7 @@ The following two resource groups will be created and populated with networking | |||
| The spoke creation will emit the following: | |||
|
|
|||
| * `appGwPublicIpAddress` - The Public IP address of the Azure Application Gateway (WAF) that will receive traffic for your workload. | |||
| * `clusterVnetResourceId` - The resource ID of the VNet that the cluster will land in. E.g. `/subscriptions/[id]/resourceGroups/rg-enterprise-networking-spokes/providers/Microsoft.Network/virtualNetworks/vnet-spoke-BU0001A0008-00` | |||
| * `clusterVnetResourceId` - The resource ID of the Virtual network that the cluster, App Gateway, and related will be deployed in. E.g. `/subscriptions/[id]/resourceGroups/rg-enterprise-networking-spokes/providers/Microsoft.Network/virtualNetworks/vnet-spoke-BU0001A0008-00` | |||
There was a problem hiding this comment.
Are you missing a noun after related? The related what will be deployed?
There was a problem hiding this comment.
Good catch, update will be coming shortly.
RobBagby
approved these changes
Oct 7, 2022
|
Thanks all for the review. If there is anything else, just let me know and I'll catch it in a follow-up PR. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This was tested end-to-end. 🚢