Azure工作负载身份 – 通过ARM模板启用工作负载身份?

huangapple go评论67阅读模式
英文:

Azure Workload Identity - --enable-workload-identity via ARM template?

问题

I managed to enable OIDC issuer and workload identity in my ARM template:

{
    "apiVersion": "2019-06-01",
    "dependsOn": [],
    "type": "Microsoft.ContainerService/managedClusters",
    "location": "[parameters('location')]",
    "name": "[parameters('resourceName')]",
    "properties": {
        "oidcIssuerProfile": {
            "enabled": true
        },
        "workloadIdentity": {
            "enabled": true
        },
        "securityProfile": {
            "workloadIdentity": {
                "enabled": true
            }
        }
    }
}

But, after the script has executed, I can't see the azure-wi-webhook-controller-manager pods running under the kube-system namespace - It seems that the ARM template does not install this component, which is required for Azure Workload Identity to work.

Is there a way I can install it through ARM?

英文:

I'm trying to create an ARM template to provision an Azure Kubernetes Service cluster with Azure workload identity pre-configure, similar to the result that the cmdlet below would produce:

az aks create -g ${RESOURCE_GROUP} -n ${CLUSTER_NAME} --enable-oidc-issuer --enable-workload-identity

I managed to enable OIDC issuer and workload identity in my ARM template:

       {
            "apiVersion": "2019-06-01",
            "dependsOn": [],
            "type": "Microsoft.ContainerService/managedClusters",
            "location": "[parameters('location')]",
            "name": "[parameters('resourceName')]",
            "properties": {
               [...]
               "oidcIssuerProfile": {
                    "enabled": true
                },
                "workloadIdentity": {
                    "enabled": true
                },
                "securityProfile": {
                    "workloadIdentity": {
                        "enabled": true
                    }
                },
                [...],
            }
       }

But, after the script has executed, I can't see the azure-wi-webhook-controller-manager pods running under the kube-system namespace - It seems that the arm template does not install this component, that is required for Azure Workload Identity to work.

Is there a way I can install it through ARM?

Thanks a lot

答案1

得分: 2

你的ARM模板问题在于API版本,workloadIdentity直到2023-01-02-preview才被添加。你正在使用2019-06-01版本。请查看https://learn.microsoft.com/en-us/azure/templates/microsoft.containerservice/change-log/managedclusters#2023-01-02-preview

作为参考,AKS Construction bicep实现了工作负载身份和大多数其他AKS功能。

英文:

The problem with your ARM template is the API version, workloadIdentity was not added until 2023-01-02-preview. You're using 2019-06-01. See https://learn.microsoft.com/en-us/azure/templates/microsoft.containerservice/change-log/managedclusters#2023-01-02-preview

For a reference, the AKS Construction bicep implements workload identity and most other AKS features.

huangapple
  • 本文由 发表于 2023年6月26日 17:53:32
  • 转载请务必保留本文链接:https://go.coder-hub.com/76555546.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定