英文:
Azure Workload Identity - --enable-workload-identity via ARM template?
问题
I managed to enable OIDC issuer and workload identity in my ARM template:
{
"apiVersion": "2019-06-01",
"dependsOn": [],
"type": "Microsoft.ContainerService/managedClusters",
"location": "[parameters('location')]",
"name": "[parameters('resourceName')]",
"properties": {
"oidcIssuerProfile": {
"enabled": true
},
"workloadIdentity": {
"enabled": true
},
"securityProfile": {
"workloadIdentity": {
"enabled": true
}
}
}
}
But, after the script has executed, I can't see the azure-wi-webhook-controller-manager
pods running under the kube-system
namespace - It seems that the ARM template does not install this component, which is required for Azure Workload Identity to work.
Is there a way I can install it through ARM?
英文:
I'm trying to create an ARM template to provision an Azure Kubernetes Service cluster with Azure workload identity pre-configure, similar to the result that the cmdlet below would produce:
az aks create -g ${RESOURCE_GROUP} -n ${CLUSTER_NAME} --enable-oidc-issuer --enable-workload-identity
I managed to enable OIDC issuer and workload identity in my ARM template:
{
"apiVersion": "2019-06-01",
"dependsOn": [],
"type": "Microsoft.ContainerService/managedClusters",
"location": "[parameters('location')]",
"name": "[parameters('resourceName')]",
"properties": {
[...]
"oidcIssuerProfile": {
"enabled": true
},
"workloadIdentity": {
"enabled": true
},
"securityProfile": {
"workloadIdentity": {
"enabled": true
}
},
[...],
}
}
But, after the script has executed, I can't see the azure-wi-webhook-controller-manager
pods running under the kube-system
namespace - It seems that the arm template does not install this component, that is required for Azure Workload Identity to work.
Is there a way I can install it through ARM?
Thanks a lot
答案1
得分: 2
你的ARM模板问题在于API版本,workloadIdentity直到2023-01-02-preview才被添加。你正在使用2019-06-01版本。请查看https://learn.microsoft.com/en-us/azure/templates/microsoft.containerservice/change-log/managedclusters#2023-01-02-preview
作为参考,AKS Construction bicep实现了工作负载身份和大多数其他AKS功能。
英文:
The problem with your ARM template is the API version, workloadIdentity was not added until 2023-01-02-preview. You're using 2019-06-01. See https://learn.microsoft.com/en-us/azure/templates/microsoft.containerservice/change-log/managedclusters#2023-01-02-preview
For a reference, the AKS Construction bicep implements workload identity and most other AKS features.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库,让每个人都能够通过互相帮助和分享经验来进步。
评论