-
Notifications
You must be signed in to change notification settings - Fork 190
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
With an update to github.com/fluxcd/pkg/oci v0.22.0. This includes a pin of `github.com/docker/docker` to `v20.10.x`, to prevent Oras from complaining. Co-authored-by: Hidde Beydals <[email protected]> Signed-off-by: Somtochi Onyekwere <[email protected]>
- Loading branch information
1 parent
6b235f0
commit 4995cff
Showing
7 changed files
with
283 additions
and
78 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -280,6 +280,7 @@ Without a [Secret reference](#secret-reference), authentication using a chain | |
| with: | ||
|
|
||
| - [Environment credentials](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#EnvironmentCredential) | ||
| - [Workload Identity](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/[email protected]#WorkloadIdentityCredential) | ||
| - [Managed Identity](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#ManagedIdentityCredential) | ||
| with the `AZURE_CLIENT_ID` | ||
| - Managed Identity with a system-assigned identity | ||
|
|
@@ -436,16 +437,97 @@ data: | |
| accountKey: <BASE64> | ||
| ``` | ||
|
|
||
| #### Managed Identity with AAD Pod Identity | ||
| ##### Workload Identity | ||
|
|
||
| If you are using [aad pod identity](https://azure.github.io/aad-pod-identity/docs), you can create an identity that has access to Azure Storage. | ||
| If you have [Workload Identity mutating webhook](https://azure.github.io/azure-workload-identity/docs/installation/managed-clusters.html) | ||
| installed on your cluster. You would need to create an Azure Identity and | ||
| give it access to Azure Blob Storage. | ||
|
|
||
| ```shell | ||
| export IDENTITY_NAME="blob-access" | ||
| az role assignment create --role "Storage Blob Data Reader" \ | ||
| --assignee-object-id "$(az identity show -n $IDENTITY_NAME -o tsv --query principalId -g $RESOURCE_GROUP)" \ | ||
| --scope "/subscriptions/<SUBSCRIPTION-ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Storage/storageAccounts/<account-name>/blobServices/default/containers/<container-name>" | ||
| ``` | ||
|
|
||
| Establish federated identity between the identity and the source-controller | ||
| ServiceAccount. | ||
|
|
||
| ```shell | ||
| export SERVICE_ACCOUNT_ISSUER="$(az aks show --resource-group <RESOURCE_GROUP> --name <CLUSTER-NAME> --query "oidcIssuerProfile.issuerUrl" -otsv)" | ||
| az identity federated-credential create \ | ||
| --name "kubernetes-federated-credential" \ | ||
| --identity-name "${IDENTITY_NAME}" \ | ||
| --resource-group "${RESOURCE_GROUP}" \ | ||
| --issuer "${SERVICE_ACCOUNT_ISSUER}" \ | ||
| --subject "system:serviceaccount:flux-system:source-controller" | ||
| ``` | ||
|
|
||
| Add a patch to label and annotate the source-controller Pods and ServiceAccount | ||
| correctly so that it can match an identity binding: | ||
|
|
||
| ```yaml | ||
| apiVersion: kustomize.config.k8s.io/v1beta1 | ||
| kind: Kustomization | ||
| resources: | ||
| - gotk-components.yaml | ||
| - gotk-sync.yaml | ||
| patches: | ||
| - patch: |- | ||
| apiVersion: v1 | ||
| kind: ServiceAccount | ||
| metadata: | ||
| name: source-controller | ||
| namespace: flux-system | ||
| annotations: | ||
| azure.workload.identity/client-id: <AZURE_CLIENT_ID> | ||
| labels: | ||
| azure.workload.identity/use: "true" | ||
| - patch: |- | ||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| name: source-controller | ||
| namespace: flux-system | ||
| labels: | ||
| azure.workload.identity/use: "true" | ||
| spec: | ||
| template: | ||
| metadata: | ||
| labels: | ||
| azure.workload.identity/use: "true" | ||
| ``` | ||
|
|
||
| If you have set Workload Identity up correctly and labeled the source-controller | ||
| Pod and ServiceAccount, then you don't need to reference a Secret. For more information, | ||
| please see [documentation](https://azure.github.io/azure-workload-identity/docs/quick-start.html). | ||
|
|
||
| ```yaml | ||
| apiVersion: source.toolkit.fluxcd.io/v1beta2 | ||
| kind: Bucket | ||
| metadata: | ||
| name: azure-bucket | ||
| namespace: flux-system | ||
| spec: | ||
| interval: 5m0s | ||
| provider: azure | ||
| bucketName: testsas | ||
| endpoint: https://testfluxsas.blob.core.windows.net | ||
| ``` | ||
|
|
||
| ##### Managed Identity with AAD Pod Identity | ||
|
|
||
| If you are using [aad pod identity](https://azure.github.io/aad-pod-identity/docs), | ||
| you can create an identity that has access to Azure Storage. | ||
|
|
||
| ```sh | ||
| export IDENTITY_NAME="blob-access" | ||
| az role assignment create --role "Storage Blob Data Contributor" \ | ||
| --assignee-object-id "$(az identity show -n blob-access -o tsv --query principalId -g $RESOURCE_GROUP)" \ | ||
| --scope "/subscriptions/<SUBSCRIPTION-ID>/resourceGroups/aks-somto/providers/Microsoft.Storage/storageAccounts/<account-name>/blobServices/default/containers/<container-name>" | ||
| az role assignment create --role "Storage Blob Data Reader" \ | ||
| --assignee-object-id "$(az identity show -n $IDENTITY_NAME -o tsv --query principalId -g $RESOURCE_GROUP)" \ | ||
| --scope "/subscriptions/<SUBSCRIPTION-ID>/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.Storage/storageAccounts/<account-name>/blobServices/default/containers/<container-name>" | ||
| export IDENTITY_CLIENT_ID="$(az identity show -n ${IDENTITY_NAME} -g ${RESOURCE_GROUP} -otsv --query clientId)" | ||
| export IDENTITY_RESOURCE_ID="$(az identity show -n ${IDENTITY_NAME} -otsv --query id)" | ||
|
|
@@ -493,7 +575,8 @@ spec: | |
| aadpodidbinding: ${IDENTITY_NAME} # match the AzureIdentity name | ||
| ``` | ||
|
|
||
| If you have set aad-pod-identity up correctly and labeled the source-controller pod, then you don't need to reference a secret. | ||
| If you have set aad-pod-identity up correctly and labeled the source-controller | ||
| pod, then you don't need to reference a secret. | ||
|
|
||
| ```yaml | ||
| apiVersion: source.toolkit.fluxcd.io/v1beta2 | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.