-
Notifications
You must be signed in to change notification settings - Fork 44
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add documentation for Azure workload identity (#1138)
* Add workload identity docs Signed-off-by: Reshma Abdul Rahim <[email protected]> * Add workload identity docs Signed-off-by: Reshma Abdul Rahim <[email protected]> * Updating with wi script Signed-off-by: willdavsmith <[email protected]> * oops Signed-off-by: willdavsmith <[email protected]> * edits Signed-off-by: willdavsmith <[email protected]> * Add dets Signed-off-by: Reshma Abdul Rahim <[email protected]> * Add dets Signed-off-by: Reshma Abdul Rahim <[email protected]> * Fix spelling errors Signed-off-by: Reshma Abdul Rahim <[email protected]> * Fix snippets visualization Signed-off-by: Reshma Abdul Rahim <[email protected]> * Update docs/content/guides/operations/providers/azure-provider/howto-azure-provider-wi/index.md Signed-off-by: Reshma Abdul Rahim <[email protected]> * Update docs/content/guides/operations/providers/azure-provider/howto-azure-provider-wi/index.md Signed-off-by: Reshma Abdul Rahim <[email protected]> * Update docs/content/guides/operations/providers/azure-provider/howto-azure-provider-sp/index.md Co-authored-by: Will <[email protected]> Signed-off-by: Reshma Abdul Rahim <[email protected]> * Address feedback Signed-off-by: Reshma Abdul Rahim <[email protected]> * Fix spelling Signed-off-by: Reshma Abdul Rahim <[email protected]> * Fix spelling Signed-off-by: Reshma Abdul Rahim <[email protected]> --------- Signed-off-by: Reshma Abdul Rahim <[email protected]> Signed-off-by: willdavsmith <[email protected]> Signed-off-by: Reshma Abdul Rahim <[email protected]> Co-authored-by: willdavsmith <[email protected]> Co-authored-by: Will <[email protected]>
- Loading branch information
3 people
authored
Jun 21, 2024
1 parent
7ffc377
commit d1d195b
Showing
13 changed files
with
202 additions
and
22 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -1245,3 +1245,6 @@ ProviderConfigProperties | |
| enableWebsockets | ||
| websocket | ||
| sp | ||
| azwi | ||
| Entra | ||
| ServiceAccounts | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
7 changes: 7 additions & 0 deletions
7
docs/content/guides/operations/providers/aws-provider/_index.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| --- | ||
| type: docs | ||
| title: "AWS provider" | ||
| linkTitle: "AWS provider" | ||
| description: "Deploy and connect to AWS resources" | ||
| weight: 300 | ||
| --- |
6 changes: 3 additions & 3 deletions
6
...ons/providers/howto-aws-provider/index.md → .../aws-provider/howto-aws-provider/index.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
7 changes: 7 additions & 0 deletions
7
docs/content/guides/operations/providers/azure-provider/_index.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| --- | ||
| type: docs | ||
| title: "Azure provider" | ||
| linkTitle: "Azure providers" | ||
| description: "Deploy and connect to Azure resources" | ||
| weight: 200 | ||
| --- |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
97 changes: 97 additions & 0 deletions
97
...ent/guides/operations/providers/azure-provider/howto-azure-provider-wi/index.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,97 @@ | ||
| --- | ||
| type: docs | ||
| title: "How-To: Configure the Azure cloud provider with Azure workload identity" | ||
| linkTitle: "Azure provider with Workload identity" | ||
| description: "Learn how to configure the Azure provider with Azure workload identity for your Radius Environment" | ||
| weight: 200 | ||
| categories: "How-To" | ||
| tags: ["Azure"] | ||
| --- | ||
|
|
||
| The Azure provider allows you to deploy and connect to Azure resources from a self-hosted Radius Environment. It can be configured: | ||
|
|
||
| - [Interactively via `rad init`](#interactive-configuration) | ||
| - [Manually via `rad env update` and `rad credential register`](#manual-configuration) | ||
|
|
||
| ## Prerequisites | ||
|
|
||
| - [Azure subscription](https://azure.com) | ||
| - [az CLI](https://aka.ms/azcli) | ||
| - [rad CLI]({{< ref "installation#step-1-install-the-rad-cli" >}}) | ||
| - [Setup a supported Kubernetes cluster]({{< ref "/guides/operations/kubernetes/overview#supported-clusters" >}}) | ||
| - You will need the cluster's OIDC Issuer URL. [AKS Example](https://azure.github.io/azure-workload-identity/docs/installation/managed-clusters.html#azure-kubernetes-service-aks) | ||
| - [Azure AD Workload Identity](https://azure.github.io/azure-workload-identity/docs/installation.html) installed in your cluster, including the [Mutating Admission Webhook](https://azure.github.io/azure-workload-identity/docs/installation/mutating-admission-webhook.html) | ||
|
|
||
| ## Setup the Azure Workload Identity for Radius | ||
|
|
||
| To authorize Radius to connect to Azure using Azure workload identity, you should set up an Entra ID Application with access to your resource group and 3 federated credentials (one for each of the Radius services). The 3 federated credentials should be created with the Kubernetes ServiceAccounts for each of the Radius services (applications-rp, bicep-de, and ucp) in the `radius-system` namespace and the OIDC Issuer for your Kubernetes cluster. | ||
|
|
||
| Below is an example script that will create an Entra ID Application and set up the federated credentials necessary for Radius to authenticate with Azure using Azure workload identity. | ||
|
|
||
| {{< rad file="snippets/install-radius-azwi.sh" embed=true lang=bash >}} | ||
|
|
||
| Now that the setup is complete, you can now install Radius with Azure workload identity enabled. | ||
|
|
||
| ## Interactive configuration | ||
|
|
||
| 1. Initialize a new environment with [`rad init --full`]({{< ref rad_init >}}): | ||
|
|
||
| ```bash | ||
| rad init --full | ||
| ``` | ||
|
|
||
| 1. Follow the prompts, specifying: | ||
| - **Namespace** - The Kubernetes namespace where your application containers and networking resources will be deployed (different than the Radius control-plane namespace, `radius-system`) | ||
| - **Add an Azure provider** | ||
| 1. Pick the subscription and resource group to deploy your Azure resources to. | ||
| 2. Select the "Workload Identity" option | ||
| 3. Enter the `appId` and the `tenantID` of the Entra ID Application | ||
| - **Environment name** - The name of the environment to create | ||
|
|
||
| You should see the following output: | ||
|
|
||
| ``` | ||
| Initializing Radius... | ||
| ✅ Install Radius {{< param version >}} | ||
| - Kubernetes cluster: k3d-k3s-default | ||
| - Kubernetes namespace: radius-system | ||
| - Azure credential: WorkloadIdentity | ||
| - Client ID: ********** | ||
| ✅ Create new environment default | ||
| - Kubernetes namespace: default | ||
| - Azure: subscription ***** and resource group *** | ||
| ✅ Scaffold application samples | ||
| ✅ Update local configuration | ||
| Initialization complete! Have a RAD time 😎 | ||
| ``` | ||
| ## Manual configuration | ||
| 1. Use [`rad install kubernetes`]({{< ref rad_install_kubernetes >}}) to install Radius with Azure workload identity enabled: | ||
| ```bash | ||
| rad install kubernetes --set global.azureWorkloadIdentity.enabled=true | ||
| ``` | ||
| 1. Create your resource group and environment: | ||
| ```bash | ||
| rad group create default | ||
| rad env create default | ||
| ``` | ||
| 1. Use [`rad env update`]({{< ref rad_env_update >}}) to update your Radius Environment with your Azure subscription ID and Azure resource group: | ||
| ```bash | ||
| rad env update myEnvironment --azure-subscription-id myAzureSubscriptionId --azure-resource-group myAzureResourceGroup | ||
| ``` | ||
| 1. Use [`rad credential register azure wi`]({{< ref rad_credential_register_azure_wi >}}) to add the Azure workload identity credentials: | ||
| ```bash | ||
| rad credential register azure wi --client-id myClientId --tenant-id myTenantId | ||
| ``` | ||
| Radius will use the provided client-id for all interactions with Azure, including Bicep and Recipe deployments. |
63 changes: 63 additions & 0 deletions
63
...erations/providers/azure-provider/howto-azure-provider-wi/snippets/install-radius-azwi.sh
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| if [ "$#" -ne 4 ]; then | ||
| echo "Usage: $0 <K8S_CLUSTER_NAME> <AZURE_RESOURCE_GROUP> <AZURE_SUBSCRIPTION_ID> <OIDC_ISSUER_URL>" | ||
| exit 1 | ||
| fi | ||
|
|
||
| export K8S_CLUSTER_NAME=$1 | ||
| export AZURE_RESOURCE_GROUP=$2 | ||
| export AZURE_SUBSCRIPTION_ID=$3 | ||
| export SERVICE_ACCOUNT_ISSUER=$4 | ||
|
|
||
| # Create the Entra ID Application | ||
| export APPLICATION_NAME="${K8S_CLUSTER_NAME}-radius-app" | ||
| az ad app create --display-name "${APPLICATION_NAME}" | ||
|
|
||
| # Get the client ID and object ID of the application | ||
| export APPLICATION_CLIENT_ID="$(az ad app list --display-name "${APPLICATION_NAME}" --query [].appId -o tsv)" | ||
| export APPLICATION_OBJECT_ID="$(az ad app show --id "${APPLICATION_CLIENT_ID}" --query id -otsv)" | ||
|
|
||
| # Create the applications-rp federated credential for the application | ||
| cat <<EOF > params-applications-rp.json | ||
| { | ||
| "name": "radius-applications-rp", | ||
| "issuer": "${SERVICE_ACCOUNT_ISSUER}", | ||
| "subject": "system:serviceaccount:radius-system:applications-rp", | ||
| "description": "Kubernetes service account federated credential for applications-rp", | ||
| "audiences": [ | ||
| "api://AzureADTokenExchange" | ||
| ] | ||
| } | ||
| EOF | ||
| az ad app federated-credential create --id "${APPLICATION_OBJECT_ID}" --parameters @params-applications-rp.json | ||
|
|
||
| # Create the bicep-de federated credential for the application | ||
| cat <<EOF > params-bicep-de.json | ||
| { | ||
| "name": "radius-bicep-de", | ||
| "issuer": "${SERVICE_ACCOUNT_ISSUER}", | ||
| "subject": "system:serviceaccount:radius-system:bicep-de", | ||
| "description": "Kubernetes service account federated credential for bicep-de", | ||
| "audiences": [ | ||
| "api://AzureADTokenExchange" | ||
| ] | ||
| } | ||
| EOF | ||
| az ad app federated-credential create --id "${APPLICATION_OBJECT_ID}" --parameters @params-bicep-de.json | ||
|
|
||
| # Create the ucp federated credential for the application | ||
| cat <<EOF > params-ucp.json | ||
| { | ||
| "name": "radius-ucp", | ||
| "issuer": "${SERVICE_ACCOUNT_ISSUER}", | ||
| "subject": "system:serviceaccount:radius-system:ucp", | ||
| "description": "Kubernetes service account federated credential for ucp", | ||
| "audiences": [ | ||
| "api://AzureADTokenExchange" | ||
| ] | ||
| } | ||
| EOF | ||
| az ad app federated-credential create --id "${APPLICATION_OBJECT_ID}" --parameters @params-ucp.json | ||
|
|
||
| # Set the permissions for the application | ||
| az ad sp create --id ${APPLICATION_CLIENT_ID} | ||
| az role assignment create --assignee "${APPLICATION_CLIENT_ID}" --role "Owner" --scope "/subscriptions/${AZURE_SUBSCRIPTION_ID}/resourceGroups/${AZURE_RESOURCE_GROUP}" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters