Adding Module that Utilizes Azure Key Vault - #1
Draft
nexilus18 wants to merge 1 commit into
Draft
Conversation
NarmathaBala
suggested changes
Nov 4, 2022
| @@ -0,0 +1,237 @@ | |||
| # Using Azure Key Vault to store secrets | |||
|
|
|||
There was a problem hiding this comment.
Introduction section on Azure Key Vault approach vs AKS Secrets described in prior lab
| or | ||
| az extension update --name aks-preview | ||
| ``` | ||
| - Existing Azure Subscription with EnableWorkloadIdentityPreview feature enabled |
There was a problem hiding this comment.
Suggested change
| - Existing Azure Subscription with EnableWorkloadIdentityPreview feature enabled | |
| - Enable `EnableWorkloadIdentityPreview` feature on the existing Azure Subscription |
There was a problem hiding this comment.
It would be helpful to add the command to add this feature or link out to the page
|
|
||
| ## Upgrade existing AKS cluster | ||
|
|
||
| Upgrade your AKS cluster with Azure Key Vaut Provider for Secrets store CSI Driver capability, enable-oidc-issuer |
There was a problem hiding this comment.
Suggested change
| Upgrade your AKS cluster with Azure Key Vaut Provider for Secrets store CSI Driver capability, enable-oidc-issuer | |
| Upgrade your AKS cluster with Azure Key Vault Provider for Secrets store CSI Driver capability, `enable-oidc-issuer` |
| ``` | ||
|
|
||
| ```bash | ||
| az keyvault secret set --vault-name $KEYVAULT_NAME -n admin-passsword --value kv_supersecret |
There was a problem hiding this comment.
Suggested change
| az keyvault secret set --vault-name $KEYVAULT_NAME -n admin-passsword --value kv_supersecret | |
| az keyvault secret set --vault-name $KEYVAULT_NAME -n admin-passsword --value supersecret |
|
|
||
| ## Create Azure KeyVault | ||
|
|
||
| Create an Azure Key Vault resource to store secrets. You can store secret in your key vault using the `az keyvaul secret set` command |
There was a problem hiding this comment.
Suggested change
| Create an Azure Key Vault resource to store secrets. You can store secret in your key vault using the `az keyvaul secret set` command | |
| Create an Azure Key Vault resource to store secrets. You can store the key-value pair of `admin-password` and related secret in the key vault using the `az keyvault secret set` command. The `admin-password` is the name of the secret and the actual secret is stored in value. |
|
|
||
| ``` | ||
|
|
||
| The following command outputs the user assigned client id. Save this output |
| Update the values for `name` and `namespace` with the Kubernetes service account name and its namespace in the `service.yaml` file and apply the manifest. | ||
|
|
||
| <details markdown="1"> | ||
| <summary>Click here for the Service YAML file</summary> |
There was a problem hiding this comment.
Suggested change
| <summary>Click here for the Service YAML file</summary> | |
| <summary>Click here for the Service.yaml file</summary> |
| kubectl apply -f service.yaml | ||
| ``` | ||
|
|
||
| Create the federated identity credential between the Managed Identity, the service account issuer, and the subject. |
There was a problem hiding this comment.
Note: to add link to federated identity credential
| az identity federated-credential create --name $federatedIdentityName --identity-name $UAMI --resource-group $RES_GROUP --issuer ${AKS_OIDC_ISSUER} --subject system:serviceaccount:${serviceAccountNamespace}:${serviceAccountName} | ||
| ``` | ||
|
|
||
| In the secret-provider-class, change `ClientID`, `keyvaultName` and `tenantID` with the worload identity, keyvault name and the tenant ID of the keyvault. Update `ObjectName` with the name of your secret. Deploy the `SecretProviderClass` after making the changes. |
There was a problem hiding this comment.
Suggested change
| In the secret-provider-class, change `ClientID`, `keyvaultName` and `tenantID` with the worload identity, keyvault name and the tenant ID of the keyvault. Update `ObjectName` with the name of your secret. Deploy the `SecretProviderClass` after making the changes. | |
| In the secret-provider-class, change `ClientID`, `keyvaultName` and `tenantID` with the workload identity, keyvault name and the tenant ID of the keyvault. Update `ObjectName` with the name of your secret. Deploy the `SecretProviderClass` after making the changes. |
| In the secret-provider-class, change `ClientID`, `keyvaultName` and `tenantID` with the worload identity, keyvault name and the tenant ID of the keyvault. Update `ObjectName` with the name of your secret. Deploy the `SecretProviderClass` after making the changes. | ||
|
|
||
| <details markdown="2"> | ||
| <summary>Click here for the Secret Provider Class YAML</summary> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds module that utilizes Azure Key Vault to store secrets.