Features

CSI Secrets driver

Azure Workload Identity

Auth Diagrams

App1 (workload identity)

App 2 & 5 (workload identity + csi)

Apps 3 & 4 (managed identity + csi)

Getting Started

Prerequisites

Installation

AKS

Guide

1. clone the repo

git clone https://github.com/Azure-Samples/aks-workload-identity.git --recurse-submodulescd aks-workload-identity

2. Deploy the infrastructure to your azure subscription

RGNAME=akswiweaz group create -n$RGNAME -l WestEuropeDEP=$(az deployment group create -g$RGNAME -f main.bicep -o json)OIDCISSUERURL=$(echo$DEP| jq -r'.properties.outputs.aksOidcIssuerUrl.value')AKSCLUSTER=$(echo$DEP| jq -r'.properties.outputs.aksClusterName.value')APP1KVNAME=$(echo$DEP| jq -r'.properties.outputs.kvApp1Name.value')APP2KVNAME=$(echo$DEP| jq -r'.properties.outputs.kvApp2Name.value')APP3KVNAME=$(echo$DEP| jq -r'.properties.outputs.kvApp3Name.value')APP4KVNAME=$(echo$DEP| jq -r'.properties.outputs.kvApp4Name.value')APP5KVNAME=$(echo$DEP| jq -r'.properties.outputs.kvApp5Name.value')APP1=$(echo$DEP| jq -r'.properties.outputs.idApp1ClientId.value')APP3=$(echo$DEP| jq -r'.properties.outputs.idApp3ClientId.value')APP5=$(echo$DEP| jq -r'.properties.outputs.idApp5ClientId.value')az aks get-credentials -n$AKSCLUSTER -g$RGNAME --overwrite-existing

3. Create AAD Service Principal (and application) for app2

APP2=$(az ad sp create-for-rbac --name"AksWiApp2" --query"appId" -o tsv)

4. AAD application permissions on KeyVault

APP2SPID="$(az ad sp show --id$APP2 --query id -o tsv)"az deployment group create -g$RGNAME -f kvRbac.bicep -p kvName=$APP2KVNAME appclientId=$APP2SPID#App4CSICLIENTID=$(az aks show -g$RGNAME --name$AKSCLUSTER --query addonProfiles.azureKeyvaultSecretsProvider.identity.clientId -o tsv)CSIOBJECTID=$(az aks show -g$RGNAME --name$AKSCLUSTER --query addonProfiles.azureKeyvaultSecretsProvider.identity.objectId -o tsv)az deployment group create -g$RGNAME -f kvRbac.bicep -p kvName=$APP4KVNAME appclientId=$CSIOBJECTID

5. Deploy the applications

TENANTID=$(az account show --query tenantId -o tsv)helm upgrade --install app1 charts/workloadIdApp1 --set azureWorkloadIdentity.tenantId=$TENANTID,azureWorkloadIdentity.clientId=$APP1,keyvaultName=$APP1KVNAME,secretName=arbitrarySecret -n app1 --create-namespacehelm upgrade --install app2 charts/workloadIdApp2 --set azureWorkloadIdentity.tenantId=$TENANTID,azureWorkloadIdentity.clientId=$APP2,keyvaultName=$APP2KVNAME,secretName=arbitrarySecret -n app2 --create-namespacehelm upgrade --install app3 charts/csiApp --set azureKVIdentity.tenantId=$TENANTID,azureKVIdentity.clientId=$APP3,keyvaultName=$APP3KVNAME,secretName=arbitrarySecret -n app3 --create-namespacehelm upgrade --install app4 charts/csiApp --set azureKVIdentity.tenantId=$TENANTID,azureKVIdentity.clientId=$CSICLIENTID,keyvaultName=$APP4KVNAME,secretName=arbitrarySecret -n app4 --create-namespacehelm upgrade --install app5 charts/workloadIdApp2 --set nameOverride=workloadidapp5,azureWorkloadIdentity.tenantId=$TENANTID,azureWorkloadIdentity.clientId=$APP5,keyvaultName=$APP5KVNAME,secretName=arbitrarySecret -n app5 --create-namespace

6. Checking the workloads

APP2POD=$(kubectl get pod -n app2 -o=jsonpath='{.items[0].metadata.name}')kubectl logs$APP2POD -n app2#error: AADSTS70021: No matching federated identity record found for presented assertion. Assertion Issuer: 'https://oidc.prod-aks.azure.com/REDACTED/'. Assertion Subject: 'system:serviceaccount:default:app2-workloadidapp'. Assertion Audience: 'api://AzureADTokenExchange'.

7. Establish federated identity credentials for the workload identities

App2

APP2SVCACCNT="app2-workloadidapp2"APP2NAMESPACE="app2"APP2APPOBJECTID="$(az ad app show --id$APP2 --query id -o tsv)"#Create federated identity credentials for use from an AKS Cluster Service AccountfedReqUrl="https://graph.microsoft.com/beta/applications/$APP2APPOBJECTID/federatedIdentityCredentials"fedReqBody=$(jq -n --arg n"kubernetes-$AKSCLUSTER-$APP2NAMESPACE-app2" \                   --arg i$OIDCISSUERURL \                   --arg s"system:serviceaccount:$APP2NAMESPACE:$APP2SVCACCNT" \                   --arg d"Kubernetes service account federated credential" \'{name:$n,issuer:$i,subject:$s,description:$d,audiences:["api://AzureADTokenExchange"]}')echo$fedReqBody| jq -raz rest --method POST --uri$fedReqUrl --body"$fedReqBody"

8. Assigning Managed Identity to the VMSS

NODEPOOLNAME=$(echo$DEP| jq -r'.properties.outputs.aksUserNodePoolName.value')RGNODE=$(echo$DEP| jq -r'.properties.outputs.nodeResourceGroup.value')APP3RESID=$(echo$DEP| jq -r'.properties.outputs.idApp3Id.value')VMSSNAME=$(az vmss list -g$RGNODE --query"[?tags.\"aks-managed-poolName\" == '$NODEPOOLNAME'].name" -o tsv)az vmss identity assign -g$RGNODE -n$VMSSNAME --identities$APP3RESID

9. Seeing all the apps working

APP1POD=$(kubectl get pod -n app1 -o=jsonpath='{.items[0].metadata.name}')kubectl logs$APP1POD -n app1APP2POD=$(kubectl get pod -n app2 -o=jsonpath='{.items[0].metadata.name}')kubectlexec -it$APP2POD -n app2 -- cat /mnt/secrets-store/arbitrarySecretAPP3POD=$(kubectl get pod -n app3 -o=jsonpath='{.items[0].metadata.name}')kubectlexec -it$APP3POD -n app3 -- cat /mnt/secrets-store/arbitrarySecretAPP4POD=$(kubectl get pod -n app4 -o=jsonpath='{.items[0].metadata.name}')kubectlexec -it$APP4POD -n app4 -- cat /mnt/secrets-store/arbitrarySecretAPP5POD=$(kubectl get pod -n app5 -o=jsonpath='{.items[0].metadata.name}')kubectlexec -it$APP5POD -n app5 -- cat /mnt/secrets-store/arbitrarySecret

10. Cleanup

az group delete -n$RGNAME#Navigate to the Azure Portal, Azure Active Directory to delete the AksWiApp1 and AksWiApp2 service principals

Resources