Skip to content

Commit 67044ca

Browse files
MGoedtelMGoedtel
committed
finished review and edits
1 parent 88f7ed2 commit 67044ca

File tree

2 files changed

+9
-83
lines changed

2 files changed

+9
-83
lines changed

‎articles/aks/learn/tutorial-kubernetes-workload-identity.md

Lines changed: 5 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Tutorial - Use a workload identity with an application on Azure Kubernete
33
description: In this Azure Kubernetes Service (AKS) tutorial, you deploy an Azure Kubernetes Service cluster and configure an application to use a workload identity.
44
ms.topic: tutorial
55
ms.custom: devx-track-azurecli
6-
ms.date: 04/17/2023
6+
ms.date: 04/18/2023
77
---
88

99
# Tutorial: Use a workload identity with an application on Azure Kubernetes Service (AKS)
@@ -20,8 +20,6 @@ This tutorial assumes a basic understanding of Kubernetes concepts. For more inf
2020

2121
[!INCLUDE [quickstarts-free-trial-note](../../../includes/quickstarts-free-trial-note.md)]
2222

23-
[!INCLUDE [preview features callout](../includes/preview/preview-callout.md)]
24-
2523
- This article requires version 2.40.0 or later of the Azure CLI. If using Azure Cloud Shell, the latest version is already installed.
2624

2725
- You have installed the latest version of the `aks-preview` extension, version 0.5.102 or later.
@@ -61,42 +59,6 @@ The following output example resembles successful creation of the resource group
6159
}
6260
```
6361

64-
## Install the aks-preview Azure CLI extension
65-
66-
[!INCLUDE [preview features callout](../includes/preview/preview-callout.md)]
67-
68-
To install the aks-preview extension, run the following command:
69-
70-
```azurecli-interactive
71-
az extension add --name aks-preview
72-
```
73-
74-
Run the following command to update to the latest version of the extension released:
75-
76-
```azurecli-interactive
77-
az extension update --name aks-preview
78-
```
79-
80-
## Register the 'EnableWorkloadIdentityPreview' feature flag
81-
82-
Register the `EnableWorkloadIdentityPreview` feature flag by using the [az feature register][az-feature-register] command, as shown in the following example:
83-
84-
```azurecli-interactive
85-
az feature register --namespace "Microsoft.ContainerService" --name "EnableWorkloadIdentityPreview"
86-
```
87-
88-
It takes a few minutes for the status to show *Registered*. Verify the registration status by using the [az feature list][az-feature-list] command:
89-
90-
```azurecli-interactive
91-
az feature show --namespace "Microsoft.ContainerService" --name "EnableWorkloadIdentityPreview"
92-
```
93-
94-
When the status shows *Registered*, refresh the registration of the *Microsoft.ContainerService* resource provider by using the [az provider register][az-provider-register] command:
95-
96-
```azurecli-interactive
97-
az provider register --namespace Microsoft.ContainerService
98-
```
99-
10062
## Export environmental variables
10163

10264
To help simplify steps to configure the identities required, the steps below define
@@ -111,15 +73,17 @@ export SERVICE_ACCOUNT_NAMESPACE="default"
11173
export SERVICE_ACCOUNT_NAME="workload-identity-sa"
11274
export SUBSCRIPTION="$(az account show --query id --output tsv)"
11375
export USER_ASSIGNED_IDENTITY_NAME="myIdentity"
114-
export FEDERATED_IDENTITY_CREDENTIAL_NAME="fic-test-fic-name"
76+
export FEDERATED_IDENTITY_CREDENTIAL_NAME="myFedIdentity"
77+
export KEYVAULT_NAME="azwi-kv-tutorial"
78+
export KEYVAULT_SECRET_NAME="my-secret"
11579
```
11680

11781
## Create AKS cluster
11882

11983
Create an AKS cluster using the [az aks create][az-aks-create] command with the `--enable-oidc-issuer` parameter to use the OIDC Issuer. The following example creates a cluster named *myAKSCluster* with one node in the *myResourceGroup*:
12084

12185
```azurecli-interactive
122-
az aks create -g "${RESOURCE_GROUP}" -n myAKSCluster --node-count 1 --enable-oidc-issuer --enable-workload-identity --generate-ssh-keys
86+
az aks create -g "${RESOURCE_GROUP}" -n myAKSCluster --node-count 1 --enable-oidc-issuer --enable-workload-identity
12387
```
12488

12589
After a few minutes, the command completes and returns JSON-formatted information about the cluster.
@@ -234,8 +198,6 @@ kind: Pod
234198
metadata:
235199
name: quick-start
236200
namespace: ${SERVICE_ACCOUNT_NAMESPACE}
237-
labels:
238-
azure.workload.identity/use: "true"
239201
spec:
240202
serviceAccountName: ${SERVICE_ACCOUNT_NAME}
241203
containers:

‎articles/aks/workload-identity-deploy-cluster.md

Lines changed: 4 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Deploy and configure an Azure Kubernetes Service (AKS) cluster with workl
33
description: In this Azure Kubernetes Service (AKS) article, you deploy an Azure Kubernetes Service cluster and configure it with an Azure AD workload identity (preview).
44
ms.topic: article
55
ms.custom: devx-track-azurecli
6-
ms.date: 04/17/2023
6+
ms.date: 04/18/2023
77
---
88

99
# Deploy and configure workload identity (preview) on an Azure Kubernetes Service (AKS) cluster
@@ -23,42 +23,6 @@ This article assumes you have a basic understanding of Kubernetes concepts. For
2323

2424
- If you have multiple Azure subscriptions, select the appropriate subscription ID in which the resources should be billed using the [az account][az-account] command.
2525

26-
## Install the aks-preview Azure CLI extension
27-
28-
[!INCLUDE [preview features callout](includes/preview/preview-callout.md)]
29-
30-
To install the aks-preview extension, run the following command:
31-
32-
```azurecli
33-
az extension add --name aks-preview
34-
```
35-
36-
Run the following command to update to the latest version of the extension released:
37-
38-
```azurecli
39-
az extension update --name aks-preview
40-
```
41-
42-
## Register the 'EnableWorkloadIdentityPreview' feature flag
43-
44-
Register the `EnableWorkloadIdentityPreview` feature flag by using the [az feature register][az-feature-register] command, as shown in the following example:
45-
46-
```azurecli-interactive
47-
az feature register --namespace "Microsoft.ContainerService" --name "EnableWorkloadIdentityPreview"
48-
```
49-
50-
It takes a few minutes for the status to show *Registered*. Verify the registration status by using the [az feature show][az-feature-show] command:
51-
52-
```azurecli-interactive
53-
az feature show --namespace "Microsoft.ContainerService" --name "EnableWorkloadIdentityPreview"
54-
```
55-
56-
When the status reflects *Registered*, refresh the registration of the *Microsoft.ContainerService* resource provider by using the [az provider register][az-provider-register] command:
57-
58-
```azurecli-interactive
59-
az provider register --namespace Microsoft.ContainerService
60-
```
61-
6226
## Export environmental variables
6327

6428
To help simplify steps to configure the identities required, the steps below define
@@ -73,7 +37,7 @@ export SERVICE_ACCOUNT_NAMESPACE="default"
7337
export SERVICE_ACCOUNT_NAME="workload-identity-sa"
7438
export SUBSCRIPTION="$(az account show --query id --output tsv)"
7539
export USER_ASSIGNED_IDENTITY_NAME="myIdentity"
76-
export FEDERATED_IDENTITY_CREDENTIAL="fic-test-fic-name"
40+
export FEDERATED_IDENTITY_CREDENTIAL="myFedIdentity"
7741
```
7842

7943
## Create AKS cluster
@@ -91,10 +55,10 @@ After a few minutes, the command completes and returns JSON-formatted informatio
9155
> [!NOTE]
9256
> When you create an AKS cluster, a second resource group is automatically created to store the AKS resources. For more information, see [Why are two resource groups created with AKS?][aks-two-resource-groups].
9357
94-
To get the OIDC Issuer URL and save it to an environmental variable, run the following command. Replace the default value for the cluster name.
58+
To get the OIDC Issuer URL and save it to an environmental variable, run the following command. Replace the default value for the arguments `-n`, which is the name of the cluster:
9559

9660
```bash
97-
export AKS_OIDC_ISSUER="$(az aks show -n myAKSCluster -g ${RESOURCE_GROUP} --query "oidcIssuerProfile.issuerUrl" -otsv)"
61+
export AKS_OIDC_ISSUER="$(az aks show -n myAKSCluster -g "${RESOURCE_GROUP}" --query "oidcIssuerProfile.issuerUrl" -otsv)"
9862
```
9963

10064
## Create a managed identity

0 commit comments

Comments
 (0)