|
1 | 1 | ---
|
2 |
| -title: Migrate your Azure Kubernetes Service (AKS) pod to use workload identity (preview) |
| 2 | +title: Migrate your Azure Kubernetes Service (AKS) pod to use workload identity |
3 | 3 | description: In this Azure Kubernetes Service (AKS) article, you learn how to configure your Azure Kubernetes Service pod to authenticate with workload identity.
|
4 | 4 | ms.topic: article
|
5 | 5 | ms.custom: devx-track-azurecli
|
6 |
| -ms.date: 03/14/2023 |
| 6 | +ms.date: 04/24/2023 |
7 | 7 | ---
|
8 | 8 |
|
9 | 9 | # Migrate from pod managed-identity to workload identity
|
10 | 10 |
|
11 |
| -This article focuses on migrating from a pod-managed identity to Azure Active Directory (Azure AD) workload identity (preview) for your Azure Kubernetes Service (AKS) cluster. It also provides guidance depending on the version of the [Azure Identity][azure-identity-supported-versions] client library used by your container-based application. |
| 11 | +This article focuses on migrating from a pod-managed identity to Azure Active Directory (Azure AD) workload identity for your Azure Kubernetes Service (AKS) cluster. It also provides guidance depending on the version of the [Azure Identity][azure-identity-supported-versions] client library used by your container-based application. |
12 | 12 |
|
13 | 13 | ## Before you begin
|
14 | 14 |
|
15 |
| -- The Azure CLI version 2.40.0 or later. Run `az --version` to find the version, and run `az upgrade` to upgrade the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli]. |
| 15 | +The Azure CLI version 2.40.0 or later. Run `az --version` to find the version, and run `az upgrade` to upgrade the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli]. |
16 | 16 |
|
17 | 17 | ## Migration scenarios
|
18 | 18 |
|
@@ -40,6 +40,9 @@ If your cluster isn't using the latest version of the Azure Identity SDK, you ha
|
40 | 40 | - [Deploy the workload with migration sidecar](#deploy-the-workload-with-migration-sidecar) to proxy the application IMDS transactions.
|
41 | 41 | - Once you verify the authentication transactions are completing successfully, you can [remove the pod-managed identity](#remove-pod-managed-identity) annotations from your application and then remove the pod-managed identity add-on.
|
42 | 42 |
|
| 43 | + > [!NOTE] |
| 44 | + > The migration sidecar is **not supported for production use**. This feature is meant to give you time to migrate your application SDK's to a supported version, and not meant or intended to be a long-term solution. |
| 45 | +
|
43 | 46 | - Rewrite your application to support the latest version of the [Azure Identity][azure-identity-supported-versions] client library. Afterwards, perform the following steps:
|
44 | 47 |
|
45 | 48 | - Restart your application deployment to begin authenticating using the workload identity.
|
@@ -115,7 +118,7 @@ az identity federated-credential create --name federatedIdentityName --identity-
|
115 | 118 | ## Deploy the workload with migration sidecar
|
116 | 119 |
|
117 | 120 | > [!NOTE]
|
118 |
| -> The migration sidecar is **not supported for production usage**. This feature was designed to give customers time to migrate there application SDK's to a supported version and not be a long running process. |
| 121 | +> The migration sidecar is **not supported for production use**. This feature is meant to give you time to migrate your application SDK's to a supported version, and not meant or intended to be a long-term solution. |
119 | 122 |
|
120 | 123 | If your application is using managed identity and still relies on IMDS to get an access token, you can use the workload identity migration sidecar to start migrating to workload identity. This sidecar is a migration solution and in the long-term applications, you should modify their code to use the latest Azure Identity SDKs that support client assertion.
|
121 | 124 |
|
@@ -195,7 +198,7 @@ After you've completed your testing and the application is successfully able to
|
195 | 198 |
|
196 | 199 | ## Next steps
|
197 | 200 |
|
198 |
| -This article showed you how to set up your pod to authenticate using a workload identity as a migration option. For more information about Azure AD workload identity (preview), see the following [Overview][workload-identity-overview] article. |
| 201 | +This article showed you how to set up your pod to authenticate using a workload identity as a migration option. For more information about Azure AD workload identity, see the following [Overview][workload-identity-overview] article. |
199 | 202 |
|
200 | 203 | <!-- INTERNAL LINKS -->
|
201 | 204 | [pod-annotations]: workload-identity-overview.md#pod-annotations
|
|
0 commit comments