Skip to content

Commit d90a0d3

Browse files
RichardChen820RichardChen820
committed
Revert the workload identity support
1 parent 6195248 commit d90a0d3

File tree

1 file changed

+9
-60
lines changed

1 file changed

+9
-60
lines changed

‎articles/azure-app-configuration/reference-kubernetes-provider.md

Lines changed: 9 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -32,19 +32,12 @@ The `spec.target` property has the following child property.
3232
|---|---|---|---|
3333
|configMapName|The name of the ConfigMap to be created|true|string|
3434

35-
The `spec.auth` property isn't required if the connection string of your App Configuration store is provided by setting the `spec.connectionStringReference` property. Otherwise, one of the identities, service principal, workload identity, or managed identity, will be used for authentication. The `spec.auth` has the following child properties. Only one of them should be specified. If none of them are set, the system-assigned managed identity of the virtual machine scale set will be used.
35+
If the `spec.auth` property isn't set, the system-assigned managed identity is used. It has the following child properties. Only one authentication method should be set.
3636

3737
|Name|Description|Required|Type|
3838
|---|---|---|---|
39+
|managedIdentityClientId|The Client ID of user-assigned managed identity|false|string|
3940
|servicePrincipalReference|The name of the Kubernetes Secret that contains the credentials of a service principal|false|string|
40-
|workloadIdentity|The settings for using workload identity|false|object|
41-
|managedIdentityClientId|The Client ID of user-assigned managed identity of virtual machine scale set|false|string|
42-
43-
The `spec.auth.workloadIdentity` property has the following child property.
44-
45-
|Name|Description|Required|Type|
46-
|---|---|---|---|
47-
|managedIdentityClientId|The Client ID of the user-assigned managed identity associated with the workload identity|true|string|
4841

4942
The `spec.keyValues` has the following child properties. The `spec.keyValues.keyVaults` property is required if any Key Vault references are expected to be downloaded.
5043

@@ -79,19 +72,17 @@ If the `spec.keyValues.keyVaults.auth` property isn't set, the system-assigned m
7972

8073
|Name|Description|Required|Type|
8174
|---|---|---|---|
75+
|managedIdentityClientId|The client ID of a user-assigned managed identity used for authentication with vaults that don't have individual authentication methods specified|false|string|
8276
|servicePrincipalReference|The name of the Kubernetes Secret that contains the credentials of a service principal used for authentication with vaults that don't have individual authentication methods specified|false|string|
83-
|workloadIdentity|The settings of the workload identity used for authentication with vaults that don't have individual authentication methods specified. It has the same child properties as `spec.auth.workloadIdentity`|false|object|
84-
|managedIdentityClientId|The client ID of a user-assigned managed identity of virtual machine scale set used for authentication with vaults that don't have individual authentication methods specified|false|string|
8577
|vaults|The authentication methods for individual vaults|false|object array|
8678

87-
The authentication method of each *vault* can be specified with the following properties. One of `managedIdentityClientId`, `servicePrincipalReference` or `workloadIdentity` must be provided.
79+
The authentication method of each *vault* can be specified with the following properties. One of `managedIdentityClientId` and `servicePrincipalReference` must be provided.
8880

8981
|Name|Description|Required|Type|
9082
|---|---|---|---|
9183
|uri|The URI of a vault|true|string|
84+
|managedIdentityClientId|The client ID of a user-assigned managed identity used for authentication with a vault|false|string|
9285
|servicePrincipalReference|The name of the Kubernetes Secret that contains the credentials of a service principal used for authentication with a vault|false|string|
93-
|workloadIdentity|The settings of the workload identity used for authentication with a vault. It has the same child properties as `spec.auth.workloadIdentity`|false|object|
94-
|managedIdentityClientId|The client ID of a user-assigned managed identity of virtual machine scale set used for authentication with a vault|false|string|
9586

9687
The `spec.keyValues.refresh` property has the following child properties.
9788

@@ -111,12 +102,10 @@ The `spec.keyValues.refresh.monitoring.keyValues` is an array of objects, which
111102

112103
### Authentication
113104

114-
#### Use system-assigned managed identity of virtual machine scale set
105+
#### Use System-Assigned Managed Identity
115106

116107
1. [Enable the system-assigned managed identity in the virtual machine scale set](/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vmss#enable-system-assigned-managed-identity-on-an-existing-virtual-machine-scale-set) used by the Azure Kubernetes Service (AKS) cluster.
117-
118108
1. [Grant the system-assigned managed identity **App Configuration Data Reader** role](/azure/azure-app-configuration/howto-integrate-azure-managed-service-identity#grant-access-to-app-configuration) in Azure App Configuration.
119-
120109
1. Deploy the following sample `AzureAppConfigurationProvider` resource to the AKS cluster.
121110

122111
``` yaml
@@ -130,14 +119,11 @@ The `spec.keyValues.refresh.monitoring.keyValues` is an array of objects, which
130119
configMapName: configmap-created-by-appconfig-provider
131120
```
132121
133-
#### Use user-assigned managed identity of virtual machine scale set
122+
#### Use User-Assigned Managed Identity
134123
135124
1. [Create a user-assigned managed identity](/azure/active-directory/managed-identities-azure-resources/how-manage-user-assigned-managed-identities#create-a-user-assigned-managed-identity) and note down its client ID after creation.
136-
137125
1. [Assign the user-assigned managed identity to the virtual machine scale set](/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vmss#user-assigned-managed-identity) used by the Azure Kubernetes Service (AKS) cluster.
138-
139126
1. [Grant the user-assigned managed identity **App Configuration Data Reader** role](/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vmss#user-assigned-managed-identity) in Azure App Configuration.
140-
141127
1. Set the `spec.auth.managedIdentityClientId` property to the client ID of the user-assigned managed identity in the following sample `AzureAppConfigurationProvider` resource and deploy it to the AKS cluster.
142128

143129
``` yaml
@@ -153,14 +139,11 @@ The `spec.keyValues.refresh.monitoring.keyValues` is an array of objects, which
153139
managedIdentityClientId: <your-managed-identity-client-id>
154140
```
155141

156-
#### Use service principal
142+
#### Use Service Principal
157143

158144
1. [Create a Service Principal](/azure/active-directory/develop/howto-create-service-principal-portal)
159-
160145
1. [Grant the service principal **App Configuration Data Reader** role](/azure/azure-app-configuration/howto-integrate-azure-managed-service-identity#grant-access-to-app-configuration) in Azure App Configuration.
161-
162146
1. Create a Kubernetes Secret in the same namespace as the `AzureAppConfigurationProvider` resource and add *azure_client_id*, *azure_client_secret*, and *azure_tenant_id* of the service principal to the Secret.
163-
164147
1. Set the `spec.auth.servicePrincipalReference` property to the name of the Secret in the following sample `AzureAppConfigurationProvider` resource and deploy it to the Kubernetes cluster.
165148

166149
``` yaml
@@ -176,42 +159,9 @@ The `spec.keyValues.refresh.monitoring.keyValues` is an array of objects, which
176159
servicePrincipalReference: <your-service-principal-secret-name>
177160
```
178161

179-
#### Use workload identity
180-
181-
1. [Enable Workload Identity](/azure/aks/workload-identity-deploy-cluster#update-an-existing-aks-cluster) on the Azure Kubernetes Service (AKS) cluster.
182-
183-
1. [Get the OIDC issuer URL](/azure/aks/workload-identity-deploy-cluster#retrieve-the-oidc-issuer-url) of the AKS cluster.
184-
185-
1. [Create a user-assigned managed identity](/azure/active-directory/managed-identities-azure-resources/how-manage-user-assigned-managed-identities#create-a-user-assigned-managed-identity) and note down its client ID after creation.
186-
187-
1. Create the federated identity credential between the managed identity, OIDC issuer, and subject using the Azure CLI.
188-
189-
``` azurecli
190-
az identity federated-credential create --name "${FEDERATED_IDENTITY_CREDENTIAL_NAME}" --identity-name "${USER_ASSIGNED_IDENTITY_NAME}" --resource-group "${RESOURCE_GROUP}" --issuer "${AKS_OIDC_ISSUER}" --subject system:serviceaccount:azappconfig-system:az-appconfig-k8s-provider --audience api://AzureADTokenExchange
191-
```
192-
193-
1. [Grant the user-assigned managed identity **App Configuration Data Reader** role](/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vmss#user-assigned-managed-identity) in Azure App Configuration.
194-
195-
1. Set the `spec.auth.workloadIdentity.managedIdentityClientId` property to the client ID of the user-assigned managed identity in the following sample `AzureAppConfigurationProvider` resource and deploy it to the AKS cluster.
196-
197-
``` yaml
198-
apiVersion: azconfig.io/v1beta1
199-
kind: AzureAppConfigurationProvider
200-
metadata:
201-
name: appconfigurationprovider-sample
202-
spec:
203-
endpoint: <your-app-configuration-store-endpoint>
204-
target:
205-
configMapName: configmap-created-by-appconfig-provider
206-
auth:
207-
workloadIdentity:
208-
managedIdentityClientId: <your-managed-identity-client-id>
209-
```
210-
211-
#### Use connection string
162+
#### Use Connection String
212163

213164
1. Create a Kubernetes Secret in the same namespace as the `AzureAppConfigurationProvider` resource and add Azure App Configuration connection string with key *azure_app_configuration_connection_string* in the Secret.
214-
215165
1. Set the `spec.connectionStringReference` property to the name of the Secret in the following sample `AzureAppConfigurationProvider` resource and deploy it to the Kubernetes cluster.
216166

217167
``` yaml
@@ -224,7 +174,6 @@ The `spec.keyValues.refresh.monitoring.keyValues` is an array of objects, which
224174
target:
225175
configMapName: configmap-created-by-appconfig-provider
226176
```
227-
228177
### Key-value selection
229178

230179
Use the `selectors` property to filter the key-values to be downloaded from Azure App Configuration.

0 commit comments

Comments
 (0)