Skip to content

Commit e9120f3

Browse files
shawnmariejonesshawnmariejones
authored
Merge pull request #103809 from trevorbye/master
new aad article
2 parents ce6c630 + c222bd5 commit e9120f3

File tree

2 files changed

+176
-0
lines changed

2 files changed

+176
-0
lines changed

‎articles/machine-learning/how-to-use-azure-ad-identity.md

Lines changed: 174 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
---
2+
title: Use AAD identity with your web service
3+
titleSuffix: Azure Machine Learning
4+
description: Use AAD identity with your web service in Azure Kubernetes Service to access cloud resources during scoring.
5+
services: machine-learning
6+
author: trevorbye
7+
ms.author: trbye
8+
ms.reviewer: aashishb
9+
ms.service: machine-learning
10+
ms.subservice: core
11+
ms.topic: conceptual
12+
ms.date: 02/10/2020
13+
---
14+
15+
# Use Azure AD identity with your machine learning web service in Azure Kubernetes Service
16+
17+
In this how-to, you learn how to assign an Azure Active Directory (AAD) identity to your deployed machine learning model in Azure Kubernetes Service. The [AAD Pod Identity](https://github.com/Azure/aad-pod-identity) project allows applications to access cloud resources securely with AAD by using a [Managed Identity](https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview) and Kubernetes primitives. This allows your web service to securely access your Azure resources without having to embed credentials or manage tokens directly inside your `score.py` script. This article explains the steps to create and install an Azure Identity in your Azure Kubernetes Service cluster and assign the identity to your deployed web service.
18+
19+
## Prerequisites
20+
21+
- The [Azure CLI extension for the Machine Learning service](reference-azure-machine-learning-cli.md), the [Azure Machine Learning SDK for Python](https://docs.microsoft.com/python/api/overview/azure/ml/intro?view=azure-ml-py), or the [Azure Machine Learning Visual Studio Code extension](tutorial-setup-vscode-extension.md).
22+
23+
- Access to your AKS cluster using the `kubectl` command. For more information, see [Connect to the cluster](https://docs.microsoft.com/azure/aks/kubernetes-walkthrough#connect-to-the-cluster)
24+
25+
- An Azure Machine Learning web service deployed to your AKS cluster.
26+
27+
## Create and install an Azure Identity in your AKS cluster
28+
29+
1. To determine if your AKS cluster is RBAC enabled, use the following command:
30+
31+
```azurecli-interactive
32+
az aks show --name <AKS cluster name> --resource-group <resource group name> --subscription <subscription id> --query enableRbac
33+
```
34+
35+
This command returns a value of `true` if RBAC is enabled. This value determines the command to use in the next step.
36+
37+
1. To install [AAD Pod Identity](https://github.com/Azure/aad-pod-identity#getting-started) in your AKS cluster, use one of the following commands:
38+
39+
* If your AKS cluster has **RBAC enabled** use the following command:
40+
41+
```azurecli-interactive
42+
kubectl apply -f https://raw.githubusercontent.com/Azure/aad-pod-identity/master/deploy/infra/deployment-rbac.yaml
43+
```
44+
45+
* If your AKS cluster **does not have RBAC enabled**, use the following command:
46+
47+
```azurecli-interactive
48+
kubectl apply -f https://raw.githubusercontent.com/Azure/aad-pod-identity/master/deploy/infra/deployment.yaml
49+
```
50+
51+
The output of the command is similar to the following text:
52+
53+
```text
54+
customresourcedefinition.apiextensions.k8s.io/azureassignedidentities.aadpodidentity.k8s.io created
55+
customresourcedefinition.apiextensions.k8s.io/azureidentitybindings.aadpodidentity.k8s.io created
56+
customresourcedefinition.apiextensions.k8s.io/azureidentities.aadpodidentity.k8s.io created
57+
customresourcedefinition.apiextensions.k8s.io/azurepodidentityexceptions.aadpodidentity.k8s.io created
58+
daemonset.apps/nmi created
59+
deployment.apps/mic created
60+
```
61+
62+
1. [Create an Azure Identity](https://github.com/Azure/aad-pod-identity#2-create-an-azure-identity) following the steps shown in AAD Pod Identity project page.
63+
64+
1. [Install the Azure Identity](https://github.com/Azure/aad-pod-identity#3-install-the-azure-identity) following the steps shown in AAD Pod Identity project page.
65+
66+
1. [Install the Azure Identity Binding](https://github.com/Azure/aad-pod-identity#5-install-the-azure-identity-binding) following the steps shown in AAD Pod Identity project page.
67+
68+
1. If the Azure Identity created in the previous step is not in the same resource group as your AKS cluster, follow [Set Permissions for MIC](https://github.com/Azure/aad-pod-identity#6-set-permissions-for-mic) following the steps shown in AAD Pod Identity project page.
69+
70+
## Assign Azure Identity to machine learning web service
71+
72+
The following steps use the Azure Identity created in the previous section, and assign it to your AKS web service through a **selector label**.
73+
74+
First, identify the name and namespace of your deployment in your AKS cluster that you want to assign the Azure Identity. You can get this information by running the following command. The namespaces should be your Azure Machine Learning workspace name and your deployment name should be your endpoint name as shown in the portal.
75+
76+
```azurecli-interactive
77+
kubectl get deployment --selector=isazuremlapp=true --all-namespaces --show-labels
78+
```
79+
80+
Add the Azure Identity selector label to your deployment by editing the deployment spec. The selector value should be the one that you defined in step 5 of [Install the Azure Identity Binding](https://github.com/Azure/aad-pod-identity#5-install-the-azure-identity-binding).
81+
82+
```yaml
83+
apiVersion: "aadpodidentity.k8s.io/v1"
84+
kind: AzureIdentityBinding
85+
metadata:
86+
name: demo1-azure-identity-binding
87+
spec:
88+
AzureIdentity: <a-idname>
89+
Selector: <label value to match>
90+
```
91+
92+
Edit the deployment to add the Azure Identity selector label. Go to the following section under `/spec/template/metadata/labels`. You should see values such as `isazuremlapp: “true”`. Add the aad-pod-identity label like shown below.
93+
94+
```azurecli-interactive
95+
kubectl edit deployment/<name of deployment> -n azureml-<name of workspace>
96+
```
97+
98+
```yaml
99+
spec:
100+
template:
101+
metadata:
102+
labels:
103+
- aadpodidbinding: "<value of Selector in AzureIdentityBinding>"
104+
...
105+
```
106+
107+
To verify that the label was correctly added, run the following command.
108+
109+
```azurecli-interactive
110+
kubectl get deployment <name of deployment> -n azureml-<name of workspace> --show-labels
111+
```
112+
113+
To see all pod statuses, run the following command.
114+
115+
```azurecli-interactive
116+
kubectl get pods -n azureml-<name of workspace>
117+
```
118+
119+
Once the pods are up and running, the web services for this deployment will now be able to access Azure resources through your Azure Identity without having to embed the credentials in your code.
120+
121+
## Assign the appropriate roles to your Azure Identity
122+
123+
[Assign your Azure Managed Identity with appropriate roles](https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-portal) to access other Azure resources. Ensure that the roles you are assigning have the correct **Data Actions**. For example, the [Storage Blob Data Reader Role](https://docs.microsoft.com/azure/role-based-access-control/built-in-roles#storage-blob-data-reader) will have read permissions to your Storage Blob while the generic [Reader Role](https://docs.microsoft.com/azure/role-based-access-control/built-in-roles#reader) might not.
124+
125+
## Use Azure Identity with your machine learning web service
126+
127+
Deploy a model to your AKS cluster. The `score.py` script can contain operations pointing to the Azure resources that your Azure Identity has access to. Ensure that you have installed your required client library dependencies for the resource that you are trying to access to. Below are a couple examples of how you can use your Azure Identity to access different Azure resources from your service.
128+
129+
### Access Key Vault from your web service
130+
131+
If you have given your Azure Identity read access to a secret inside a **Key Vault**, your `score.py` can access it using the following code.
132+
133+
```python
134+
from azure.identity import DefaultAzureCredential
135+
from azure.keyvault.secrets import SecretClient
136+
137+
my_vault_name = "yourkeyvaultname"
138+
my_vault_url = "https://{}.vault.azure.net/".format(my_vault_name)
139+
my_secret_name = "sample-secret"
140+
141+
# This will use your Azure Managed Identity
142+
credential = DefaultAzureCredential()
143+
secret_client = SecretClient(
144+
vault_url=my_vault_url,
145+
credential=credential)
146+
secret = secret_client.get_secret(my_secret_name)
147+
```
148+
149+
### Access Blob from your web service
150+
151+
If you have given your Azure Identity read access to data inside a **Storage Blob**, your `score.py` can access it using the following code.
152+
153+
```python
154+
from azure.identity import DefaultAzureCredential
155+
from azure.storage.blob import BlobServiceClient
156+
157+
my_storage_account_name = "yourstorageaccountname"
158+
my_storage_account_url = "https://{}.blob.core.windows.net/".format(my_storage_account_name)
159+
160+
# This will use your Azure Managed Identity
161+
credential = DefaultAzureCredential()
162+
blob_service_client = BlobServiceClient(
163+
account_url=my_storage_account_url,
164+
credential=credential
165+
)
166+
blob_client = blob_service_client.get_blob_client(container="some-container", blob="some_text.txt")
167+
blob_data = blob_client.download_blob()
168+
blob_data.readall()
169+
```
170+
171+
## Next steps
172+
173+
* For more information on how to use the Python Azure Identity client library, see the [repository](https://github.com/Azure/azure-sdk-for-python/tree/master/sdk/identity/azure-identity#azure-identity-client-library-for-python) on GitHub.
174+
* For a detailed guide on deploying models to Azure Kubernetes Service clusters, see the [how-to](how-to-deploy-azure-kubernetes-service.md).

‎articles/machine-learning/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,8 @@
131131
href: how-to-enable-virtual-network.md
132132
- name: Secure web services with SSL
133133
href: how-to-secure-web-service.md
134+
- name: Use Azure AD identity in AKS deployments
135+
href: how-to-use-azure-ad-identity.md
134136
- name: Regenerate storage access keys
135137
href: how-to-change-storage-access-key.md
136138
- name: Set up authentication

0 commit comments

Comments
 (0)