Skip to content

Commit f66352c

Browse files
scottaddiescottaddie
committed
Add code samples to Azure Identity SDK section
1 parent 79deae1 commit f66352c

File tree

1 file changed

+158
-12
lines changed

1 file changed

+158
-12
lines changed

‎articles/aks/workload-identity-overview.md

Lines changed: 158 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Use an Azure AD workload identities on Azure Kubernetes Service (AKS)
33
description: Learn about Azure Active Directory workload identity for Azure Kubernetes Service (AKS) and how to migrate your application to authenticate using this identity.
44
ms.topic: article
55
ms.custom: build-2023
6-
ms.date: 08/18/2023
6+
ms.date: 08/24/2023
77
---
88

99
# Use Azure AD workload identity with Azure Kubernetes Service (AKS)
@@ -29,24 +29,170 @@ In the Azure Identity client libraries, choose one of the following approaches:
2929
- Create a `ChainedTokenCredential` instance that includes `WorkloadIdentityCredential`.
3030
- Use `WorkloadIdentityCredential` directly.
3131

32-
The following table provides the **minimum** package version required for each language's client library.
32+
The following table provides the **minimum** package version required for each language ecosystem's client library.
3333

34-
| Language | Library | Minimum Version | Example |
35-
|------------|------------------------------------------------------------------------------------------------------------------|-----------------|-----------------------------------------------------------------------------------------------------------------------------------|
36-
| .NET | [Azure.Identity](/dotnet/api/overview/azure/identity-readme) | 1.9.0 | [Link](https://github.com/Azure/azure-workload-identity/tree/main/examples/azure-identity/dotnet) |
37-
| C++ | [azure-identity-cpp](https://github.com/Azure/azure-sdk-for-cpp/blob/main/sdk/identity/azure-identity/README.md) | 1.6.0-beta.1 | [Link](https://github.com/Azure/azure-sdk-for-cpp/blob/main/sdk/identity/azure-identity/samples/workload_identity_credential.cpp) |
38-
| Go | [azidentity](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity) | 1.3.0 | [Link](https://github.com/Azure/azure-workload-identity/tree/main/examples/azure-identity/go) |
39-
| Java | [azure-identity](/java/api/overview/azure/identity-readme) | 1.9.0 | [Link](https://github.com/Azure/azure-workload-identity/tree/main/examples/azure-identity/java) |
40-
| JavaScript | [@azure/identity](/javascript/api/overview/azure/identity-readme) | 3.2.0 | [Link](https://github.com/Azure/azure-workload-identity/tree/main/examples/azure-identity/node) |
41-
| Python | [azure-identity](/python/api/overview/azure/identity-readme) | 1.13.0 | [Link](https://github.com/Azure/azure-workload-identity/tree/main/examples/azure-identity/python) |
34+
| Ecosystem | Library | Minimum Version |
35+
|-----------|------------------------------------------------------------------------------------------------------------------|-----------------|
36+
| .NET | [Azure.Identity](/dotnet/api/overview/azure/identity-readme) | 1.9.0 |
37+
| C++ | [azure-identity-cpp](https://github.com/Azure/azure-sdk-for-cpp/blob/main/sdk/identity/azure-identity/README.md) | 1.6.0-beta.1 |
38+
| Go | [azidentity](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity) | 1.3.0 |
39+
| Java | [azure-identity](/java/api/overview/azure/identity-readme) | 1.9.0 |
40+
| Node.js | [@azure/identity](/javascript/api/overview/azure/identity-readme) | 3.2.0 |
41+
| Python | [azure-identity](/python/api/overview/azure/identity-readme) | 1.13.0 |
4242

4343
† In the C++ library, `WorkloadIdentityCredential` isn't part of the `DefaultAzureCredential` authentication flow.
4444

45+
In the following code samples, `DefaultAzureCredential` is used. This credential type will use the environment variables injected by the Azure Workload Identity mutating webhook to authenticate with Azure Key Vault.
46+
47+
## [.NET](#tab/dotnet)
48+
49+
```csharp
50+
using Azure.Identity;
51+
using Azure.Security.KeyVault.Secrets;
52+
53+
string keyVaultUrl = Environment.GetEnvironmentVariable("KEYVAULT_URL");
54+
string secretName = Environment.GetEnvironmentVariable("SECRET_NAME");
55+
56+
var client = new SecretClient(
57+
new Uri(keyVaultUrl),
58+
new DefaultAzureCredential());
59+
60+
KeyVaultSecret secret = await client.GetSecretAsync(secretName);
61+
```
62+
63+
## [C++](#tab/cpp)
64+
65+
```cpp
66+
#include <cstdlib>
67+
#include <azure/identity.hpp>
68+
#include <azure/keyvault/secrets/secret_client.hpp>
69+
70+
using namespace Azure::Identity;
71+
using namespace Azure::Security::KeyVault::Secrets;
72+
73+
int main()
74+
{
75+
const char* keyVaultUrl = std::getenv("KEYVAULT_URL");
76+
const char* secretName = std::getenv("SECRET_NAME");
77+
auto credential = std::make_shared<DefaultAzureCredential>();
78+
79+
SecretClient client(keyVaultUrl, credential);
80+
Secret secret = client.GetSecret(secretName).Value;
81+
82+
return 0;
83+
}
84+
```
85+
86+
## [Go](#tab/go)
87+
88+
```go
89+
package main
90+
91+
import (
92+
"context"
93+
"os"
94+
95+
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
96+
"github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets"
97+
"k8s.io/klog/v2"
98+
)
99+
100+
func main() {
101+
keyVaultUrl := os.Getenv("KEYVAULT_URL")
102+
secretName := os.Getenv("SECRET_NAME")
103+
104+
credential, err := azidentity.NewDefaultAzureCredential(nil)
105+
if err != nil {
106+
klog.Fatal(err)
107+
}
108+
109+
client, err := azsecrets.NewClient(keyVaultUrl, credential, nil)
110+
if err != nil {
111+
klog.Fatal(err)
112+
}
113+
114+
secret, err := client.GetSecret(context.Background(), secretName, "", nil)
115+
if err != nil {
116+
klog.ErrorS(err, "failed to get secret", "keyvault", keyVaultUrl, "secretName", secretName)
117+
os.Exit(1)
118+
}
119+
}
120+
```
121+
122+
## [Java](#tab/java)
123+
124+
```java
125+
import java.util.Map;
126+
127+
import com.azure.security.keyvault.secrets.SecretClient;
128+
import com.azure.security.keyvault.secrets.SecretClientBuilder;
129+
import com.azure.security.keyvault.secrets.models.KeyVaultSecret;
130+
import com.azure.identity.DefaultAzureCredentialBuilder;
131+
import com.azure.identity.DefaultAzureCredential;
132+
133+
public class App {
134+
public static void main(String[] args) {
135+
Map<String, String> env = System.getenv();
136+
String keyVaultUrl = env.get("KEYVAULT_URL");
137+
String secretName = env.get("SECRET_NAME");
138+
139+
SecretClient client = new SecretClientBuilder()
140+
.vaultUrl(keyVaultUrl)
141+
.credential(new DefaultAzureCredentialBuilder().build())
142+
.buildClient();
143+
KeyVaultSecret secret = client.getSecret(secretName);
144+
}
145+
}
146+
```
147+
148+
## [Node.js](#tab/javascript)
149+
150+
```nodejs
151+
import { DefaultAzureCredential } from "@azure/identity";
152+
import { SecretClient } from "@azure/keyvault-secrets";
153+
154+
const main = async () => {
155+
const keyVaultUrl = process.env["KEYVAULT_URL"];
156+
const secretName = process.env["SECRET_NAME"];
157+
158+
const credential = new DefaultAzureCredential();
159+
const client = new SecretClient(keyVaultUrl, credential);
160+
161+
const secret = await client.getSecret(secretName);
162+
}
163+
164+
main().catch((error) => {
165+
console.error("An error occurred:", error);
166+
process.exit(1);
167+
});
168+
```
169+
170+
## [Python](#tab/python)
171+
172+
```python
173+
import os
174+
175+
from azure.keyvault.secrets import SecretClient
176+
from azure.identity import DefaultAzureCredential
177+
178+
def main():
179+
keyvault_url = os.getenv('KEYVAULT_URL', '')
180+
secret_name = os.getenv('SECRET_NAME', '')
181+
182+
client = SecretClient(vault_url=keyvault_url, credential=DefaultAzureCredential())
183+
secret = client.get_secret(secret_name)
184+
185+
if __name__ == '__main__':
186+
main()
187+
```
188+
189+
---
190+
45191
## Microsoft Authentication Library (MSAL)
46192

47-
The following client libraries are the **minimum** version required
193+
The following client libraries are the **minimum** version required.
48194

49-
| Language | Library | Image | Example | Has Windows |
195+
| Ecosystem | Library | Image | Example | Has Windows |
50196
|-----------|-----------|----------|----------|----------|
51197
| .NET | [microsoft-authentication-library-for-dotnet](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet) | ghcr.io/azure/azure-workload-identity/msal-net:latest | [Link](https://github.com/Azure/azure-workload-identity/tree/main/examples/msal-net/akvdotnet) | Yes |
52198
| Go | [microsoft-authentication-library-for-go](https://github.com/AzureAD/microsoft-authentication-library-for-go) | ghcr.io/azure/azure-workload-identity/msal-go:latest | [Link](https://github.com/Azure/azure-workload-identity/tree/main/examples/msal-go) | Yes |

0 commit comments

Comments
 (0)