Skip to content

Commit bd37282

Browse files
committed
docs: inheritFromAzureAD for managed identities (review #681)
Make explicit in docs that the inheritFromAzureAD option enables the usage of Azure Managed Identity authentication mechanism. Signed-off-by: Gabriele Fedi <[email protected]>
1 parent 853ec3c commit bd37282

File tree

1 file changed

+13
-6
lines changed

1 file changed

+13
-6
lines changed

web/docs/object_stores.md

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -232,12 +232,16 @@ Barman Cloud supports the following authentication methods:
232232
- [Connection String](https://learn.microsoft.com/en-us/azure/storage/common/storage-configure-connection-string)
233233
- Storage Account Name + [Access Key](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage)
234234
- Storage Account Name + [SAS Token](https://learn.microsoft.com/en-us/azure/storage/blobs/sas-service-create)
235-
- [Azure AD Workload Identity](https://azure.github.io/azure-workload-identity/docs/introduction.html)
235+
- [Azure AD Managed Identities](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview)
236+
- [Default Azure Credentials](https://learn.microsoft.com/en-us/dotnet/api/azure.identity.defaultazurecredential?view=azure-dotnet)
236237

237-
### Azure AD Workload Identity
238+
### Azure AD Managed Identity
238239

239-
This method avoids storing credentials in Kubernetes via the
240-
`.spec.configuration.inheritFromAzureAD` option:
240+
This method avoids storing credentials in Kubernetes by enabling the
241+
usage of [Azure Managed Identities](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview) authentication mechanism.
242+
This can be enabled by setting the `inheritFromAzureAD` option to `true`.
243+
Managed Identitity can be configured for the AKS Cluster by following
244+
the [Azure documentation](https://learn.microsoft.com/en-us/azure/aks/use-managed-identity?pivots=system-assigned).
241245

242246
```yaml
243247
apiVersion: barmancloud.cnpg.io/v1
@@ -263,8 +267,11 @@ to automatically discover and use available credentials in the following order:
263267
3. **Azure CLI** — Uses credentials from the Azure CLI if available
264268
4. **Azure PowerShell** — Uses credentials from Azure PowerShell if available
265269

266-
This is particularly useful when running on Azure Kubernetes Service (AKS) with
267-
[Workload Identity](https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview):
270+
This approach is particularly useful for getting started with development and testing; it allows
271+
the SDK to attempt multiple authentication mechanisms seamlessly across different environments.
272+
However, this is not recommended for production. Please refer to the
273+
[official Azure guidance](https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication/credential-chains?tabs=dac#usage-guidance-for-defaultazurecredential)
274+
for a comprehensive understanding of `DefaultAzureCredential`.
268275

269276
```yaml
270277
apiVersion: barmancloud.cnpg.io/v1

0 commit comments

Comments
 (0)