Skip to content

Commit 25c7b0a

Browse files
cvvzcvvz
committed
docs
1 parent e2d3f30 commit 25c7b0a

File tree

1 file changed

+30
-33
lines changed

1 file changed

+30
-33
lines changed

‎docs/workload-identity.md

Lines changed: 30 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# How to Use workload identity with Azurefile
1+
# How to Use workload identity with Blob CSI driver
22

33
## Prerequisites
44

@@ -9,20 +9,16 @@ After you finish the Installation guide, you should have already:
99
* installed the mutating admission webhook
1010
* obtained your cluster’s OIDC issuer URL
1111

12-
## 1. Enable Azure Workload Identity Mutating Webhook injection to Pod in the `kube-system` namespace
13-
14-
Per [azure-workload-identity Known Issues](https://github.com/Azure/azure-workload-identity/blob/main/docs/book/src/known-issues.md#environment-variables-not-injected-into-pods-deployed-in-the-kube-system-namespace-in-an-aks-cluster), if you're deploying Azurefile in the `kube-system` namespace of an AKS cluster, add the `"admissions.enforcer/disabled": "true"` label or annotation in the [MutatingWebhookConfiguration](https://github.com/Azure/azure-workload-identity/blob/8644a217f09902fa1ac63e05cf04d9a3f3f1ebc3/deploy/azure-wi-webhook.yaml#L206-L235).
15-
16-
## 2. Export environment variables
12+
## 1. Export environment variables
1713

1814
```shell
1915
export CLUSTER_NAME="<your cluster name>"
2016
export CLUSTER_RESOURCE_GROUP="<cluster resource group name>"
2117
export LOCATION="<location>"
2218
export OIDC_ISSUER="<your cluster’s OIDC issuer URL>"
2319

24-
# [OPTIONAL] resource group where Azurefile storage account reside
25-
export AZURE_FILE_RESOURCE_GROUP="<resource group where Azurefile storage account reside>"
20+
# [OPTIONAL] resource group where Blob storage account reside
21+
export AZURE_BLOB_RESOURCE_GROUP="<resource group where Blob storage account reside>"
2622

2723
# environment variables for the AAD application
2824
# [OPTIONAL] Only set this if you're using a Azure AD Application as part of this tutorial
@@ -33,26 +29,26 @@ export APPLICATION_NAME="<your application name>"
3329
export USER_ASSIGNED_IDENTITY_NAME="<your user-assigned managed identity name>"
3430
export IDENTITY_RESOURCE_GROUP="<resource group where your user-assigned managed identity reside>"
3531

36-
# Azurefile CSI Driver Service Account and namespace
37-
export SA_LIST=( "csi-azurefile-controller-sa" "csi-azurefile-node-sa" )
32+
# Blob CSI Driver Service Account and namespace
33+
export SA_LIST=( "csi-blob-controller-sa" "csi-blob-node-sa" )
3834
export NAMESPACE="kube-system"
3935
```
4036

41-
## 3. Create Azurefile resource group
37+
## 2. Create Blob resource group
4238

43-
If you are using AKS, you can get the resource group where Azurefile storage class reside by running:
39+
If you are using AKS, you can get the resource group where Blob storage class reside by running:
4440

4541
```shell
46-
export AZURE_FILE_RESOURCE_GROUP="$(az aks show --name $CLUSTER_NAME --resource-group $CLUSTER_RESOURCE_GROUP --query "nodeResourceGroup" -o tsv)"
42+
export AZURE_BLOB_RESOURCE_GROUP="$(az aks show --name $CLUSTER_NAME --resource-group $CLUSTER_RESOURCE_GROUP --query "nodeResourceGroup" -o tsv)"
4743
```
4844

49-
You can also create resource group by yourself, but you must [specify the resource group](https://github.com/kubernetes-sigs/azurefile-csi-driver/blob/master/docs/driver-parameters.md#:~:text=current%20k8s%20cluster-,resourceGroup,No,-if%20empty%2C%20driver) in the storage class while using Azurefile.
45+
You can also create resource group by yourself, but you must [specify the resource group](https://github.com/cvvz/blob-csi-driver/blob/workload_identity/docs/driver-parameters.md) in the storage class while using Blob CSI driver:
5046

5147
```shell
52-
az group create -n $AZURE_FILE_RESOURCE_GROUP -l $LOCATION
48+
az group create -n $AZURE_BLOB_RESOURCE_GROUP -l $LOCATION
5349
```
5450

55-
## 4. Create an AAD application or user-assigned managed identity and grant required permissions
51+
## 3. Create an AAD application or user-assigned managed identity and grant required permissions
5652

5753
```shell
5854
# create an AAD application if using Azure AD Application for this tutorial
@@ -61,28 +57,29 @@ az ad sp create-for-rbac --name "${APPLICATION_NAME}"
6157

6258
```shell
6359
# create a user-assigned managed identity if using user-assigned managed identity for this tutorial
60+
az group create -n ${IDENTITY_RESOURCE_GROUP} -l $LOCATION
6461
az identity create --name "${USER_ASSIGNED_IDENTITY_NAME}" --resource-group "${IDENTITY_RESOURCE_GROUP}"
6562
```
6663

67-
Grant required permission to the AAD application or user-assigned managed identity, for simplicity, we just assign Contributor role to the resource group where Azurefile storage class reside:
64+
Grant required permission to the AAD application or user-assigned managed identity, for simplicity, we just assign Contributor role to the resource group where Blob storage class reside:
6865

6966
If using Azure AD Application:
7067

7168
```shell
7269
export APPLICATION_CLIENT_ID="$(az ad sp list --display-name "${APPLICATION_NAME}" --query '[0].appId' -otsv)"
73-
export AZURE_FILE_RESOURCE_GROUP_ID="$(az group show -n $AZURE_FILE_RESOURCE_GROUP --query 'id' -otsv)"
74-
az role assignment create --assignee $APPLICATION_CLIENT_ID --role Contributor --scope $AZURE_FILE_RESOURCE_GROUP_ID
70+
export AZURE_BLOB_RESOURCE_GROUP_ID="$(az group show -n $AZURE_BLOB_RESOURCE_GROUP --query 'id' -otsv)"
71+
az role assignment create --assignee $APPLICATION_CLIENT_ID --role Contributor --scope $AZURE_BLOB_RESOURCE_GROUP_ID
7572
```
7673

7774
if using user-assigned managed identity:
7875

7976
```shell
8077
export USER_ASSIGNED_IDENTITY_OBJECT_ID="$(az identity show --name "${USER_ASSIGNED_IDENTITY_NAME}" --resource-group "${IDENTITY_RESOURCE_GROUP}" --query 'principalId' -otsv)"
81-
export AZURE_FILE_RESOURCE_GROUP_ID="$(az group show -n $AZURE_FILE_RESOURCE_GROUP --query 'id' -otsv)"
82-
az role assignment create --assignee $USER_ASSIGNED_IDENTITY_OBJECT_ID --role Contributor --scope $AZURE_FILE_RESOURCE_GROUP_ID
78+
export AZURE_BLOB_RESOURCE_GROUP_ID="$(az group show -n $AZURE_BLOB_RESOURCE_GROUP --query 'id' -otsv)"
79+
az role assignment create --assignee $USER_ASSIGNED_IDENTITY_OBJECT_ID --role Contributor --scope $AZURE_BLOB_RESOURCE_GROUP_ID
8380
```
8481

85-
## 5. Establish federated identity credential between the identity and the Azurefile service account issuer & subject
82+
## 4. Establish federated identity credential between the identity and the Blob service account issuer & subject
8683

8784
If using Azure AD Application:
8885

@@ -122,25 +119,25 @@ az identity federated-credential create \
122119
done
123120
```
124121

125-
## 6. Deploy Azurefile
122+
## 5. Deploy Blob CSI Driver
126123

127124
Deploy storageclass:
128125

129126
```shell
130-
kubectl create -f https://raw.githubusercontent.com/kubernetes-sigs/azurefile-csi-driver/master/deploy/example/storageclass-azurefile-csi.yaml
131-
kubectl create -f https://raw.githubusercontent.com/kubernetes-sigs/azurefile-csi-driver/master/deploy/example/storageclass-azurefile-nfs.yaml
127+
kubectl create -f https://raw.githubusercontent.com/kubernetes-sigs/blob-csi-driver/master/deploy/example/storageclass-blobfuse.yaml
128+
kubectl create -f https://raw.githubusercontent.com/kubernetes-sigs/blob-csi-driver/master/deploy/example/storageclass-blob-nfs.yaml
132129
```
133130

134-
Deploy Azurefile(If you are using AKS, please disable the managed Azurefile CSI driver by `--disable-file-driver` first)
131+
Deploy Blob CSI Driver
135132

136133
If using Azure AD Application:
137134

138135
```shell
139136
export CLIENT_ID="$(az ad sp list --display-name "${APPLICATION_NAME}" --query '[0].appId' -otsv)"
140137
export TENANT_ID="$(az ad sp list --display-name "${APPLICATION_NAME}" --query '[0].appOwnerOrganizationId' -otsv)"
141-
helm install azurefile-csi-driver charts/latest/azurefile-csi-driver \
138+
helm install blob-csi-driver charts/latest/blob-csi-driver \
142139
--namespace $NAMESPACE \
143-
--set workloadIdentity.clientID=$CLIENT_ID
140+
--set workloadIdentity.clientID=$CLIENT_ID \
144141
--set workloadIdentity.tenantID=$TENANT_ID
145142
```
146143

@@ -149,17 +146,17 @@ If using user-assigned managed identity:
149146
```shell
150147
export CLIENT_ID="$(az identity show --name "${USER_ASSIGNED_IDENTITY_NAME}" --resource-group "${IDENTITY_RESOURCE_GROUP}" --query 'clientId' -otsv)"
151148
export TENANT_ID="$(az identity show --name "${USER_ASSIGNED_IDENTITY_NAME}" --resource-group "${IDENTITY_RESOURCE_GROUP}" --query 'tenantId' -otsv)"
152-
helm install azurefile-csi-driver charts/latest/azurefile-csi-driver \
149+
helm install blob-csi-driver charts/latest/blob-csi-driver \
153150
--namespace $NAMESPACE \
154-
--set workloadIdentity.clientID=$CLIENT_ID
151+
--set workloadIdentity.clientID=$CLIENT_ID \
155152
--set workloadIdentity.tenantID=$TENANT_ID
156153
```
157154

158-
## 7. Deploy application using Azurefile
155+
## 6. Deploy application using Blob CSI driver
159156

160157
```shell
161-
kubectl create -f https://raw.githubusercontent.com/kubernetes-sigs/azurefile-csi-driver/master/deploy/example/nfs/statefulset.yaml
162-
kubectl create -f https://raw.githubusercontent.com/kubernetes-sigs/azurefile-csi-driver/master/deploy/example/deployment.yaml
158+
kubectl create -f https://raw.githubusercontent.com/kubernetes-sigs/blob-csi-driver/master/deploy/example/nfs/statefulset.yaml
159+
kubectl create -f https://raw.githubusercontent.com/kubernetes-sigs/blob-csi-driver/master/deploy/example/deployment.yaml
163160
```
164161

165162
Please make sure all the Pods are running.

0 commit comments

Comments
 (0)