Skip to content

Commit b3b7b68

Browse files
andyzhangxandyzhangx
authored
Merge pull request #938 from andyzhangx/refine-wi-doc
doc: refine workload identity doc
2 parents ca56bdd + d189641 commit b3b7b68

File tree

2 files changed

+22
-46
lines changed

2 files changed

+22
-46
lines changed

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ This option does not depend on cloud provider config file, supports cross subscr
6363
- [Basic usage](./deploy/example/e2e_usage.md)
6464
- [NFSv3](./deploy/example/nfs)
6565
- [fsGroupPolicy](./deploy/example/fsgroup)
66+
- [Workload identity](./docs/workload-identity.md)
6667
6768
### Troubleshooting
6869
- [CSI driver troubleshooting guide](./docs/csi-debug.md)

‎docs/workload-identity.md

Lines changed: 21 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,14 @@
1-
# How to Use workload identity with Blob CSI driver
1+
# workload identity support
2+
> Note:
3+
> - supported version: v1.22.0
4+
> - workload identity is supported on OpenShift, capz and other self-managed clusters
5+
> - workload identity is NOT supported on AKS **managed** Blob CSI driver since the driver controller is managed by AKS control plane which is already using [managed identity](https://learn.microsoft.com/en-us/azure/aks/use-managed-identity) by default, it's not necessary to use workload identity for AKS managed Blob CSI driver.
26
37
## Prerequisites
48

5-
This document is mainly refer to [Azure AD Workload Identity Quick Start](https://azure.github.io/azure-workload-identity/docs/quick-start.html). Please Complete the [Installation guide](https://azure.github.io/azure-workload-identity/docs/installation.html) before the following steps.
9+
Before proceeding with the following steps, please ensure that you have completed the [Workload Identity installation guide](https://azure.github.io/azure-workload-identity/docs/installation.html). After completing the installation, you should have already installed the mutating admission webhook and obtained the OIDC issuer URL for your cluster.
610

7-
After you finish the Installation guide, you should have already:
8-
9-
* installed the mutating admission webhook
10-
* obtained your cluster’s OIDC issuer URL
11-
12-
## 1. Export environment variables
11+
## 1. Set environment variables
1312

1413
```shell
1514
export CLUSTER_NAME="<your cluster name>"
@@ -34,54 +33,40 @@ export SA_LIST=( "csi-blob-controller-sa" "csi-blob-node-sa" )
3433
export NAMESPACE="kube-system"
3534
```
3635

37-
## 2. Create Blob resource group
38-
39-
If you are using AKS, you can get the resource group where Blob storage class reside by running:
40-
41-
```shell
42-
export AZURE_BLOB_RESOURCE_GROUP="$(az aks show --name $CLUSTER_NAME --resource-group $CLUSTER_RESOURCE_GROUP --query "nodeResourceGroup" -o tsv)"
43-
```
44-
45-
You can also create resource group by yourself, but you must [specify the resource group](https://github.com/cvvz/blob-csi-driver/blob/workload_identity/docs/driver-parameters.md) in the storage class while using Blob CSI driver:
36+
## 2. Create an AAD application or user-assigned managed identity and grant required permissions
4637

4738
```shell
48-
az group create -n $AZURE_BLOB_RESOURCE_GROUP -l $LOCATION
49-
```
50-
51-
## 3. Create an AAD application or user-assigned managed identity and grant required permissions
52-
53-
```shell
54-
# create an AAD application if using Azure AD Application for this tutorial
39+
# create an AAD application if you are using Azure AD Application
5540
az ad sp create-for-rbac --name "${APPLICATION_NAME}"
5641
```
5742

5843
```shell
59-
# create a user-assigned managed identity if using user-assigned managed identity for this tutorial
44+
# create a user-assigned managed identity if you are using user-assigned managed identity
6045
az group create -n ${IDENTITY_RESOURCE_GROUP} -l $LOCATION
6146
az identity create --name "${USER_ASSIGNED_IDENTITY_NAME}" --resource-group "${IDENTITY_RESOURCE_GROUP}"
6247
```
6348

6449
Grant required permission to the AAD application or user-assigned managed identity, for simplicity, we just assign Contributor role to the resource group where Blob storage class reside:
6550

66-
If using Azure AD Application:
51+
- if you are using Azure AD Application:
6752

6853
```shell
6954
export APPLICATION_CLIENT_ID="$(az ad sp list --display-name "${APPLICATION_NAME}" --query '[0].appId' -otsv)"
7055
export AZURE_BLOB_RESOURCE_GROUP_ID="$(az group show -n $AZURE_BLOB_RESOURCE_GROUP --query 'id' -otsv)"
7156
az role assignment create --assignee $APPLICATION_CLIENT_ID --role Contributor --scope $AZURE_BLOB_RESOURCE_GROUP_ID
7257
```
7358

74-
if using user-assigned managed identity:
59+
- if you are using user-assigned managed identity:
7560

7661
```shell
7762
export USER_ASSIGNED_IDENTITY_OBJECT_ID="$(az identity show --name "${USER_ASSIGNED_IDENTITY_NAME}" --resource-group "${IDENTITY_RESOURCE_GROUP}" --query 'principalId' -otsv)"
7863
export AZURE_BLOB_RESOURCE_GROUP_ID="$(az group show -n $AZURE_BLOB_RESOURCE_GROUP --query 'id' -otsv)"
7964
az role assignment create --assignee $USER_ASSIGNED_IDENTITY_OBJECT_ID --role Contributor --scope $AZURE_BLOB_RESOURCE_GROUP_ID
8065
```
8166

82-
## 4. Establish federated identity credential between the identity and the Blob service account issuer & subject
67+
## 3. Establish federated identity credential between the identity and the Blob service account issuer & subject
8368

84-
If using Azure AD Application:
69+
- if you are using Azure AD Application:
8570

8671
```shell
8772
# Get the object ID of the AAD application
@@ -105,7 +90,7 @@ az ad app federated-credential create --id ${APPLICATION_OBJECT_ID} --parameters
10590
done
10691
```
10792

108-
If using user-assigned managed identity:
93+
- if you are using user-assigned managed identity:
10994

11095
```shell
11196
for SERVICE_ACCOUNT_NAME in "${SA_LIST[@]}"
@@ -119,18 +104,10 @@ az identity federated-credential create \
119104
done
120105
```
121106

122-
## 5. Deploy Blob CSI Driver
107+
## 4. Install CSI driver manually
108+
> workload identity is NOT supported on AKS **managed** Blob CSI driver
123109
124-
Deploy storageclass:
125-
126-
```shell
127-
kubectl create -f https://raw.githubusercontent.com/kubernetes-sigs/blob-csi-driver/master/deploy/example/storageclass-blobfuse.yaml
128-
kubectl create -f https://raw.githubusercontent.com/kubernetes-sigs/blob-csi-driver/master/deploy/example/storageclass-blob-nfs.yaml
129-
```
130-
131-
Deploy Blob CSI Driver
132-
133-
If using Azure AD Application:
110+
- if you are using Azure AD Application:
134111

135112
```shell
136113
export CLIENT_ID="$(az ad sp list --display-name "${APPLICATION_NAME}" --query '[0].appId' -otsv)"
@@ -141,7 +118,7 @@ helm install blob-csi-driver charts/latest/blob-csi-driver \
141118
--set workloadIdentity.tenantID=$TENANT_ID
142119
```
143120

144-
If using user-assigned managed identity:
121+
- if you are using user-assigned managed identity:
145122

146123
```shell
147124
export CLIENT_ID="$(az identity show --name "${USER_ASSIGNED_IDENTITY_NAME}" --resource-group "${IDENTITY_RESOURCE_GROUP}" --query 'clientId' -otsv)"
@@ -152,11 +129,9 @@ helm install blob-csi-driver charts/latest/blob-csi-driver \
152129
--set workloadIdentity.tenantID=$TENANT_ID
153130
```
154131

155-
## 6. Deploy application using Blob CSI driver
132+
## 5. Deploy application using CSI driver volume
156133

157134
```shell
135+
kubectl create -f https://raw.githubusercontent.com/kubernetes-sigs/blob-csi-driver/master/deploy/example/storageclass-blobfuse.yaml
158136
kubectl create -f https://raw.githubusercontent.com/kubernetes-sigs/blob-csi-driver/master/deploy/example/nfs/statefulset.yaml
159-
kubectl create -f https://raw.githubusercontent.com/kubernetes-sigs/blob-csi-driver/master/deploy/example/deployment.yaml
160137
```
161-
162-
Please make sure all the Pods are running.

0 commit comments

Comments
 (0)