Skip to content

Commit d28d57b

Browse files
authored
Update workload-identity-static-pv-mount.md
1 parent 6dc3983 commit d28d57b

File tree

1 file changed

+2
-45
lines changed

1 file changed

+2
-45
lines changed

docs/workload-identity-static-pv-mount.md

Lines changed: 2 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,6 @@
1-
# Example of static PV mount with workload identity
2-
1+
# workload identity support on static provisioning
32
- supported from v1.23.3
4-
5-
## prerequisites
6-
7-
3+
## Prerequisites
84
### 1. Create a cluster with oidc-issuer enabled and get the credential
95

106
Following the [documentation](https://learn.microsoft.com/en-us/azure/aks/use-oidc-issuer#create-an-aks-cluster-with-oidc-issuer) to create an AKS cluster with the `--enable-oidc-issuer` parameter and get the AKS credentials. And export following environment variables:
@@ -14,9 +10,7 @@ export CLUSTER_NAME=<your cluster name>
1410
export REGION=<your region>
1511
```
1612

17-
1813
### 2. Create a new storage account and container
19-
2014
Following the [documentation](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-quickstart-blobs-cli) to create a new storage account and container or use your own. And export following environment variables:
2115
```
2216
export STORAGE_RESOURCE_GROUP=<your storage account resource group>
@@ -63,7 +57,6 @@ az identity federated-credential create --name $FEDERATED_IDENTITY_NAME \
6357
--subject system:serviceaccount:${SERVICE_ACCOUNT_NAMESPACE}:${SERVICE_ACCOUNT_NAME}
6458
```
6559

66-
## option#1: static provision with PV
6760
```
6861
cat <<EOF | kubectl apply -f -
6962
apiVersion: v1
@@ -139,39 +132,3 @@ spec:
139132
storage: 10Gi
140133
EOF
141134
```
142-
143-
## option#2: Pod with ephemeral inline volume
144-
```
145-
cat <<EOF | kubectl apply -f -
146-
kind: Pod
147-
apiVersion: v1
148-
metadata:
149-
name: nginx-blobfuse-inline-volume
150-
spec:
151-
serviceAccountName: $SERVICE_ACCOUNT_NAME #required, Pod does not use this service account has no permission to mount the volume
152-
nodeSelector:
153-
"kubernetes.io/os": linux
154-
containers:
155-
- image: mcr.microsoft.com/oss/nginx/nginx:1.19.5
156-
name: nginx-blobfuse
157-
command:
158-
- "/bin/bash"
159-
- "-c"
160-
- set -euo pipefail; while true; do echo $(date) >> /mnt/blobfuse/outfile; sleep 1; done
161-
volumeMounts:
162-
- name: persistent-storage
163-
mountPath: "/mnt/blobfuse"
164-
readOnly: false
165-
volumes:
166-
- name: persistent-storage
167-
csi:
168-
driver: blob.csi.azure.com
169-
volumeAttributes:
170-
storageaccount: $ACCOUNT # required
171-
containerName: $CONTAINER # required
172-
clientID: $USER_ASSIGNED_CLIENT_ID # required
173-
resourcegroup: $STORAGE_RESOURCE_GROUP # optional, specified when the storage account is not under AKS node resource group(which is prefixed with "MC_")
174-
# tenantID: $IDENTITY_TENANT # optional, only specified when workload identity and AKS cluster are in different tenant
175-
# subscriptionid: $SUBSCRIPTION # optional, only specified when workload identity and AKS cluster are in different subscription
176-
EOF
177-
```

0 commit comments

Comments
 (0)