You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/workload-identity-static-pv-mount.md
+2-45Lines changed: 2 additions & 45 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,10 +1,6 @@
1
-
# Example of static PV mount with workload identity
2
-
1
+
# workload identity support on static provisioning
3
2
- supported from v1.23.3
4
-
5
-
## prerequisites
6
-
7
-
3
+
## Prerequisites
8
4
### 1. Create a cluster with oidc-issuer enabled and get the credential
9
5
10
6
Following the [documentation](https://learn.microsoft.com/en-us/azure/aks/use-oidc-issuer#create-an-aks-cluster-with-oidc-issuer) to create an AKS cluster with the `--enable-oidc-issuer` parameter and get the AKS credentials. And export following environment variables:
Following the [documentation](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-quickstart-blobs-cli) to create a new storage account and container or use your own. And export following environment variables:
serviceAccountName: $SERVICE_ACCOUNT_NAME #required, Pod does not use this service account has no permission to mount the volume
152
-
nodeSelector:
153
-
"kubernetes.io/os": linux
154
-
containers:
155
-
- image: mcr.microsoft.com/oss/nginx/nginx:1.19.5
156
-
name: nginx-blobfuse
157
-
command:
158
-
- "/bin/bash"
159
-
- "-c"
160
-
- set -euo pipefail; while true; do echo $(date) >> /mnt/blobfuse/outfile; sleep 1; done
161
-
volumeMounts:
162
-
- name: persistent-storage
163
-
mountPath: "/mnt/blobfuse"
164
-
readOnly: false
165
-
volumes:
166
-
- name: persistent-storage
167
-
csi:
168
-
driver: blob.csi.azure.com
169
-
volumeAttributes:
170
-
storageaccount: $ACCOUNT # required
171
-
containerName: $CONTAINER # required
172
-
clientID: $USER_ASSIGNED_CLIENT_ID # required
173
-
resourcegroup: $STORAGE_RESOURCE_GROUP # optional, specified when the storage account is not under AKS node resource group(which is prefixed with "MC_")
174
-
# tenantID: $IDENTITY_TENANT # optional, only specified when workload identity and AKS cluster are in different tenant
175
-
# subscriptionid: $SUBSCRIPTION # optional, only specified when workload identity and AKS cluster are in different subscription
0 commit comments