|
| 1 | +# How to Use workload identity with Blob CSI driver |
| 2 | + |
| 3 | +## Prerequisites |
| 4 | + |
| 5 | +This document is mainly refer to [Azure AD Workload Identity Quick Start](https://azure.github.io/azure-workload-identity/docs/quick-start.html). Please Complete the [Installation guide](https://azure.github.io/azure-workload-identity/docs/installation.html) before the following steps. |
| 6 | + |
| 7 | +After you finish the Installation guide, you should have already: |
| 8 | + |
| 9 | +* installed the mutating admission webhook |
| 10 | +* obtained your cluster’s OIDC issuer URL |
| 11 | + |
| 12 | +## 1. Export environment variables |
| 13 | + |
| 14 | +```shell |
| 15 | +export CLUSTER_NAME="<your cluster name>" |
| 16 | +export CLUSTER_RESOURCE_GROUP="<cluster resource group name>" |
| 17 | +export LOCATION="<location>" |
| 18 | +export OIDC_ISSUER="<your cluster’s OIDC issuer URL>" |
| 19 | + |
| 20 | +# [OPTIONAL] resource group where Blob storage account reside |
| 21 | +export AZURE_BLOB_RESOURCE_GROUP="<resource group where Blob storage account reside>" |
| 22 | + |
| 23 | +# environment variables for the AAD application |
| 24 | +# [OPTIONAL] Only set this if you're using a Azure AD Application as part of this tutorial |
| 25 | +export APPLICATION_NAME="<your application name>" |
| 26 | + |
| 27 | +# environment variables for the user-assigned managed identity |
| 28 | +# [OPTIONAL] Only set this if you're using a user-assigned managed identity as part of this tutorial |
| 29 | +export USER_ASSIGNED_IDENTITY_NAME="<your user-assigned managed identity name>" |
| 30 | +export IDENTITY_RESOURCE_GROUP="<resource group where your user-assigned managed identity reside>" |
| 31 | + |
| 32 | +# Blob CSI Driver Service Account and namespace |
| 33 | +export SA_LIST=( "csi-blob-controller-sa" "csi-blob-node-sa" ) |
| 34 | +export NAMESPACE="kube-system" |
| 35 | +``` |
| 36 | + |
| 37 | +## 2. Create Blob resource group |
| 38 | + |
| 39 | +If you are using AKS, you can get the resource group where Blob storage class reside by running: |
| 40 | + |
| 41 | +```shell |
| 42 | +export AZURE_BLOB_RESOURCE_GROUP="$(az aks show --name $CLUSTER_NAME --resource-group $CLUSTER_RESOURCE_GROUP --query "nodeResourceGroup" -o tsv)" |
| 43 | +``` |
| 44 | + |
| 45 | +You can also create resource group by yourself, but you must [specify the resource group](https://github.com/cvvz/blob-csi-driver/blob/workload_identity/docs/driver-parameters.md) in the storage class while using Blob CSI driver: |
| 46 | + |
| 47 | +```shell |
| 48 | +az group create -n $AZURE_BLOB_RESOURCE_GROUP -l $LOCATION |
| 49 | +``` |
| 50 | + |
| 51 | +## 3. Create an AAD application or user-assigned managed identity and grant required permissions |
| 52 | + |
| 53 | +```shell |
| 54 | +# create an AAD application if using Azure AD Application for this tutorial |
| 55 | +az ad sp create-for-rbac --name "${APPLICATION_NAME}" |
| 56 | +``` |
| 57 | + |
| 58 | +```shell |
| 59 | +# create a user-assigned managed identity if using user-assigned managed identity for this tutorial |
| 60 | +az group create -n ${IDENTITY_RESOURCE_GROUP} -l $LOCATION |
| 61 | +az identity create --name "${USER_ASSIGNED_IDENTITY_NAME}" --resource-group "${IDENTITY_RESOURCE_GROUP}" |
| 62 | +``` |
| 63 | + |
| 64 | +Grant required permission to the AAD application or user-assigned managed identity, for simplicity, we just assign Contributor role to the resource group where Blob storage class reside: |
| 65 | + |
| 66 | +If using Azure AD Application: |
| 67 | + |
| 68 | +```shell |
| 69 | +export APPLICATION_CLIENT_ID="$(az ad sp list --display-name "${APPLICATION_NAME}" --query '[0].appId' -otsv)" |
| 70 | +export AZURE_BLOB_RESOURCE_GROUP_ID="$(az group show -n $AZURE_BLOB_RESOURCE_GROUP --query 'id' -otsv)" |
| 71 | +az role assignment create --assignee $APPLICATION_CLIENT_ID --role Contributor --scope $AZURE_BLOB_RESOURCE_GROUP_ID |
| 72 | +``` |
| 73 | + |
| 74 | +if using user-assigned managed identity: |
| 75 | + |
| 76 | +```shell |
| 77 | +export USER_ASSIGNED_IDENTITY_OBJECT_ID="$(az identity show --name "${USER_ASSIGNED_IDENTITY_NAME}" --resource-group "${IDENTITY_RESOURCE_GROUP}" --query 'principalId' -otsv)" |
| 78 | +export AZURE_BLOB_RESOURCE_GROUP_ID="$(az group show -n $AZURE_BLOB_RESOURCE_GROUP --query 'id' -otsv)" |
| 79 | +az role assignment create --assignee $USER_ASSIGNED_IDENTITY_OBJECT_ID --role Contributor --scope $AZURE_BLOB_RESOURCE_GROUP_ID |
| 80 | +``` |
| 81 | + |
| 82 | +## 4. Establish federated identity credential between the identity and the Blob service account issuer & subject |
| 83 | + |
| 84 | +If using Azure AD Application: |
| 85 | + |
| 86 | +```shell |
| 87 | +# Get the object ID of the AAD application |
| 88 | +export APPLICATION_OBJECT_ID="$(az ad app show --id ${APPLICATION_CLIENT_ID} --query id -otsv)" |
| 89 | + |
| 90 | +# Add the federated identity credential: |
| 91 | +for SERVICE_ACCOUNT_NAME in "${SA_LIST[@]}" |
| 92 | +do |
| 93 | +cat <<EOF > params.json |
| 94 | +{ |
| 95 | + "name": "${SERVICE_ACCOUNT_NAME}", |
| 96 | + "issuer": "${OIDC_ISSUER}", |
| 97 | + "subject": "system:serviceaccount:${NAMESPACE}:${SERVICE_ACCOUNT_NAME}", |
| 98 | + "description": "Kubernetes service account federated credential", |
| 99 | + "audiences": [ |
| 100 | + "api://AzureADTokenExchange" |
| 101 | + ] |
| 102 | +} |
| 103 | +EOF |
| 104 | +az ad app federated-credential create --id ${APPLICATION_OBJECT_ID} --parameters @params.json |
| 105 | +done |
| 106 | +``` |
| 107 | + |
| 108 | +If using user-assigned managed identity: |
| 109 | + |
| 110 | +```shell |
| 111 | +for SERVICE_ACCOUNT_NAME in "${SA_LIST[@]}" |
| 112 | +do |
| 113 | +az identity federated-credential create \ |
| 114 | +--name "${SERVICE_ACCOUNT_NAME}" \ |
| 115 | +--identity-name "${USER_ASSIGNED_IDENTITY_NAME}" \ |
| 116 | +--resource-group "${IDENTITY_RESOURCE_GROUP}" \ |
| 117 | +--issuer "${OIDC_ISSUER}" \ |
| 118 | +--subject system:serviceaccount:"${NAMESPACE}":"${SERVICE_ACCOUNT_NAME}" |
| 119 | +done |
| 120 | +``` |
| 121 | + |
| 122 | +## 5. Deploy Blob CSI Driver |
| 123 | + |
| 124 | +Deploy storageclass: |
| 125 | + |
| 126 | +```shell |
| 127 | +kubectl create -f https://raw.githubusercontent.com/kubernetes-sigs/blob-csi-driver/master/deploy/example/storageclass-blobfuse.yaml |
| 128 | +kubectl create -f https://raw.githubusercontent.com/kubernetes-sigs/blob-csi-driver/master/deploy/example/storageclass-blob-nfs.yaml |
| 129 | +``` |
| 130 | + |
| 131 | +Deploy Blob CSI Driver |
| 132 | + |
| 133 | +If using Azure AD Application: |
| 134 | + |
| 135 | +```shell |
| 136 | +export CLIENT_ID="$(az ad sp list --display-name "${APPLICATION_NAME}" --query '[0].appId' -otsv)" |
| 137 | +export TENANT_ID="$(az ad sp list --display-name "${APPLICATION_NAME}" --query '[0].appOwnerOrganizationId' -otsv)" |
| 138 | +helm install blob-csi-driver charts/latest/blob-csi-driver \ |
| 139 | +--namespace $NAMESPACE \ |
| 140 | +--set workloadIdentity.clientID=$CLIENT_ID \ |
| 141 | +--set workloadIdentity.tenantID=$TENANT_ID |
| 142 | +``` |
| 143 | + |
| 144 | +If using user-assigned managed identity: |
| 145 | + |
| 146 | +```shell |
| 147 | +export CLIENT_ID="$(az identity show --name "${USER_ASSIGNED_IDENTITY_NAME}" --resource-group "${IDENTITY_RESOURCE_GROUP}" --query 'clientId' -otsv)" |
| 148 | +export TENANT_ID="$(az identity show --name "${USER_ASSIGNED_IDENTITY_NAME}" --resource-group "${IDENTITY_RESOURCE_GROUP}" --query 'tenantId' -otsv)" |
| 149 | +helm install blob-csi-driver charts/latest/blob-csi-driver \ |
| 150 | +--namespace $NAMESPACE \ |
| 151 | +--set workloadIdentity.clientID=$CLIENT_ID \ |
| 152 | +--set workloadIdentity.tenantID=$TENANT_ID |
| 153 | +``` |
| 154 | + |
| 155 | +## 6. Deploy application using Blob CSI driver |
| 156 | + |
| 157 | +```shell |
| 158 | +kubectl create -f https://raw.githubusercontent.com/kubernetes-sigs/blob-csi-driver/master/deploy/example/nfs/statefulset.yaml |
| 159 | +kubectl create -f https://raw.githubusercontent.com/kubernetes-sigs/blob-csi-driver/master/deploy/example/deployment.yaml |
| 160 | +``` |
| 161 | + |
| 162 | +Please make sure all the Pods are running. |
0 commit comments