You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/book/src/topics/vm-identity.md
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,9 +25,9 @@ A system-assigned identity is a managed identity which is tied to the lifespan o
25
25
26
26
⚠️ **When a Node is created with a System Assigned Identity, A role of Subscription contributor is added to this generated Identity**
27
27
28
-
<asideclass="note warning">
28
+
<asideclass="note warning">
29
29
30
-
<h1> Warning </h1>
30
+
<h1> Warning </h1>
31
31
32
32
To create an Azure VM with the system-assigned managed identity enabled, your AzureClusterIdentity needs the [Virtual Machine Contributor](https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-contributor) role assignment. In order to be able to grant the subscription contributor role to the identity, it also needs `Microsoft.Authorization/roleAssignments/write` permissions, such as [User Access Administrator](https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#user-access-administrator) or [Owner](https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#owner).
33
33
@@ -37,7 +37,7 @@ To create an Azure VM with the system-assigned managed identity enabled, your Az
37
37
38
38
#### User-assigned
39
39
40
-
<asideclass="note">
40
+
<asideclass="note">
41
41
42
42
<h1> Note </h1>
43
43
@@ -83,7 +83,7 @@ spec:
83
83
84
84
The CAPZ controller will look for `UserAssigned` value in `identity` field under `AzureMachinePool`, and assign the user identities listed in `userAssignedIdentities` to the virtual machine scale set.
85
85
86
-
Alternatively, you can use the `user-assigned-identity`, and `machinepool-user-assigned-identity` flavors by setting the `{flavor}` in `clusterctl generate cluster --flavor {flavor}` to use user-assigned managed identity in machine deployment, and machine pool respectively.
86
+
Alternatively, you can also use the `user-assigned-identity` flavor to build a simple machine deployment-enabled cluster by using `clusterctl generate cluster --flavor user-assigned-identity` to generate a cluster template.
87
87
88
88
#### System-assigned
89
89
@@ -119,15 +119,15 @@ spec:
119
119
120
120
The CAPZ controller will look for `SystemAssigned` value in `identity` field under `AzureMachinePool`, and enable system-assigned managed identity in the virtual machine scale set.
121
121
122
-
Alternatively, you can also use the `system-assigned-identity`, and `machinepool-system-assigned-identity` flavors by setting the `{flavor}` in `clusterctl generate cluster --flavor {flavor}` to use system-assigned managed identity in machine deployment, and machine pool respectively.
122
+
Alternatively, you can also use the `system-assigned-identity` flavor to build a simple machine deployment-enabled cluster by using `clusterctl generate cluster --flavor system-assigned-identity` to generate a cluster template.
123
123
124
124
### Service Principal (not recommended)
125
125
126
126
A service principal is an identity in AAD which is described by a tenant ID and client (or "app") ID. It can have one or more associated secrets or certificates. The set of these values will enable the holder to exchange the values for a JWT token to communicate with Azure. The user generally creates a service principal, saves the credentials, and then uses the credentials in applications. To read more about Service Principals and AD Applications see ["Application and service principal objects in Azure Active Directory"](https://azure.microsoft.com/en-us/documentation/articles/active-directory-application-objects/).
127
127
128
-
<asideclass="note warning">
128
+
<asideclass="note warning">
129
129
130
-
<h1> Warning </h1>
130
+
<h1> Warning </h1>
131
131
132
132
Using Service Principal authentication for Cloud Provider Azure is less secure than Managed Identity. Your Service Principal credentials will be written to a file on the disk of each VM in order to be accessible by Cloud Provider.
0 commit comments