managed-identity.md

Managed Identity

This document is intended to give an overview of using Managed Identities (MI) with Azure Kubernetes Service (AKS).

MI is a common alternative to Service Principal based authentication because it provides services with an automatically managed identity in Azure AD. Applications can use the identity to authenticate to any service that supports Azure AD authentication, including Key Vault, without any credentials in code or the environment.

AKS Managed Identities

AKS natively supports MI (docs). Azure automatically creates a System Assigned Managed Identity for AKS deployments that leverage MI.

Infrastructure deployed through Terraform can leverage an identity block (ref) to deploy a cluster with Managed Identity.

Required Role Assignments

ACR Pull

Grants AKS MI the ability to pull application images from ACR

resource "azurerm_role_assignment" "acrpull" {
  scope                = var.acr_id
  role_definition_name = "AcrPull"
  principal_id         = module.aks.kubelet_identity.client_id
}

Pod Managed Identities

AAD Pod Identity enables Kubernetes applications to access cloud resources securely with Azure Active Directory (AAD).

Using Kubernetes primitives, administrators configure identities and bindings to match pods. Then without any code modifications, your containerized applications can leverage any resource in the cloud that depends on AAD as an identity provider.

Required Role Assignments

The following Role Assignments are required based on the AAD Pod Identity documentation:

Managed Identity Operator

Grant AKS MI the ability to read and assign User Assigned MI

resource "azurerm_role_assignment" "mi_operator" {
  scope                = data.azurerm_resource_group.kube_rg.id
  role_definition_name = "Managed Identity Operator"
  principal_id         = module.aks.kubelet_identity.client_id
}

Virtual Machine Contributor

Grant AKS MI the ability to manage VMs in AKS VM Scale Set

resource "azurerm_role_assignment" "vm_contrib" {
  scope                = data.azurerm_resource_group.kube_rg.id
  role_definition_name = "Virtual Machine Contributor"
  principal_id         = module.aks.kubelet_identity.client_id
}

Other

Pod MIs will also need access to other Azure Managed Services. Here is an example of what that might look like:

# Example: grant Pod MI access to Azure Storage
resource "azurerm_role_assignment" "mi_container" {
  count                = length(local.identities_for_storage)
  scope                = azurerm_storage_container.example.resource_manager_id
  role_definition_name = "Storage Blob Data Contributor"
  principal_id         = local.identities_for_storage[count.index].principal_id
}

Installing AAD Pod Identity on AKS

AAD Pod Identity can be installed on AKS using Helm. The official documentation details the steps needed.