HOW-TO: Deploy AKS with POD Managed Identity and CSI using Terraform and Azure Pipeline

Published 03-31-2021 11:45 AM 1,310 Views
Microsoft

Today as we develop and run application in AKS, we do not want credentials like database connection strings, keys, or secrets and certificates exposed to the outside world where an attacker could take advantage of those secrets for malicious purposes. Our application should be designed to protect customer data. AKS documentation describes in detail security best practice

In this article we will show how to implement and deploy pod security by deploying Pod managed Identity and Secrets Store CSI driver resources on Kubernetes. There are many articles and blogs that discuss this topic in detail however we will discuss how to deploy it the resources using Terraform. The source code you will find here and Azure pipeline to deploy it is here

Prerequisite resources:

The following resources should exist before running azure pipeline.

  • Server Service Principal ID and Secret: Terraform will use it to access Azure and create resources. Also, will be used to integrate AKS with AAD.
  • Client Service Principal ID and Secret: It will be used to integrate AKS with AAD.
  • AAD Cluster Admin Group: AAD group for cluster admins
  • Azure Key Vault: A KV should exists where CSI will connect with it. You can also modify the code to create the KV during the TF execution

AKS Terraform Scripts Overview

Current repo has the following structure. Terraform scripts are located under “terraform_aks” folder.

magdysalem_0-1617211808512.png

Each file, under terraform_aks folder, is designed to define specific resource deployment. 

  • Variables.tf: terraform use this file to read custom settings variable to use during the run time.  If the variable is defined in the variable file then TF expect a default value or it will be passed as env variable during execution. For example, cluster network specification 
    variable "virtual_network_name" {
      description = "Virtual network name"
      default     = "aksVirtualNetwork"
    }
    
    variable "virtual_network_address_prefix" {
      description = "VNET address prefix"
      default     = "15.0.0.0/8"
    }
    
    variable "aks_subnet_name" {
      description = "Subnet Name."
      default     = "kubesubnet"
    }
    
    variable "aks_subnet_address_prefix" {
      description = "Subnet address prefix."
      default     = "15.0.0.0/16"
    }
    ​

     

  • main.tf:  defined different terraform providers will be use in the execution. 
    provider "azurerm" {
      version = "~> 2.53.0"
      features {}
    }
    
    
    terraform {
      required_version = ">= 0.14.9"
      # Backend variables are initialized by Azure DevOps
      backend "azurerm" {}
    }
    
    data "azurerm_subscription" "current" {}
    ​

     

  • vnet.tf: create the network resource to use with AKS based on variable.tf input
    resource "azurerm_virtual_network" "demo" {
      name                = var.virtual_network_name
      location            = azurerm_resource_group.rg.location
      resource_group_name = azurerm_resource_group.rg.name
      address_space       = [var.virtual_network_address_prefix]
    
      subnet {
        name           = var.aks_subnet_name
        address_prefix = var.aks_subnet_address_prefix
      }
    
      tags = var.tags
    }
    
    data "azurerm_subnet" "kubesubnet" {
      name                 = var.aks_subnet_name
      virtual_network_name = azurerm_virtual_network.demo.name
      resource_group_name  = var.resource_group_name
      depends_on           = [azurerm_virtual_network.demo]
    }
    ​
  • K8s.tf: The main script to create AKS.  The resource configuration as following 
    resource "azurerm_kubernetes_cluster" "k8s" {
      name       = var.aks_name
      location   = azurerm_resource_group.rg.location
      dns_prefix = var.aks_dns_prefix
    
      resource_group_name = azurerm_resource_group.rg.name
    
      linux_profile {
        admin_username = var.vm_user_name
    
        ssh_key {
          key_data = var.public_ssh_key_path
        }
      }
    
      addon_profile {
        http_application_routing {
          enabled = true
        }
    
      }
    
      default_node_pool {
        name            = "agentpool"
        node_count      = var.aks_agent_count
        vm_size         = var.aks_agent_vm_size
        os_disk_size_gb = var.aks_agent_os_disk_size
        vnet_subnet_id  = data.azurerm_subnet.kubesubnet.id
      }
    
      # block will be applied only if `enable` is true in var.azure_ad object
      role_based_access_control {
        azure_active_directory {
          managed = true
          admin_group_object_ids = var.azure_ad_admin_groups
        }
        enabled = true
      }
    
      identity {
        type = "SystemAssigned"
      }
    
      network_profile {
        network_plugin     = "azure"
        dns_service_ip     = var.aks_dns_service_ip
        docker_bridge_cidr = var.aks_docker_bridge_cidr
        service_cidr       = var.aks_service_cidr
      }
    
      depends_on = [
        azurerm_virtual_network.demo
      ]
      tags = var.tags
    }
    ​
  • To enable AAD integration we used the following configuration for the role_base_access_control section 
    # block will be applied only if `enable` is true in var.azure_ad object
      role_based_access_control {
        azure_active_directory {
          managed = true
          admin_group_object_ids = var.azure_ad_admin_groups
        }
        enabled = true
      }
    
      identity {
        type = "SystemAssigned"
      }
    
  • After creating the cluster we need to add cluster role binding where we assign AAD admin group as cluster admins 
    resource "kubernetes_cluster_role_binding" "aad_integration" {
      metadata {
        name = "${var.aks_name}admins"
      }
      role_ref {
        api_group = "rbac.authorization.k8s.io"
        kind      = "ClusterRole"
        name      = "cluster-admin"
      }
      subject {
        kind      = "Group"
        name      = var.aks-aad-clusteradmins
        api_group = "rbac.authorization.k8s.io"
      }
      depends_on = [
        azurerm_kubernetes_cluster.k8s
      ]
    }
    ​
  • roles.tf: this script will assign different roles to cluster and agentpool like acr image puller role
    resource "azurerm_role_assignment" "acr_image_puller" {
      scope                = azurerm_container_registry.acr.id
      role_definition_name = "AcrPull"
      principal_id         = azurerm_kubernetes_cluster.k8s.kubelet_identity.0.object_id
    }
    ​
  • To Enable POD Identity. Agent pool should have two specific roles as Managed Identity Operator over the node resource group scope 

    resource "azurerm_role_assignment" "agentpool_msi" {
      scope                            = data.azurerm_resource_group.node_rg.id
      role_definition_name             = "Managed Identity Operator"
      principal_id                     = data.azurerm_user_assigned_identity.agentpool.principal_id
      skip_service_principal_aad_check = true
    
    }

      Virtual Machine Contributor

    resource "azurerm_role_assignment" "agentpool_vm" {
      scope                            = data.azurerm_resource_group.node_rg.id
      role_definition_name             = "Virtual Machine Contributor"
      principal_id                     = data.azurerm_user_assigned_identity.agentpool.principal_id
      skip_service_principal_aad_check = true
    }
  • Addon-aad-pod-identity.tf: The script will deploy AAD Pod identity helm chart.

  • Addon-kv-csi-driver.tf: The script will deploy Azure CSI Secret store provider helm chart

  • Namespace-pod-identity.tf: It will deploy the managed Identity for specific namespace. Also, it will deploy CSI store provider for this namespace. 

Deploying AKS cluster using Azure DevOps pipeline

We can deploy the cluster using azure DevOps pipeline. In the repo there is file call “azure-pipelines-terraform.yml” 

The deployment use Stage and Jobs to deploy the cluster as following.

  • Task Set Terraform backed: will provision backend storage account and container to save terraform state
        - task: AzureCLI@1
          displayName: Set Terraform backend
          condition: and(succeeded(), ${{ parameters.provisionStorage }})
          inputs:
            azureSubscription: ${{ parameters.TerraformBackendServiceConnection }}
            scriptLocation: inlineScript
            inlineScript: |
              set -eu  # fail on error
              RG='${{ parameters.TerraformBackendResourceGroup }}'
              export AZURE_STORAGE_ACCOUNT='${{ parameters.TerraformBackendStorageAccount }}'
              export AZURE_STORAGE_KEY="$(az storage account keys list -g "$RG" -n "$AZURE_STORAGE_ACCOUNT" --query '[0].value' -o tsv)"
              if test -z "$AZURE_STORAGE_KEY"; then
                az configure --defaults group="$RG" location='${{ parameters.TerraformBackendLocation }}'
                az group create -n "$RG" -o none
                az storage account create -n "$AZURE_STORAGE_ACCOUNT" -o none
                export AZURE_STORAGE_KEY="$(az storage account keys list -g "$RG" -n "$AZURE_STORAGE_ACCOUNT" --query '[0].value' -o tsv)"
              fi
    
              container='${{ parameters.TerraformBackendStorageContainer }}'
              if ! az storage container show -n "$container" -o none 2>/dev/null; then
                az storage container create -n "$container" -o none
              fi
              blob='${{ parameters.environment }}.tfstate'
              if [[ $(az storage blob exists -c "$container" -n "$blob" --query exists) = "true" ]]; then
                if [[ $(az storage blob show -c "$container" -n "$blob" --query "properties.lease.status=='locked'") = "true" ]]; then
                  echo "State is leased"
                  lock_jwt=$(az storage blob show -c "$container" -n "$blob" --query metadata.terraformlockid -o tsv)
                  if [ "$lock_jwt" != "" ]; then
                    lock_json=$(base64 -d <<< "$lock_jwt")
                    echo "State is locked"
                    jq . <<< "$lock_json"
                  fi
                  if [ "${TERRAFORM_BREAK_LEASE:-}" != "" ]; then
                    az storage blob lease break -c "$container" -b "$blob"
                  else
                    echo "If you're really sure you want to break the lease, rerun the pipeline with variable TERRAFORM_BREAK_LEASE set to 1."
                    exit 1
                  fi
                fi
              fi
            addSpnToEnvironment: true​
  • Task Install Terraform CLI based on the parameter version.
  • Task Terraform Credentials: will read the SP account information that will be used to execute the pipeline

        - task: AzureCLI@1
          displayName: Terraform init
          inputs:
            azureSubscription: ${{ parameters.TerraformBackendServiceConnection }}
            scriptLocation: inlineScript
            inlineScript: |
              set -eux  # fail on error
              subscriptionId=$(az account show --query id -o tsv)
              terraform init \
                -backend-config=storage_account_name=${{ parameters.TerraformBackendStorageAccount }} \
                -backend-config=container_name=${{ parameters.TerraformBackendStorageContainer }} \
                -backend-config=key=${{ parameters.environment }}.tfstate \
                -backend-config=resource_group_name=${{ parameters.TerraformBackendResourceGroup }} \
                -backend-config=subscription_id=$subscriptionId \
                -backend-config=tenant_id=$tenantId \
                -backend-config=client_id=$servicePrincipalId \
                -backend-config=client_secret="$servicePrincipalKey"
            workingDirectory: ${{ parameters.TerraformDirectory }}
            addSpnToEnvironment: true
        
  • Task Terraform init to initiate terraform

  • Task Terraform apply will execute the terraform with auto-approve flag so terraform will run the apply.

 
P.S We could add task for terraform plan and the ask for approval.

Setting up pipeline in Azure DevOps

  • Under Pipeline Library Create new variable group call it terraform and create following variables
  • magdysalem_3-1617213751404.png
  • Add new pipeline then select Github

          magdysalem_4-1617213793378.png

  • After login select the terraform repo 

          magdysalem_5-1617213859936.png

  • Select Existing Azure Pipeline YAML then select “azure-pipeline-terraform.yml"
  • Once we save the pipeline and created the prerequisite resources and updated the variable.tf file then we are ready to run the pipeline and we should get something like that

        magdysalem_7-1617214230548.png

Check Our work

Cluster information

Under cluster configuration we should see AAD is enabled 

magdysalem_0-1617216276296.png

 

Azure POD Identity /  CSI Provider Pods
From command line we can check kube-system namespace for MIC and NMI pods

magdysalem_9-1617214291098.png

magdysalem_10-1617214299798.png

 

Namespace Azure Identity and Azure Identity Binding

magdysalem_11-1617214337124.png

 

Check for CSI secret store provider

magdysalem_12-1617214352096.png

Summary

In this article we demonstrated how to deploy AKS integrated with AAD and deploy Pod Identity and CSI provider using terraform and helm chart. In the next article we will demo how to build application and use POD Identity to access azure resources.

 

 

%3CLINGO-SUB%20id%3D%22lingo-sub-2247508%22%20slang%3D%22en-US%22%3EHOW-TO%3A%20Deploy%20AKS%20with%20POD%20Managed%20Identity%20and%20CSI%20using%20Terraform%20and%20Azure%20Pipeline%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2247508%22%20slang%3D%22en-US%22%3E%3CP%3EToday%20as%20we%20develop%20and%20run%20application%20in%20AKS%2C%20we%20do%20not%20want%20credentials%20like%20database%20connection%20strings%2C%20keys%2C%20or%20secrets%20and%20certificates%20exposed%20to%20the%20outside%20world%20where%20an%20attacker%20could%20take%20advantage%20of%20those%20secrets%20for%20malicious%20purposes.%20Our%20application%20should%20be%20designed%20to%20protect%20customer%20data.%20AKS%20documentation%20describes%20in%20detail%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Faks%2Fdeveloper-best-practices-pod-security%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Esecurity%20best%20practice%3C%2FA%3E%3C%2FP%3E%0A%3CP%3EIn%20this%20article%20we%20will%20show%20how%20to%20implement%20and%20deploy%20pod%20security%20by%20deploying%20Pod%20managed%20Identity%20and%20Secrets%20Store%20CSI%20driver%20resources%20on%20Kubernetes.%20There%20are%20many%20articles%20and%20blogs%20that%20discuss%20this%20topic%20in%20detail%20however%20we%20will%20discuss%20how%20to%20deploy%20it%20the%20resources%20using%20Terraform.%20The%20source%20code%20you%20will%20find%20%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2Fmsalemcode%2Faks-terraform-pod-identity%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Ehere%3C%2FA%3E%20and%20Azure%20pipeline%20to%20deploy%20it%20is%20%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2Fmsalemcode%2Faks-terraform-pod-identity%2Fblob%2Fmain%2Fazure-pipelines-terraform.yml%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Ehere%3C%2FA%3E%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId-2001589819%22%20id%3D%22toc-hId-2001589819%22%3EPrerequisite%20resources%3A%3C%2FH3%3E%0A%3CP%3EThe%20following%20resources%20should%20exist%20before%20running%20azure%20pipeline.%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSTRONG%3EServer%20Service%20Principal%20ID%20and%20Secret%3C%2FSTRONG%3E%3A%20Terraform%20will%20use%20it%20to%20access%20Azure%20and%20create%20resources.%20Also%2C%20will%20be%20used%20to%20integrate%20AKS%20with%20AAD.%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3EClient%20Service%20Principal%20ID%20and%20Secret%3C%2FSTRONG%3E%3A%20It%20will%20be%20used%20to%20integrate%20AKS%20with%20AAD.%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3EAAD%20Cluster%20Admin%20Group%3C%2FSTRONG%3E%3A%20AAD%20group%20for%20cluster%20admins%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3EAzure%20Key%20Vault%3C%2FSTRONG%3E%3A%20A%20KV%20should%20exists%20where%20CSI%20will%20connect%20with%20it.%20You%20can%20also%20modify%20the%20code%20to%20create%20the%20KV%20during%20the%20TF%20execution%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CH3%20id%3D%22toc-hId-194135356%22%20id%3D%22toc-hId-194135356%22%3EAKS%20Terraform%20Scripts%20Overview%3C%2FH3%3E%0A%3CP%3ECurrent%20repo%20has%20the%20following%20structure.%20Terraform%20scripts%20are%20located%20under%20%3CSTRONG%3E%3CFONT%20color%3D%22%23000000%22%3E%E2%80%9Cterraform_aks%3C%2FFONT%3E%3C%2FSTRONG%3E%E2%80%9D%20folder.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_0-1617211808512.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F268668i0BC5C4A2A8DEC9C7%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22magdysalem_0-1617211808512.png%22%20alt%3D%22magdysalem_0-1617211808512.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EEach%20file%2C%20under%20terraform_aks%20folder%2C%20is%20designed%20to%20define%20specific%20resource%20deployment.%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSTRONG%3EVariables.tf%3C%2FSTRONG%3E%3A%20terraform%20use%20this%20file%20to%20read%20custom%20settings%20variable%20to%20use%20during%20the%20run%20time.%20%26nbsp%3BIf%20the%20variable%20is%20defined%20in%20the%20variable%20file%20then%20TF%20expect%20a%20default%20value%20or%20it%20will%20be%20passed%20as%20env%20variable%20during%20execution.%20For%20example%2C%20cluster%20network%20specification%26nbsp%3B%3CPRE%20class%3D%22lia-code-sample%20language-json%22%3E%3CCODE%3Evariable%20%22virtual_network_name%22%20%7B%0A%20%20description%20%3D%20%22Virtual%20network%20name%22%0A%20%20default%20%20%20%20%20%3D%20%22aksVirtualNetwork%22%0A%7D%0A%0Avariable%20%22virtual_network_address_prefix%22%20%7B%0A%20%20description%20%3D%20%22VNET%20address%20prefix%22%0A%20%20default%20%20%20%20%20%3D%20%2215.0.0.0%2F8%22%0A%7D%0A%0Avariable%20%22aks_subnet_name%22%20%7B%0A%20%20description%20%3D%20%22Subnet%20Name.%22%0A%20%20default%20%20%20%20%20%3D%20%22kubesubnet%22%0A%7D%0A%0Avariable%20%22aks_subnet_address_prefix%22%20%7B%0A%20%20description%20%3D%20%22Subnet%20address%20prefix.%22%0A%20%20default%20%20%20%20%20%3D%20%2215.0.0.0%2F16%22%0A%7D%0A%E2%80%8B%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3Emain.tf%3A%20%3C%2FSTRONG%3E%26nbsp%3Bdefined%20different%20terraform%20providers%20will%20be%20use%20in%20the%20execution.%26nbsp%3B%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3Eprovider%20%22azurerm%22%20%7B%0A%20%20version%20%3D%20%22~%26gt%3B%202.53.0%22%0A%20%20features%20%7B%7D%0A%7D%0A%0A%0Aterraform%20%7B%0A%20%20required_version%20%3D%20%22%26gt%3B%3D%200.14.9%22%0A%20%20%23%20Backend%20variables%20are%20initialized%20by%20Azure%20DevOps%0A%20%20backend%20%22azurerm%22%20%7B%7D%0A%7D%0A%0Adata%20%22azurerm_subscription%22%20%22current%22%20%7B%7D%0A%E2%80%8B%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3Evnet.tf%3A%20%3C%2FSTRONG%3Ecreate%20the%20network%20resource%20to%20use%20with%20AKS%20based%20on%20variable.tf%20input%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3Eresource%20%22azurerm_virtual_network%22%20%22demo%22%20%7B%0A%20%20name%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%3D%20var.virtual_network_name%0A%20%20location%20%20%20%20%20%20%20%20%20%20%20%20%3D%20azurerm_resource_group.rg.location%0A%20%20resource_group_name%20%3D%20azurerm_resource_group.rg.name%0A%20%20address_space%20%20%20%20%20%20%20%3D%20%5Bvar.virtual_network_address_prefix%5D%0A%0A%20%20subnet%20%7B%0A%20%20%20%20name%20%20%20%20%20%20%20%20%20%20%20%3D%20var.aks_subnet_name%0A%20%20%20%20address_prefix%20%3D%20var.aks_subnet_address_prefix%0A%20%20%7D%0A%0A%20%20tags%20%3D%20var.tags%0A%7D%0A%0Adata%20%22azurerm_subnet%22%20%22kubesubnet%22%20%7B%0A%20%20name%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%3D%20var.aks_subnet_name%0A%20%20virtual_network_name%20%3D%20azurerm_virtual_network.demo.name%0A%20%20resource_group_name%20%20%3D%20var.resource_group_name%0A%20%20depends_on%20%20%20%20%20%20%20%20%20%20%20%3D%20%5Bazurerm_virtual_network.demo%5D%0A%7D%0A%E2%80%8B%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3EK8s.tf%3A%20%3C%2FSTRONG%3EThe%20main%20script%20to%20create%20AKS.%26nbsp%3B%20The%20resource%20configuration%20as%20following%26nbsp%3B%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3Eresource%20%22azurerm_kubernetes_cluster%22%20%22k8s%22%20%7B%0A%20%20name%20%20%20%20%20%20%20%3D%20var.aks_name%0A%20%20location%20%20%20%3D%20azurerm_resource_group.rg.location%0A%20%20dns_prefix%20%3D%20var.aks_dns_prefix%0A%0A%20%20resource_group_name%20%3D%20azurerm_resource_group.rg.name%0A%0A%20%20linux_profile%20%7B%0A%20%20%20%20admin_username%20%3D%20var.vm_user_name%0A%0A%20%20%20%20ssh_key%20%7B%0A%20%20%20%20%20%20key_data%20%3D%20var.public_ssh_key_path%0A%20%20%20%20%7D%0A%20%20%7D%0A%0A%20%20addon_profile%20%7B%0A%20%20%20%20http_application_routing%20%7B%0A%20%20%20%20%20%20enabled%20%3D%20true%0A%20%20%20%20%7D%0A%0A%20%20%7D%0A%0A%20%20default_node_pool%20%7B%0A%20%20%20%20name%20%20%20%20%20%20%20%20%20%20%20%20%3D%20%22agentpool%22%0A%20%20%20%20node_count%20%20%20%20%20%20%3D%20var.aks_agent_count%0A%20%20%20%20vm_size%20%20%20%20%20%20%20%20%20%3D%20var.aks_agent_vm_size%0A%20%20%20%20os_disk_size_gb%20%3D%20var.aks_agent_os_disk_size%0A%20%20%20%20vnet_subnet_id%20%20%3D%20data.azurerm_subnet.kubesubnet.id%0A%20%20%7D%0A%0A%20%20%23%20block%20will%20be%20applied%20only%20if%20%60enable%60%20is%20true%20in%20var.azure_ad%20object%0A%20%20role_based_access_control%20%7B%0A%20%20%20%20azure_active_directory%20%7B%0A%20%20%20%20%20%20managed%20%3D%20true%0A%20%20%20%20%20%20admin_group_object_ids%20%3D%20var.azure_ad_admin_groups%0A%20%20%20%20%7D%0A%20%20%20%20enabled%20%3D%20true%0A%20%20%7D%0A%0A%20%20identity%20%7B%0A%20%20%20%20type%20%3D%20%22SystemAssigned%22%0A%20%20%7D%0A%0A%20%20network_profile%20%7B%0A%20%20%20%20network_plugin%20%20%20%20%20%3D%20%22azure%22%0A%20%20%20%20dns_service_ip%20%20%20%20%20%3D%20var.aks_dns_service_ip%0A%20%20%20%20docker_bridge_cidr%20%3D%20var.aks_docker_bridge_cidr%0A%20%20%20%20service_cidr%20%20%20%20%20%20%20%3D%20var.aks_service_cidr%0A%20%20%7D%0A%0A%20%20depends_on%20%3D%20%5B%0A%20%20%20%20azurerm_virtual_network.demo%0A%20%20%5D%0A%20%20tags%20%3D%20var.tags%0A%7D%0A%E2%80%8B%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FLI%3E%0A%3CLI%3ETo%20enable%20AAD%20integration%20we%20used%20the%20following%20configuration%20for%20the%20role_base_access_control%20section%26nbsp%3B%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3E%23%20block%20will%20be%20applied%20only%20if%20%60enable%60%20is%20true%20in%20var.azure_ad%20object%0A%20%20role_based_access_control%20%7B%0A%20%20%20%20azure_active_directory%20%7B%0A%20%20%20%20%20%20managed%20%3D%20true%0A%20%20%20%20%20%20admin_group_object_ids%20%3D%20var.azure_ad_admin_groups%0A%20%20%20%20%7D%0A%20%20%20%20enabled%20%3D%20true%0A%20%20%7D%0A%0A%20%20identity%20%7B%0A%20%20%20%20type%20%3D%20%22SystemAssigned%22%0A%20%20%7D%0A%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FLI%3E%0A%3CLI%3EAfter%20creating%20the%20cluster%20we%20need%20to%20add%20cluster%20role%20binding%20where%20we%20assign%20AAD%20admin%20group%20as%20cluster%20admins%26nbsp%3B%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3Eresource%20%22kubernetes_cluster_role_binding%22%20%22aad_integration%22%20%7B%0A%20%20metadata%20%7B%0A%20%20%20%20name%20%3D%20%22%24%7Bvar.aks_name%7Dadmins%22%0A%20%20%7D%0A%20%20role_ref%20%7B%0A%20%20%20%20api_group%20%3D%20%22rbac.authorization.k8s.io%22%0A%20%20%20%20kind%20%20%20%20%20%20%3D%20%22ClusterRole%22%0A%20%20%20%20name%20%20%20%20%20%20%3D%20%22cluster-admin%22%0A%20%20%7D%0A%20%20subject%20%7B%0A%20%20%20%20kind%20%20%20%20%20%20%3D%20%22Group%22%0A%20%20%20%20name%20%20%20%20%20%20%3D%20var.aks-aad-clusteradmins%0A%20%20%20%20api_group%20%3D%20%22rbac.authorization.k8s.io%22%0A%20%20%7D%0A%20%20depends_on%20%3D%20%5B%0A%20%20%20%20azurerm_kubernetes_cluster.k8s%0A%20%20%5D%0A%7D%0A%E2%80%8B%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3Eroles.tf%3C%2FSTRONG%3E%3A%20this%20script%20will%20assign%20different%20roles%20to%20cluster%20and%20agentpool%20like%20acr%20image%20puller%20role%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3Eresource%20%22azurerm_role_assignment%22%20%22acr_image_puller%22%20%7B%0A%20%20scope%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%3D%20azurerm_container_registry.acr.id%0A%20%20role_definition_name%20%3D%20%22AcrPull%22%0A%20%20principal_id%20%20%20%20%20%20%20%20%20%3D%20azurerm_kubernetes_cluster.k8s.kubelet_identity.0.object_id%0A%7D%0A%E2%80%8B%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FLI%3E%0A%3CLI%3E%3CP%3ETo%20Enable%20POD%20Identity.%20Agent%20pool%20should%20have%20two%20specific%20roles%20as%20Managed%20Identity%20Operator%20over%20the%20node%20resource%20group%20scope%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3Eresource%20%22azurerm_role_assignment%22%20%22agentpool_msi%22%20%7B%0A%20%20scope%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%3D%20data.azurerm_resource_group.node_rg.id%0A%20%20role_definition_name%20%20%20%20%20%20%20%20%20%20%20%20%20%3D%20%22Managed%20Identity%20Operator%22%0A%20%20principal_id%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%3D%20data.azurerm_user_assigned_identity.agentpool.principal_id%0A%20%20skip_service_principal_aad_check%20%3D%20true%0A%0A%7D%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%20Virtual%20Machine%20Contributor%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3Eresource%20%22azurerm_role_assignment%22%20%22agentpool_vm%22%20%7B%0A%20%20scope%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%3D%20data.azurerm_resource_group.node_rg.id%0A%20%20role_definition_name%20%20%20%20%20%20%20%20%20%20%20%20%20%3D%20%22Virtual%20Machine%20Contributor%22%0A%20%20principal_id%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%3D%20data.azurerm_user_assigned_identity.agentpool.principal_id%0A%20%20skip_service_principal_aad_check%20%3D%20true%0A%7D%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FLI%3E%0A%3CLI%3E%3CP%3E%3CSTRONG%3EAddon-aad-pod-identity.tf%3C%2FSTRONG%3E%3A%20The%20script%20will%20deploy%20AAD%20Pod%20identity%20helm%20chart.%3C%2FP%3E%0A%3C%2FLI%3E%0A%3CLI%3E%3CP%3E%3CSTRONG%3EAddon-kv-csi-driver.tf%3A%3C%2FSTRONG%3E%20The%20script%20will%20deploy%20Azure%20CSI%20Secret%20store%20provider%20helm%20chart%3C%2FP%3E%0A%3C%2FLI%3E%0A%3CLI%3E%3CP%3E%3CSTRONG%3ENamespace-pod-identity.tf%3A%20%3C%2FSTRONG%3EIt%20will%20deploy%20the%20managed%20Identity%20for%20specific%20namespace.%20Also%2C%20it%20will%20deploy%20CSI%20store%20provider%20for%20this%20namespace.%26nbsp%3B%3C%2FP%3E%0A%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CH3%20id%3D%22toc-hId--1613319107%22%20id%3D%22toc-hId--1613319107%22%3E%3CSTRONG%3EDeploying%20AKS%20cluster%20using%20Azure%20DevOps%20pipeline%3C%2FSTRONG%3E%3C%2FH3%3E%0A%3CP%3EWe%20can%20deploy%20the%20cluster%20using%20azure%20DevOps%20pipeline.%20In%20the%20repo%20there%20is%20file%20call%20%E2%80%9Cazure-pipelines-terraform.yml%E2%80%9D%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20deployment%20use%20Stage%20and%20Jobs%20to%20deploy%20the%20cluster%20as%20following.%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3ETask%20Set%20Terraform%20backed%3A%20will%20provision%20backend%20storage%20account%20and%20container%20to%20save%20terraform%20state%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3E%20%20%20%20-%20task%3A%20AzureCLI%401%0A%20%20%20%20%20%20displayName%3A%20Set%20Terraform%20backend%0A%20%20%20%20%20%20condition%3A%20and(succeeded()%2C%20%24%7B%7B%20parameters.provisionStorage%26nbsp%3B%7D%7D)%0A%20%20%20%20%20%20inputs%3A%0A%20%20%20%20%20%20%20%20azureSubscription%3A%20%24%7B%7B%20parameters.TerraformBackendServiceConnection%20%7D%7D%0A%20%20%20%20%20%20%20%20scriptLocation%3A%20inlineScript%0A%20%20%20%20%20%20%20%20inlineScript%3A%20%7C%0A%20%20%20%20%20%20%20%20%20%20set%20-eu%20%20%23%20fail%20on%20error%0A%20%20%20%20%20%20%20%20%20%20RG%3D'%24%7B%7B%20parameters.TerraformBackendResourceGroup%20%7D%7D'%0A%20%20%20%20%20%20%20%20%20%20export%20AZURE_STORAGE_ACCOUNT%3D'%24%7B%7B%20parameters.TerraformBackendStorageAccount%20%7D%7D'%0A%20%20%20%20%20%20%20%20%20%20export%20AZURE_STORAGE_KEY%3D%22%24(az%20storage%20account%20keys%20list%20-g%20%22%24RG%22%20-n%20%22%24AZURE_STORAGE_ACCOUNT%22%20--query%20'%5B0%5D.value'%20-o%20tsv)%22%0A%20%20%20%20%20%20%20%20%20%20if%20test%20-z%20%22%24AZURE_STORAGE_KEY%22%3B%20then%0A%20%20%20%20%20%20%20%20%20%20%20%20az%20configure%20--defaults%20group%3D%22%24RG%22%20location%3D'%24%7B%7B%20parameters.TerraformBackendLocation%20%7D%7D'%0A%20%20%20%20%20%20%20%20%20%20%20%20az%20group%20create%20-n%20%22%24RG%22%20-o%20none%0A%20%20%20%20%20%20%20%20%20%20%20%20az%20storage%20account%20create%20-n%20%22%24AZURE_STORAGE_ACCOUNT%22%20-o%20none%0A%20%20%20%20%20%20%20%20%20%20%20%20export%20AZURE_STORAGE_KEY%3D%22%24(az%20storage%20account%20keys%20list%20-g%20%22%24RG%22%20-n%20%22%24AZURE_STORAGE_ACCOUNT%22%20--query%20'%5B0%5D.value'%20-o%20tsv)%22%0A%20%20%20%20%20%20%20%20%20%20fi%0A%0A%20%20%20%20%20%20%20%20%20%20container%3D'%24%7B%7B%20parameters.TerraformBackendStorageContainer%20%7D%7D'%0A%20%20%20%20%20%20%20%20%20%20if%20!%20az%20storage%20container%20show%20-n%20%22%24container%22%20-o%20none%202%26gt%3B%2Fdev%2Fnull%3B%20then%0A%20%20%20%20%20%20%20%20%20%20%20%20az%20storage%20container%20create%20-n%20%22%24container%22%20-o%20none%0A%20%20%20%20%20%20%20%20%20%20fi%0A%20%20%20%20%20%20%20%20%20%20blob%3D'%24%7B%7B%20parameters.environment%20%7D%7D.tfstate'%0A%20%20%20%20%20%20%20%20%20%20if%20%5B%5B%20%24(az%20storage%20blob%20exists%20-c%20%22%24container%22%20-n%20%22%24blob%22%20--query%20exists)%20%3D%20%22true%22%20%5D%5D%3B%20then%0A%20%20%20%20%20%20%20%20%20%20%20%20if%20%5B%5B%20%24(az%20storage%20blob%20show%20-c%20%22%24container%22%20-n%20%22%24blob%22%20--query%20%22properties.lease.status%3D%3D'locked'%22)%20%3D%20%22true%22%20%5D%5D%3B%20then%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20echo%20%22State%20is%20leased%22%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20lock_jwt%3D%24(az%20storage%20blob%20show%20-c%20%22%24container%22%20-n%20%22%24blob%22%20--query%20metadata.terraformlockid%20-o%20tsv)%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20if%20%5B%20%22%24lock_jwt%22%20!%3D%20%22%22%20%5D%3B%20then%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20lock_json%3D%24(base64%20-d%20%26lt%3B%26lt%3B%26lt%3B%20%22%24lock_jwt%22)%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20echo%20%22State%20is%20locked%22%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20jq%20.%20%26lt%3B%26lt%3B%26lt%3B%20%22%24lock_json%22%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20fi%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20if%20%5B%20%22%24%7BTERRAFORM_BREAK_LEASE%3A-%7D%22%20!%3D%20%22%22%20%5D%3B%20then%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20az%20storage%20blob%20lease%20break%20-c%20%22%24container%22%20-b%20%22%24blob%22%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20else%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20echo%20%22If%20you're%20really%20sure%20you%20want%20to%20break%20the%20lease%2C%20rerun%20the%20pipeline%20with%20variable%20TERRAFORM_BREAK_LEASE%20set%20to%201.%22%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20exit%201%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20fi%0A%20%20%20%20%20%20%20%20%20%20%20%20fi%0A%20%20%20%20%20%20%20%20%20%20fi%0A%20%20%20%20%20%20%20%20addSpnToEnvironment%3A%20true%E2%80%8B%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FLI%3E%0A%3CLI%3ETask%20Install%20Terraform%20CLI%20based%20on%20the%20parameter%20version.%3C%2FLI%3E%0A%3CLI%3E%3CP%3ETask%20Terraform%20Credentials%3A%20will%20read%20the%20SP%20account%20information%20that%20will%20be%20used%20to%20execute%20the%20pipeline%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3E%20%20%20%20-%20task%3A%20AzureCLI%401%0A%20%20%20%20%20%20displayName%3A%20Terraform%20init%0A%20%20%20%20%20%20inputs%3A%0A%20%20%20%20%20%20%20%20azureSubscription%3A%20%24%7B%7B%20parameters.TerraformBackendServiceConnection%20%7D%7D%0A%20%20%20%20%20%20%20%20scriptLocation%3A%20inlineScript%0A%20%20%20%20%20%20%20%20inlineScript%3A%20%7C%0A%20%20%20%20%20%20%20%20%20%20set%20-eux%20%20%23%20fail%20on%20error%0A%20%20%20%20%20%20%20%20%20%20subscriptionId%3D%24(az%20account%20show%20--query%20id%20-o%20tsv)%0A%20%20%20%20%20%20%20%20%20%20terraform%20init%20%5C%0A%20%20%20%20%20%20%20%20%20%20%20%20-backend-config%3Dstorage_account_name%3D%24%7B%7B%20parameters.TerraformBackendStorageAccount%20%7D%7D%20%5C%0A%20%20%20%20%20%20%20%20%20%20%20%20-backend-config%3Dcontainer_name%3D%24%7B%7B%20parameters.TerraformBackendStorageContainer%20%7D%7D%20%5C%0A%20%20%20%20%20%20%20%20%20%20%20%20-backend-config%3Dkey%3D%24%7B%7B%20parameters.environment%20%7D%7D.tfstate%20%5C%0A%20%20%20%20%20%20%20%20%20%20%20%20-backend-config%3Dresource_group_name%3D%24%7B%7B%20parameters.TerraformBackendResourceGroup%20%7D%7D%20%5C%0A%20%20%20%20%20%20%20%20%20%20%20%20-backend-config%3Dsubscription_id%3D%24subscriptionId%20%5C%0A%20%20%20%20%20%20%20%20%20%20%20%20-backend-config%3Dtenant_id%3D%24tenantId%20%5C%0A%20%20%20%20%20%20%20%20%20%20%20%20-backend-config%3Dclient_id%3D%24servicePrincipalId%20%5C%0A%20%20%20%20%20%20%20%20%20%20%20%20-backend-config%3Dclient_secret%3D%22%24servicePrincipalKey%22%0A%20%20%20%20%20%20%20%20workingDirectory%3A%20%24%7B%7B%20parameters.TerraformDirectory%20%7D%7D%0A%20%20%20%20%20%20%20%20addSpnToEnvironment%3A%20true%0A%20%20%20%20%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FLI%3E%0A%3CLI%3E%3CP%3ETask%20Terraform%20init%20to%20initiate%20terraform%3C%2FP%3E%0A%3C%2FLI%3E%0A%3CLI%3E%3CP%3ETask%20Terraform%20apply%20will%20execute%20the%20terraform%20with%20auto-approve%20flag%20so%20terraform%20will%20run%20the%20apply.%3C%2FP%3E%0A%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CH5%20id%3D%22toc-hId-1575258304%22%20id%3D%22toc-hId-1575258304%22%3E%26nbsp%3B%3C%2FH5%3E%0A%3CH5%20id%3D%22toc-hId--232196159%22%20id%3D%22toc-hId--232196159%22%3E%3CSTRONG%3EP.S%20We%20could%20add%20task%20for%20terraform%20plan%20and%20the%20ask%20for%20approval.%3C%2FSTRONG%3E%3C%2FH5%3E%0A%3CP%3E%3CSTRONG%3ESetting%20up%20pipeline%20in%20Azure%20DevOps%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EUnder%20Pipeline%20Library%20Create%20new%20variable%20group%20call%20it%20terraform%20and%20create%20following%20variables%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_3-1617213751404.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F268689i360F30D15CD0C9AF%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_3-1617213751404.png%22%20alt%3D%22magdysalem_3-1617213751404.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%3EAdd%20new%20pipeline%20then%20select%20Github%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%3E%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_4-1617213793378.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F268690i80CF22AB46E1A311%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_4-1617213793378.png%22%20alt%3D%22magdysalem_4-1617213793378.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EAfter%20login%20select%20the%20terraform%20repo%26nbsp%3B%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%26nbsp%3B%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_5-1617213859936.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F268691iCC74383F34FC7B68%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_5-1617213859936.png%22%20alt%3D%22magdysalem_5-1617213859936.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%3ESelect%20Existing%20Azure%20Pipeline%20YAML%20then%20select%20%E2%80%9Cazure-pipeline-terraform.yml%E2%80%9D%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_6-1617214056039.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F268692i9EA6D9849F6C4E87%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_6-1617214056039.png%22%20alt%3D%22magdysalem_6-1617214056039.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3EOnce%20we%20save%20the%20pipeline%20and%20created%20the%20prerequisite%20resources%20and%20updated%20the%20variable.tf%20file%20then%20we%20are%20ready%20to%20run%20the%20pipeline%20and%20we%20should%20get%20something%20like%20that%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_7-1617214230548.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F268694iCB5AF80FF38EAF34%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_7-1617214230548.png%22%20alt%3D%22magdysalem_7-1617214230548.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId--943763841%22%20id%3D%22toc-hId--943763841%22%3E%3CSTRONG%20style%3D%22font-family%3A%20inherit%3B%22%3ECheck%20Our%20work%3C%2FSTRONG%3E%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3ECluster%20information%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EUnder%20cluster%20configuration%20we%20should%20see%20AAD%20is%20enabled%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_0-1617216276296.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F268714i94D01B5EEC78B30B%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22magdysalem_0-1617216276296.png%22%20alt%3D%22magdysalem_0-1617216276296.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%20style%3D%22font-family%3A%20inherit%3B%22%3EAzure%20POD%20Identity%20%2F%26nbsp%3B%20CSI%20Provider%20Pods%3C%2FSTRONG%3E%3CBR%20%2F%3EFrom%20command%20line%20we%20can%20check%20kube-system%20namespace%20for%20MIC%20and%20NMI%20pods%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_9-1617214291098.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F268696i24692C9B86FF2204%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_9-1617214291098.png%22%20alt%3D%22magdysalem_9-1617214291098.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_10-1617214299798.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F268697iD3EFB3391F7D7158%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_10-1617214299798.png%22%20alt%3D%22magdysalem_10-1617214299798.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3ENamespace%20Azure%20Identity%20and%20Azure%20Identity%20Binding%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_11-1617214337124.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F268698i42B7700AA5910788%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_11-1617214337124.png%22%20alt%3D%22magdysalem_11-1617214337124.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3ECheck%20for%20CSI%20secret%20store%20provider%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_12-1617214352096.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F268699i5950C4DD68FB69DE%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_12-1617214352096.png%22%20alt%3D%22magdysalem_12-1617214352096.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20script%20was%20executed%20successfully%2C%20and%20all%20our%20resources%20and%20resources%20deployment%20are%20in%20place.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-1543748992%22%20id%3D%22toc-hId-1543748992%22%3E%3CSTRONG%3ESummary%3C%2FSTRONG%3E%3C%2FH2%3E%0A%3CP%3EIn%20this%20article%20we%20demonstrated%20how%20to%20deploy%20AKS%20integrated%20with%20AAD%20and%20deploy%20Pod%20Identity%20and%20CSI%20provider%20using%20terraform%20and%20helm%20chart.%20In%20the%20next%20article%20we%20will%20demo%20how%20to%20build%20application%20and%20use%20POD%20Identity%20to%20access%20azure%20resources.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-2247508%22%20slang%3D%22en-US%22%3E%3CP%3EToday%20as%20we%20develop%20and%20run%20application%20in%20AKS%2C%20we%20do%20not%20want%20credentials%20like%20database%20connection%20strings%2C%20keys%2C%20or%20secrets%20and%20certificates%20exposed%20to%20the%20outside%20world%20where%20an%20attacker%20could%20take%20advantage%20of%20those%20secrets%20for%20malicious%20purposes.%20Our%20application%20should%20be%20designed%20to%20protect%20customer%20data.%20AKS%20documentation%20describes%20in%20detail%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Faks%2Fdeveloper-best-practices-pod-security%22%20rel%3D%22noopener%20noreferrer%22%20target%3D%22_blank%22%3Esecurity%20best%20practice%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2247508%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Emagdysalem%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Co-Authors
Version history
Last update:
‎Mar 31 2021 12:12 PM
Updated by: