How-To: Deploy Microservice Application with Secrets Store CSI Driver Using Helm Chart

Published Jun 03 2021 11:31 AM 1,818 Views
Microsoft

 

In the last blog we discussed AKS Pod Identity and how we utilize this feature in our application and establish a secure access to Azure resources using Azure SDK libraries. One of disadvantage of using Pod Identity is in case of existing workload that use K8s secrets. If developer wants to adapt pod Identity instead of using K8s secrets, then developer will need to refactor the existing code and add Azure Key Vault libraries to retrieve secrets from KV.

Now this considers a blocker for customer with existing workload that depends on K8s secrets. By using Secret Store CSI Driver feature we can unblock customers and help them to moving their workload faster to AKS.

 

What is Secret Store CSI Driver?

Using the pod identity feature enables authentication against supporting Azure services. When applications need a credential, they communicate with the digital vault, retrieve the latest secret contents, and then connect to the required service. Azure Key Vault can be this digital vault. The simplified workflow for retrieving a credential from Azure Key Vault using pod managed identities is shown in the following diagram:

magdysalem_0-1622676141054.png

 

You can review Microsoft docs about secret provider and Pod security best practice here

 

How to use secret provider CSI ?

In order to use secret provider in our code we will need AKS cluster to be configured with Azure AAD and Pod Identity and Secret Store CSI driver deployed as we discussed in our pervious posts. The following chart summarize the steps

 

magdysalem_1-1622676206179.png

In our demo today, we will show how to create a pod with the “secret provider class” object mounted as a volume. You can find the code here

 

Helm Chart Review

The helm chart will be the same chart for all demos (java/C#/Python) we will override the values.yaml during the pipeline run to fit every demo needs. The chart will deploy the following:

magdysalem_2-1622678028154.png

 

  • Applications pods deployment: we can control how many replica from values.yaml
  • Service deployment:
  • Ingress deployment: map incoming request to app services

Same like last post there will be a metadata label aadpodbinding. The pod deployment file MUST have this label. In our environment we deployed the AzureIdentity and AzureIdentityBinding with same name like environment namespace hence we passing the namespace as value for aadpodbinding. 

magdysalem_3-1622678168156.png

 

To enable Secret Store CSI driver we will need to add Volume. 

magdysalem_4-1622678205916.png

 

You will notice in this demo we are passing the namespace as a name for secretProviderClass. During the first post we established the secretProviderClass object and name it as namespace.

magdysalem_5-1622678234635.png

 

After adding the volume, we will need to mount the volume to pod

magdysalem_6-1622678281361.png

 

One the great advantage of this feature is the ability to generate a K8s secrets beside mounting the secrets to pod. So the app can get the secret from the volume or use the traditional way to get secrets as environment variables.

In our demo we will be passing an environment variable call “COSMOS_DB_KEY

magdysalem_7-1622678303709.png

 

You will notice when we created the cluster and generated the secret store object we did assign value “cosmosdbkey” to secret file “demosecret

magdysalem_8-1622678335276.png

magdysalem_9-1622678390122.png

 

That is it.. now we are ready to launch the Pod and inject the secret as environment variable.

The following code sample will demonstrate how the pod will read the secrets as environment variable.

 

Java Demo

Rest API service that shows the value of the secret passed to pod as environment variable. The main class shows how we retrieve the secrets using annotation @Value

magdysalem_10-1622678448710.png

You will notice POM file does not have KeyVault library dependency in this demo.

 

Pipeline Review

The pipeline “azure-pipelines-java-csi.yml” has 3 stages as shows in the following figure

  • Java Build: using Maven will package the app and publish it with chart
  • Docker Build: using docker will build an image and publish it to ACR
  • Helm Deployment: using helm will connect to AKS then install helm chart under namespace “demo”. Please notice how we are passing new chart values as arguments 

Once it runs, we should see the following:

magdysalem_11-1622678505299.png

C# Demo

Source Code Review

Demo is identical to Java code. Rest API service that shows secret passed to pod as env variable.

magdysalem_12-1622678582651.png

 

The pipeline for ““azure-pipelines-csharp-csi.yml” is follow same structure of 3 stages

  • CSharp Build: using dotnet will package the app and publish it with chart
  • Docker Build: using docker will build an image and publish it to ACR
  • Helm Deployment: using helm will connect to AKS then install helm chart under namespace “demo”. Please notice how we are passing new chart values as arguments 

Python Demo

Source Code Review

Python code is a FlaskRest API example.

magdysalem_13-1622678609470.png

The pipeline for ““azure-pipelines-python-csi.yml” is follow same structure of 2 stages.

  • Docker Build: using docker will build an image and publish it to ACR
  • Helm Deployment: using helm will connect to AKS then install helm chart under namespace “demo”. Please notice how we are passing new chart values as arguments. 

Check our work:

Once we get pipelines deployed for all application, we can review the deployed resources.

  • Check Charts  

magdysalem_14-1622678684371.png

  • Check Pods

magdysalem_15-1622678747742.png

  • Check Services

magdysalem_16-1622678755614.png

  • Check Ingress

magdysalem_17-1622678769437.png

  • Use Postman to call apps using ingress host.

Java demo endpoint 

magdysalem_18-1622678781419.png

Python demo

magdysalem_19-1622678792700.png

C# demo

magdysalem_20-1622678806709.png

Summary

Today we concluded this series by we discussed how to use Secret Store CSI Driver.  In this series we discussed how to use Terraform and Azure Pipeline to deploy AKS fully integrated with AD, we also show how to deploy add-ons for Pod Identity and csi-driver objects. Then we discussed how to use Pod Identity with your application and finally we closed the series by showing how to leaverage Secret Store CSI Driver with Pod Identity to present the pods with the secrets.

 

Thank you for Reading!

 

 

%3CLINGO-SUB%20id%3D%22lingo-sub-2410737%22%20slang%3D%22en-US%22%3EHow-To%3A%20Deploy%20Microservice%20Application%20with%20Secrets%20Store%20CSI%20Driver%20Using%20Helm%20Chart%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2410737%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIn%20the%20last%20blog%20we%20discussed%20AKS%20Pod%20Identity%20and%20how%20we%20utilize%20this%20feature%20in%20our%20application%20and%20establish%20a%20secure%20access%20to%20Azure%20resources%20using%20Azure%20SDK%20libraries.%20One%20of%20disadvantage%20of%20using%20Pod%20Identity%20is%20in%20case%20of%20existing%20workload%20that%20use%20K8s%20secrets.%20If%20developer%20wants%20to%20adapt%20pod%20Identity%20instead%20of%20using%20K8s%20secrets%2C%20then%20developer%20will%20need%20to%20refactor%20the%20existing%20code%20and%20add%20Azure%20Key%20Vault%20libraries%20to%20retrieve%20secrets%20from%20KV.%3C%2FP%3E%0A%3CP%3ENow%20this%20considers%20a%20blocker%20for%20customer%20with%20existing%20workload%20that%20depends%20on%20K8s%20secrets.%20By%20using%20Secret%20Store%20CSI%20Driver%20feature%20we%20can%20unblock%20customers%20and%20help%20them%20to%20moving%20their%20workload%20faster%20to%20AKS.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId-2055960468%22%20id%3D%22toc-hId-2055960498%22%3E%3CSTRONG%3EWhat%20is%20Secret%20Store%20CSI%20Driver%3F%3C%2FSTRONG%3E%3C%2FH3%3E%0A%3CP%3EUsing%20the%20pod%20identity%20feature%20enables%20authentication%20against%20supporting%20Azure%20services.%20When%20applications%20need%20a%20credential%2C%20they%20communicate%20with%20the%20digital%20vault%2C%20retrieve%20the%20latest%20secret%20contents%2C%20and%20then%20connect%20to%20the%20required%20service.%20Azure%20Key%20Vault%20can%20be%20this%20digital%20vault.%20The%20simplified%20workflow%20for%20retrieving%20a%20credential%20from%20Azure%20Key%20Vault%20using%20pod%20managed%20identities%20is%20shown%20in%20the%20following%20diagram%3A%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_0-1622676141054.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F285749iD0A624E5D2B8EDC6%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_0-1622676141054.png%22%20alt%3D%22magdysalem_0-1622676141054.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20can%20review%20Microsoft%20docs%20about%20secret%20provider%20and%20Pod%20security%20best%20practice%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Faks%2Fdeveloper-best-practices-pod-security%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehere%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId-248506005%22%20id%3D%22toc-hId-248506035%22%3E%3CSTRONG%3EHow%20to%20use%20secret%20provider%20CSI%20%3F%3C%2FSTRONG%3E%3C%2FH3%3E%0A%3CP%3EIn%20order%20to%20use%20secret%20provider%20in%20our%20code%20we%20will%20need%20AKS%20cluster%20to%20be%20configured%20with%20Azure%20AAD%20and%20Pod%20Identity%20and%20Secret%20Store%20CSI%20driver%20deployed%20as%20we%20discussed%20in%20our%20pervious%20posts.%20The%20following%20chart%20summarize%20the%20steps%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_1-1622676206179.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F285750iD0C69594980AAC10%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_1-1622676206179.png%22%20alt%3D%22magdysalem_1-1622676206179.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EIn%20our%20demo%20today%2C%20we%20will%20show%20how%20to%20create%20a%20pod%20with%20the%20%E2%80%9Csecret%20provider%20class%E2%80%9D%20object%20mounted%20as%20a%20volume.%20You%20can%20find%20the%20code%20here%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId--1558948458%22%20id%3D%22toc-hId--1558948428%22%3E%3CSTRONG%3EHelm%20Chart%20Review%3C%2FSTRONG%3E%3C%2FH3%3E%0A%3CP%3EThe%20helm%20chart%20will%20be%20the%20same%20chart%20for%20all%20demos%20(java%2FC%23%2FPython)%20we%20will%20override%20the%20%3CSTRONG%3Evalues.yaml%3C%2FSTRONG%3E%20during%20the%20pipeline%20run%20to%20fit%20every%20demo%20needs.%20The%20chart%20will%20deploy%20the%20following%3A%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_2-1622678028154.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F285779i49938EB113B7C5B7%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_2-1622678028154.png%22%20alt%3D%22magdysalem_2-1622678028154.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EApplications%20pods%20deployment%3A%20we%20can%20control%20how%20many%20replica%20from%20%3CSTRONG%3Evalues.yaml%3C%2FSTRONG%3E%3C%2FLI%3E%0A%3CLI%3EService%20deployment%3A%3C%2FLI%3E%0A%3CLI%3EIngress%20deployment%3A%20map%20incoming%20request%20to%20app%20services%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3ESame%20like%20last%20post%20there%20will%20be%20a%20metadata%20label%20%3CSTRONG%3Eaadpodbinding%3C%2FSTRONG%3E.%20The%20pod%20deployment%20file%20MUST%20have%20this%20label.%20In%20our%20environment%20we%20deployed%20the%20%3CSTRONG%3EAzureIdentity%3C%2FSTRONG%3E%20and%20%3CSTRONG%3EAzureIdentityBinding%3C%2FSTRONG%3E%20with%20same%20name%20like%20environment%20namespace%20hence%20we%20passing%20the%20namespace%20as%20value%20for%20%3CSTRONG%3Eaadpodbinding.%26nbsp%3B%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_3-1622678168156.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F285780i024BCE3C4006680C%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_3-1622678168156.png%22%20alt%3D%22magdysalem_3-1622678168156.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20enable%20Secret%20Store%20CSI%20driver%20we%20will%20need%20to%20add%20Volume.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_4-1622678205916.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F285781i8E2FC1D211AF1657%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_4-1622678205916.png%22%20alt%3D%22magdysalem_4-1622678205916.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20will%20notice%20in%20this%20demo%20we%20are%20passing%20the%20namespace%20as%20a%20name%20for%20%3CSTRONG%3EsecretProviderClass%3C%2FSTRONG%3E.%20During%20the%20first%20post%20we%20established%20the%20%3CSTRONG%3EsecretProviderClass%3C%2FSTRONG%3E%20object%20and%20name%20it%20as%20namespace.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_5-1622678234635.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F285782i0AD6FFF1DEA4DA49%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_5-1622678234635.png%22%20alt%3D%22magdysalem_5-1622678234635.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAfter%20adding%20the%20volume%2C%20we%20will%20need%20to%20mount%20the%20volume%20to%20pod%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_6-1622678281361.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F285783i74CEABAAB38F806F%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_6-1622678281361.png%22%20alt%3D%22magdysalem_6-1622678281361.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EOne%20the%20great%20advantage%20of%20this%20feature%20is%20the%20ability%20to%20generate%20a%20K8s%20secrets%20beside%20mounting%20the%20secrets%20to%20pod.%20So%20the%20app%20can%20get%20the%20secret%20from%20the%20volume%20or%20use%20the%20traditional%20way%20to%20get%20secrets%20as%20environment%20variables.%3C%2FP%3E%0A%3CP%3EIn%20our%20demo%20we%20will%20be%20passing%20an%20environment%20variable%20call%20%E2%80%9C%3CSTRONG%3ECOSMOS_DB_KEY%3C%2FSTRONG%3E%E2%80%9D%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_7-1622678303709.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F285784iF779D7D77B4339A9%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_7-1622678303709.png%22%20alt%3D%22magdysalem_7-1622678303709.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20will%20notice%20when%20we%20created%20the%20cluster%20and%20generated%20the%20secret%20store%20object%20we%20did%20assign%20value%20%E2%80%9C%3CSTRONG%3Ecosmosdbkey%3C%2FSTRONG%3E%E2%80%9D%20to%20secret%20file%20%E2%80%9C%3CSTRONG%3Edemosecret%3C%2FSTRONG%3E%E2%80%9D%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_8-1622678335276.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F285785i245EE8A2D16D76AC%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_8-1622678335276.png%22%20alt%3D%22magdysalem_8-1622678335276.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_9-1622678390122.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F285786iBC3DD6CA44C662C6%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_9-1622678390122.png%22%20alt%3D%22magdysalem_9-1622678390122.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThat%20is%20it..%20now%20we%20are%20ready%20to%20launch%20the%20Pod%20and%20inject%20the%20secret%20as%20environment%20variable.%3C%2FP%3E%0A%3CP%3EThe%20following%20code%20sample%20will%20demonstrate%20how%20the%20pod%20will%20read%20the%20secrets%20as%20environment%20variable.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId-928564375%22%20id%3D%22toc-hId-928564405%22%3E%3CSTRONG%3EJava%20Demo%3C%2FSTRONG%3E%3C%2FH3%3E%0A%3CP%3ERest%20API%20service%20that%20shows%20the%20value%20of%20the%20secret%20passed%20to%20pod%20as%20environment%20variable.%20The%20main%20class%20shows%20how%20we%20retrieve%20the%20secrets%20using%20annotation%20%3CSTRONG%3E%40Value%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_10-1622678448710.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F285787iC58E5BA99E9B525E%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_10-1622678448710.png%22%20alt%3D%22magdysalem_10-1622678448710.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EYou%20will%20notice%20POM%20file%20does%20not%20have%20KeyVault%20library%20dependency%20in%20this%20demo.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EPipeline%20Review%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EThe%20pipeline%20%E2%80%9C%3CSTRONG%3Eazure-pipelines-java-csi.yml%3C%2FSTRONG%3E%E2%80%9D%20has%203%20stages%20as%20shows%20in%20the%20following%20figure%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EJava%20Build%3A%20using%20Maven%20will%20package%20the%20app%20and%20publish%20it%20with%20chart%3C%2FLI%3E%0A%3CLI%3EDocker%20Build%3A%20using%20docker%20will%20build%20an%20image%20and%20publish%20it%20to%20ACR%3C%2FLI%3E%0A%3CLI%3EHelm%20Deployment%3A%20using%20helm%20will%20connect%20to%20AKS%20then%20install%20helm%20chart%20under%20namespace%20%E2%80%9Cdemo%E2%80%9D.%20Please%20notice%20how%20we%20are%20passing%20new%20chart%20values%20as%20arguments%26nbsp%3B%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3EOnce%20it%20runs%2C%20we%20should%20see%20the%20following%3A%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_11-1622678505299.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F285788i98652CF4C33CBB7E%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_11-1622678505299.png%22%20alt%3D%22magdysalem_11-1622678505299.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EC%23%20Demo%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3ESource%20Code%20Review%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EDemo%20is%20identical%20to%20Java%20code.%20Rest%20API%20service%20that%20shows%20secret%20passed%20to%20pod%20as%20env%20variable.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_12-1622678582651.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F285789iC45669A499E9FCC9%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_12-1622678582651.png%22%20alt%3D%22magdysalem_12-1622678582651.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20pipeline%20for%20%E2%80%9C%E2%80%9Cazure-pipelines-csharp-csi.yml%E2%80%9D%20is%20follow%20same%20structure%20of%203%20stages%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3ECSharp%20Build%3A%20using%20dotnet%20will%20package%20the%20app%20and%20publish%20it%20with%20chart%3C%2FLI%3E%0A%3CLI%3EDocker%20Build%3A%20using%20docker%20will%20build%20an%20image%20and%20publish%20it%20to%20ACR%3C%2FLI%3E%0A%3CLI%3EHelm%20Deployment%3A%20using%20helm%20will%20connect%20to%20AKS%20then%20install%20helm%20chart%20under%20namespace%20%E2%80%9Cdemo%E2%80%9D.%20Please%20notice%20how%20we%20are%20passing%20new%20chart%20values%20as%20arguments%26nbsp%3B%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CSTRONG%3EPython%20Demo%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3ESource%20Code%20Review%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EPython%20code%20is%20a%20FlaskRest%20API%20example.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_13-1622678609470.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F285790iC54BB08236405321%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_13-1622678609470.png%22%20alt%3D%22magdysalem_13-1622678609470.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EThe%20pipeline%20for%20%E2%80%9C%E2%80%9Cazure-pipelines-python-csi.yml%E2%80%9D%20is%20follow%20same%20structure%20of%202%20stages.%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EDocker%20Build%3A%20using%20docker%20will%20build%20an%20image%20and%20publish%20it%20to%20ACR%3C%2FLI%3E%0A%3CLI%3EHelm%20Deployment%3A%20using%20helm%20will%20connect%20to%20AKS%20then%20install%20helm%20chart%20under%20namespace%20%E2%80%9Cdemo%E2%80%9D.%20Please%20notice%20how%20we%20are%20passing%20new%20chart%20values%20as%20arguments.%26nbsp%3B%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CH3%20id%3D%22toc-hId--878890088%22%20id%3D%22toc-hId--878890058%22%3E%3CSTRONG%3ECheck%20our%20work%3A%3C%2FSTRONG%3E%3C%2FH3%3E%0A%3CP%3EOnce%20we%20get%20pipelines%20deployed%20for%20all%20application%2C%20we%20can%20review%20the%20deployed%20resources.%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3ECheck%20Charts%20%26nbsp%3B%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_14-1622678684371.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F285791iD954362BFE3BAA5D%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_14-1622678684371.png%22%20alt%3D%22magdysalem_14-1622678684371.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3ECheck%20Pods%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_15-1622678747742.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F285792iB909479D806A29FD%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_15-1622678747742.png%22%20alt%3D%22magdysalem_15-1622678747742.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3ECheck%20Services%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_16-1622678755614.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F285793i442F44E8127AA8E3%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_16-1622678755614.png%22%20alt%3D%22magdysalem_16-1622678755614.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3ECheck%20Ingress%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_17-1622678769437.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F285794iD27148D22334B1A4%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_17-1622678769437.png%22%20alt%3D%22magdysalem_17-1622678769437.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EUse%20Postman%20to%20call%20apps%20using%20ingress%20host.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSTRONG%3EJava%20demo%20endpoint%26nbsp%3B%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_18-1622678781419.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F285796iC530A7CC76FF3363%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_18-1622678781419.png%22%20alt%3D%22magdysalem_18-1622678781419.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSTRONG%3EPython%20demo%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_19-1622678792700.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F285797iBE4018A63923E54A%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_19-1622678792700.png%22%20alt%3D%22magdysalem_19-1622678792700.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSTRONG%3EC%23%20demo%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22magdysalem_20-1622678806709.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F285798i382FA49C7ABA2D6C%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22magdysalem_20-1622678806709.png%22%20alt%3D%22magdysalem_20-1622678806709.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId--889393192%22%20id%3D%22toc-hId--889393162%22%3E%3CSTRONG%3ESummary%3C%2FSTRONG%3E%3C%2FH2%3E%0A%3CP%3EToday%20we%20concluded%20this%20series%20by%20we%20discussed%20how%20to%20use%20Secret%20Store%20CSI%20Driver.%26nbsp%3B%20In%20this%20series%20we%20discussed%20how%20to%20use%20Terraform%20and%20Azure%20Pipeline%20to%20deploy%20AKS%20fully%20integrated%20with%20AD%2C%20we%20also%20show%20how%20to%20deploy%20add-ons%20for%20Pod%20Identity%20and%20csi-driver%20objects.%20Then%20we%20discussed%20how%20to%20use%20Pod%20Identity%20with%20your%20application%20and%20finally%20we%20closed%20the%20series%20by%20showing%20how%20to%20leaverage%20Secret%20Store%20CSI%20Driver%20with%20Pod%20Identity%20to%20present%20the%20pods%20with%20the%20secrets.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThank%20you%20for%20Reading!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-2410737%22%20slang%3D%22en-US%22%3E%3CP%3EIn%20the%20last%20blog%20we%20discussed%20AKS%20Pod%20Identity%20and%20how%20we%20utilize%20this%20feature%20in%20our%20application%20and%20establish%20a%20secure%20access%20to%20Azure%20resources%20using%20Azure%20SDK%20libraries.%20One%20of%20disadvantage%20of%20using%20Pod%20Identity%20is%20in%20case%20of%20existing%20workload%20that%20use%20K8s%20secrets.%20If%20developer%20wants%20to%20adapt%20pod%20Identity%20instead%20of%20using%20K8s%20secrets%2C%20then%20developer%20will%20need%20to%20refactor%20the%20existing%20code%20and%20add%20Azure%20Key%20Vault%20libraries%20to%20retrieve%20secrets%20from%20KV.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2410737%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Emagdysalem%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Co-Authors
Version history
Last update:
‎Jun 03 2021 12:29 PM
Updated by: