-
Notifications
You must be signed in to change notification settings - Fork 355
[IB] doc: add identity binding example setup #5430
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
This PR introduces a comprehensive example for the Identity Binding feature in AKS, providing users with step-by-step instructions and configuration files to set up managed identity access in their clusters. The example demonstrates how to configure RBAC permissions and deploy pods that authenticate to Azure services using managed identities.
Key Changes
- Added complete documentation with prerequisites, setup steps, and verification instructions for using Identity Binding
- Provided Kubernetes RBAC configurations to grant service accounts permission to use specific managed identities
- Included a sample pod manifest demonstrating Azure Key Vault access via Identity Binding
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 14 comments.
| File | Description |
|---|---|
| examples/identity-binding/README.md | Comprehensive guide covering prerequisites, Azure CLI commands for identity binding creation, RBAC setup, pod deployment, and verification steps |
| examples/identity-binding/cluster-role-and-cluster-role-binding.yaml | Kubernetes RBAC configuration defining ClusterRole with use-managed-identity verb and ClusterRoleBinding for the default service account |
| examples/identity-binding/pod.yaml | Sample pod manifest with identity binding annotations for accessing Azure Key Vault using managed identity |
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 9 comments.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
This pull request introduces a new example for the Identity Binding feature in AKS, providing documentation and configuration files to help users set up and test managed identity access in their clusters. The changes are grouped into documentation and configuration for RBAC and pod deployment.
Documentation and Instructions:
README.mdexplaining prerequisites, setup steps, and verification for using Identity Binding in AKS clusters, including notes on required Azure CLI and AKS features, RBAC setup, and pod deployment.Configuration for RBAC and Pod Deployment:
cluster-role-and-cluster-role-binding.yamlto define aClusterRoleandClusterRoleBindingthat grant the default service account permission to use a specific managed identity via the new verbuse-managed-identity.pod.yamlmanifest for deploying a sample pod that demonstrates access to Azure Key Vault using the managed identity and the new identity binding annotation.