prescribe aad-pod-identity installation in kube-system #488
Conversation
There was a problem hiding this comment.
@ferantivero Thank you for the PR. If we change the default deployment to kube-system namespace it would break current users who rely on the deployment manifests for upgrades. Instead would it be possible to add a note recommending installing in kube-system namespace using the helm chart for AKS?
|
I could test this some time next week using helm3. |
|
Thank you @ferantivero! |
|
@ferantivero Can you please update the PR to add a note instead of changing the deployment to |
|
@aramase sure I can do that. But I‘d rather make the helm chart installation in kube-system the default one. In my opinion we can get the better of both worlds: production-ready installation by default and backwards compat. I‘m initially just adding a note as requested, unless you consider otherwise. |
|
@ferantivero That makes sense! So I think we can update this PR to add a note in the deployment section recommending deployment in kube-system namespace for AKS clusters. Then in a follow up PR, we can add the helm section in here as well https://github.com/Azure/aad-pod-identity#1-create-the-deployment. WDYT? |
|
@ferantivero Can you please update the PR when you get the chance? I want to add the recommendation to the docs before more users run into the issue. I can do it too if you aren't able to pick this up? Let me know. |
|
@aramase done: recommendation has been added to the docs. Please let me know in case you want to change the wording, typos, etc. |
README.md
Outdated
| @@ -41,6 +41,8 @@ Or run this command to deploy to a non-RBAC cluster: | |||
| kubectl apply -f https://raw.githubusercontent.com/Azure/aad-pod-identity/master/deploy/infra/deployment.yaml | |||
| ``` | |||
|
|
|||
| > Important: if you are behind a firewall (e.g. Azure Firewall) and the Kubernetes Api Server is outside of your [AKS] cluster subnet, it is recommended to install AAD Pod Identity in the `kuebe-system` namespace by using the [helm charts]. Otherwise, please ensure the Kuberentes Api Server is explicity allowed adding a layer 4 rule to your Firewall. | |||
There was a problem hiding this comment.
Important: For AKS clusters with limited egress-traffic, Please install pod-identity in kube-system namespace using the helm charts.
@ferantivero wdyt?
ferantivero
deleted the
feature/467_move-aad-pod-identity-to-kube-system
branch
* add recommendation to install in kube-system with helm * fix link * fix typos * address PR feedback: simplify wording
solves: #467
Reason for Change:
Prescribe add-pod-indentity installation in
kube-system, otherwise it might fail trying to contact the AKS Api ServerIssue Fixed:
fixes #467
Notes for Reviewers: