-
Notifications
You must be signed in to change notification settings - Fork 90
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
May I know Azure workload identity works for aks virtual-node-aci-linux #381
Comments
We haven't tried running it in a virtual node but I can give it a try. Meanwhile, could you confirmed that the pod has been mutated (i.e. |
I think yes
|
This might be a bug in virtual-kubelet/azure-aci with service account token projected volumes. I see projected volume support was added as part of this PR. The check for service account projected volume assumes the token is stored in a Kubernetes secret: https://github.com/virtual-kubelet/azure-aci/blob/master/provider/aci.go#L1740-L1745 which isn't really the case. While default service account token is stored in a Kubernetes secret, the projected service account JWT token are not. @feiskyer for azure-aci |
Hi, @chewong did you get a chance to try in virtual node? |
The bug still exists in azure-aci. The PR I linked above added support for projected service account token volumes, but the projected service account token volume is incorrect. I would recommend opening an issue here. |
The bug is being tracked in azure-aci: virtual-kubelet/azure-aci#189. Closing this issue now. Please feel free to reopen if you've any questions. |
Currently, we are using Azure AD Pod Identity for our aks clusters.
We are exploring Azure AD workload identity and able to install using the below links and see it works in nodes as per the given example.
https://azure.github.io/azure-workload-identity/docs/introduction.html
https://github.com/Azure/azure-workload-identity
As mentioned in the 7th point or end of this page, https://azure.github.io/azure-workload-identity/docs/quick-start.html
I have deployed the workload and am able to access the key vault secret via the azure token.
Then I have updated the yaml with nodeSelector & tolerations to install in the virtual-node-aci-linux. Upon deploy, the pod is running but not able to access the keyvault secret.
Error when running kubectl logs podname:
E0215 15:21:21.216383 1 token_credential.go:43] 'failed to read the service account token from the filesystem' err='open /var/run/secrets/azure/tokens/azure-identity-token: no such file or directory'
The text was updated successfully, but these errors were encountered: