Tag · 8 posts
#identity
Authenticate to Azure Resources with Azure Managed Identities
In this post, we will take a look at managed identities in general and system-assigned managed identity in particular. Managed identities can be used by your code to authenticate to Azure AD resources from Azure compute resources that support it, like virtual machines and containers. But first, let’s look at the other option and why…
azureAKS Workload Identity Revisited
A while ago, I blogged about Workload Identity. Since then, Microsoft simplified the configuration steps and enabled Managed Identity, in addition to app registrations. But first, let’s take a step back. Why do you need something like workload identity in the first place? Take a look at the diagram below. Workloads (deployed in a container…
azureQuick Guide to Kubernetes Workload Identity on AKS
IMPORTANT: the steps below are not relevant anymore; the steps in the quick guide have been updated; see https://github.com/gbaeke/quick-guides/blob/main/workload-identity/README.md for the correct steps. Some things that have changed: you can now use managed identities instead of app registrations; federated token configuration is at the managed identity level you do not need to install the webhook…
azureAKS Pod Identity with the Azure SDK for Go
In an earlier post, I wrote about the use of AKS Pod Identity (Preview) in combination with the Azure SDK for Python. Although that works fine, there are some issues with that solution: the container image is around 1GB, which is quite large (it is based on tiangolo/uvicorn-gunicorn-fastapi:python3.7) as expected, the image contains many vulnerabilities…
azureAzure AD pod-managed identities in AKS revisited
A long time ago, I wrote a blog post about assigning managed identities to pods in Azure Kubernetes Services (AKS) to authenticate to Azure Storage. The implementation was based on the aad-pod-identity project on GitHub. You can look at the walkthrough to see how it worked. Microsoft recently released a preview that enables you to…
azureAzure SQL, Azure Active Directory and Seamless SSO: An Overview
Instead of pure lift-and-shift migrations to the cloud, we often encounter lift-shift-tinker migrations. In such a migration, you modify some of the application components to take advantage of cloud services. Often, that’s the database but it could also be your web servers (e.g. replaced by Azure Web App). When you replace SQL Server on-premises with…
azureAKS Managed Pod Identity and access to Azure Storage
When you need to access Azure Storage (or other Azure resources) from a container in AKS (Kubernetes on Azure), you have many options. You can put credentials in your code (nooooo!), pass credentials via environment variables, use Kubernetes secrets, obtain secrets from Key Vault and so on. Usually, the credentials are keys but you can…
automationDeploying Azure resources using webhookd
In the previous blog post, I discussed adding SSL to webhookd. In this post, I will briefly show how to use this solution to deploy Azure resources. To run webhookd, I deployed a small Standard_B1s machine (1GB RAM, 1 vCPU) with a system assigned managed identity. After deployment, information about the managed identity is available…
api