Configure and update Storage for Workload Identity - Githubissues

Altinn / altinn-storage

Altinn platform microservice for handling instance storage

1 stars 3 forks source link

Configure and update Storage for Workload Identity #411

Closed SandGrainOne closed 27 minutes ago

SandGrainOne commented 1 month ago

Description

The Storage application should be updated to access azure resources through workload identity.

Identified resources:

[x] #441
[x] #442

Tasks

[x] Configure the necessary accesses through workload identity (helm chart)
- [x] Service account
- [x] Azure AD configuration?
[x] Update the code to no longer use the kvSettings secrets to access the KeyVault

This will not be done by Altinn-platform:

[ ] Update the code to no longer aquire a SAS-token when accessing a Application Owner Storage Account.
[ ] QA
[ ] Manual tests

Acceptance criteria

[x] Storage can access the platform key vault without the explicitly shared credentials.
[ ] Storage can access all Application Owner blob storage without the explicityly shared credentials.

bengtfredh commented 1 month ago

We need to wait for @sduranc to be back at work 8/6

sduranc commented 2 days ago

Has been deployed https://github.com/Altinn/altinn-storage/pull/447
The SAS part will be discussed and implemented in a different task

Herskis commented 6 hours ago

Moved to Core after agreement between @sduranc and @SandGrainOne that Core will perform the last tasks.

SandGrainOne commented 27 minutes ago

Next step in this story will be tracked by issue #450