search

Azure / AKS-Construction

Accelerate your onboarding to AKS with; Helper Web App, bicep templating and CI/CD samples. Flexible & secure AKS baseline implementations in a Microsoft + community maintained reference implementation.
https://azure.github.io/AKS-Construction/
MIT License
356 stars 165 forks source link

Added UI & BiCep update for issue 551. #681

Closed deepdolphin closed 6 months ago

deepdolphin commented 8 months ago

PR Summary

Added UI & Bicep updates to address issue #551. Currently no UI web tests.

PR Checklist

deepdolphin commented 8 months ago

TODO: Discuss how/when we run/fix this.

You will probably receive an error when you try to deploy using this new option because the User Identity that gets created during the running of the main Bicep needs access over the pre-existing User Identity that you want to run the Kublet under. As you don't know the GUID of the new identity, you can't assign it rights over your existing User Identity.

  1. You will need to deploy the template as normal then wait for an error which states that the "Managed Identity Operator" role is missing
  2. Grant the newly created managed identity used by AKS for control plane access (to change the MC_* resource group) the role of "Managed Identity Operator" over the Kublet managed identity. 
    az role assignment create --assignee '<controlplaneGUID>' --role "Managed Identity Operator" --scope '/subscriptions/<someguid>/resourcegroups/<rgname>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<kubeletidentityname>'
  3. Rerun the deployment template again.

Reference: https://learn.microsoft.com/en-us/azure/aks/use-managed-identity#add-role-assignment

github-actions[bot] commented 7 months ago

PR smells stale, no activity for 30 days. Stale Label will be removed if the PR is updated, otherwise closed in a month.