Open rouke-broersma opened 1 year ago
Hi, any plans to support this at some point? This is a great feature
Any update on supporting this one? cc: @aramase
same, looking for this solution. MS support integration to other resources using WI but not to ACR which is weird.
Is your feature request related to a problem? Please describe.
In azure you can connect your AKS cluster to an Azure Container Registry by granting the agent pool managed identity pull permission on the ACR. However this only works if the AKS cluster and the ACR are in the same tenant.
Describe the solution you'd like
Extend workload identity with the capability to request and renew a token for a container registry using federated credentials and create or patch a kubernetes pullsecret with the token on an interval. Add the pullsecret to the annotated service account. See: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account
Example config:
Describe alternatives you've considered
Build it myself, eg by following https://blogs.sap.com/2022/09/01/use-kubernetes-service-accounts-in-combination-with-oidc-identity-federation-for-imagepullsecrets/
Additional context