search

MicrosoftDocs / azure-docs

Open source documentation of Microsoft Azure
https://docs.microsoft.com/azure
Creative Commons Attribution 4.0 International
10.29k stars 21.47k forks source link

Bicep/ARM template for workload identity #103627

Closed chitturs closed 1 year ago

chitturs commented 1 year ago

Can we document bicep/ARM templates for automated, safe deployments?

Thanks

Document Details

⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

YashikaTyagii commented 1 year ago

@chitturs Thanks for your feedback! We will investigate and update as appropriate.

AjayBathini-MSFT commented 1 year ago

Hi @chitturs Could you please find below link for your reference. https://learn.microsoft.com/en-us/azure/templates/

chitturs commented 1 year ago

Hi @chitturs Could you please find below link for your reference. https://learn.microsoft.com/en-us/azure/templates/

Hey @AjayBathini-MSFT, I was looking for a specific sample showing a bicep template instead of az for both cluster creation with oidc and workloadid addons and federated credentials for managed identity. In addition, show samples of helm charts needed for the pod labels, annotations, service accounts, etc.

AjayBathini-MSFT commented 1 year ago

Hi @chitturs As per my research i have found two links for the above query which can be helpful. If you need any further assistance, you can reach out to support Team. https://learn.microsoft.com/en-us/azure/templates/microsoft.operationalinsights/clusters?pivots=deployment-language-bicep https://learn.microsoft.com/en-us/azure/templates/microsoft.managedidentity/userassignedidentities?pivots=deployment-language-arm-template

Support Link: I'd recommend working closer with our support team via an [Azure support request] (https://docs.microsoft.com/en-us/azure/azure-portal/supportability/how-to-create-azure-support-request).

miqm commented 1 year ago

👍🏻 on this.

The links you've provided does not provide how to create federated identity on the managed identity. Limiting this to a CLI task (and not even a powershell) is a bit problematic.

Please extend the documentation to flow with bicep and powershell.

AjayBathini-MSFT commented 1 year ago

Hi @miqm

To create federated identity on the managed identity we found the link for your reference. I

https://learn.microsoft.com/en-us/azure/active-directory/develop/workload-identity-federation-create-trust-user-assigned-managed-identity?pivots=identity-wif-mi-methods-azp#:~:text=the%20following%20steps.-,Configure%20a%20federated%20identity%20credential%20on%20a%20user%2Dassigned%20managed%20identity,In%20the%20Federated%20credential%20scenario%20dropdown%20box%2C%20select%20your%20scenario.,-GitHub%20Actions%20deploying

miqm commented 1 year ago

The link you provided is for using portal action. Please update the docs with bicep code if it's possible or explicitly say that you can't do this with ARM/Bicep.

AjayBathini-MSFT commented 1 year ago

@miqm I'm going to assign this to the document author so they can take a look at it accordingly.

@MGoedtel Can you please check and add your comments on this doc update request as applicable.

MGoedtel commented 1 year ago

@chitturs - Thanks for your inquiry. Here is an Azure Solution sample demonstrating how to deploy an AKS cluster with Workload Identity for a .NET-based application workload. It includes ARM/Bicep templates to accomplish this enterprise-grade configuration that is based on Workload Identity preview. You can evaluate if this fits your needs.

We are planning to publish a similar how-to guide after GA of this feature. Stay tuned.

I'm going to proceed with closing this GitHub issue as this isn't based on a specific issue identified with our existing documentation. #please-close