Closed TeamDman closed 2 weeks ago
what blob csi driver version are you using? is it managed by AKS? we are not releasing the workload identity support release yet.
I believe it's the AKS managed one, will follow up Tuesday when I'm back at the console
@TeamDman the managed blob csi driver does not support workload identity, it supports managed identity instead, check details here: https://github.com/kubernetes-sigs/blob-csi-driver/blob/master/docs/workload-identity.md
in your case, you could remove AzureStorageAuthType
, and AzureStorageIdentityClientId
parameters in volumeAttributes
, and then grant the managed identity for the kubelet on the agent node read & write access to the storage account, it should work.
you could also set AzureStorageAuthType: msi
and set a correct AzureStorageIdentityClientId
value, then the blobfuse mount would use the managed identity you assigned to mount directly.
I hesitate to grant the kubelet identity the perms since that grants the whole cluster access. I'm setting up a shared environment where multiple teams will be using a cluster separated by namespaces; the goal is to be able to use managed identities so I'll check out the second part you linked!
Node pools Kubernetes versions 1.23.12
Node sizes Standard_D2s_v3
Cluster Configuration Kubernetes version 1.24.9
Here's what I'm using
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
helmCharts:
- name: blob-csi-driver
repo: https://raw.githubusercontent.com/kubernetes-sigs/blob-csi-driver/master/charts
version: v1.18.0
namespace: kube-system
releaseName: blob-csi-driver
valuesInline:
controller:
replicas: 1
node.enableBlobfuseProxy: true
cloud: AzureStackCloud
Will follow up once I get the time to try the msi
auth type.
@TeamDman msi is managed identity, and it can only be assigned to node level. if you want namespace isolation identity, account key stored as k8s secret is the only way now.
Thanks for the clarification, will wait for GA release of the full support then <3
/assign @cvvz
The Kubernetes project currently lacks enough contributors to adequately respond to all issues.
This bot triages un-triaged issues according to the following rules:
lifecycle/stale
is appliedlifecycle/stale
was applied, lifecycle/rotten
is appliedlifecycle/rotten
was applied, the issue is closedYou can:
/remove-lifecycle stale
/close
Please send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale
The Kubernetes project currently lacks enough contributors to adequately respond to all issues.
This bot triages un-triaged issues according to the following rules:
lifecycle/stale
is appliedlifecycle/stale
was applied, lifecycle/rotten
is appliedlifecycle/rotten
was applied, the issue is closedYou can:
/remove-lifecycle stale
/close
Please send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.
This bot triages un-triaged issues according to the following rules:
lifecycle/stale
is appliedlifecycle/stale
was applied, lifecycle/rotten
is appliedlifecycle/rotten
was applied, the issue is closedYou can:
/remove-lifecycle rotten
/close
Please send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle rotten
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.
This bot triages issues according to the following rules:
lifecycle/stale
is appliedlifecycle/stale
was applied, lifecycle/rotten
is appliedlifecycle/rotten
was applied, the issue is closedYou can:
/reopen
/remove-lifecycle rotten
Please send feedback to sig-contributor-experience at kubernetes/community.
/close not-planned
@k8s-triage-robot: Closing this issue, marking it as "Not Planned".
Is your feature request related to a problem?/Why is this needed
I have a cluster where I have a k8s service account set up with Workload Identity.
https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview
The identity has Storage Blob Data Reader role, so it should be able to read the storage account?
However, it doesn't seem like this is a supported use case, instead I think we are required to create a k8s secret with a storage key?
https://github.com/kubernetes-sigs/blob-csi-driver/blob/master/deploy/example/e2e_usage.md
Describe the solution you'd like in detail
I'd like this to work without needing to create a secret for the storage key, since I should be able to give the workload identity principle the necessary roles to access the storage
Describe alternatives you've considered
Additional context
The above example errors with the following
I tried adding the object id in case that helped, but it seems that I was right the first time and only the client ID should need to be specified