chore: remove variables for workload identity#256
Conversation
| {{- end }} | ||
| - name: AZURE_FEDERATED_TOKEN_FILE | ||
| value: "/var/run/secrets/azure/tokens/azure-identity-token" | ||
| {{- if .Values.azure.subscriptionId }} |
There was a problem hiding this comment.
How will AZURE_SUBSCRIPTION_ID be used? It's not necessary for workload identity.
There was a problem hiding this comment.
we will set the default sub for az using AZURE_SUBSCRIPTION_ID if it is set, please keep it.
There was a problem hiding this comment.
AZURE_SUBSCRIPTION_ID env seems to be wrapped around by if .Values.workloadIdentity.enabled, should we move it outside of it, so that it can be used to set the default sub for other scenarios?
There was a problem hiding this comment.
good point, could you please move it?
There was a problem hiding this comment.
Done already. Now AZURE_SUBSCRIPTION_ID env does not rely on workload identity's enablement.
docs/helm-workload-identity.md
Outdated
| | `workloadIdentity.enabled` | Enable Azure Workload Identity | `false` | | ||
| | `azure.tenantId` | Azure Tenant ID (required for Workload Identity) | `""` | | ||
| | `azure.clientId` | Azure Client ID (required for Workload Identity) | `""` | | ||
| | `azure.subscriptionId` | Azure Subscription ID | `""` | |
There was a problem hiding this comment.
We can remove azure.subscriptionId from the table when it's confirmed that azure.subscriptionId is not used.
| --set workloadIdentity.enabled=true \ | ||
| --set azure.tenantId=$TENANT_ID \ | ||
| --set azure.clientId=$IDENTITY_CLIENT_ID \ | ||
| --set azure.subscriptionId=$SUBSCRIPTION_ID |
| labels: | ||
| {{- include "aks-mcp.labels" . | nindent 4 }} | ||
| {{- if .Values.workloadIdentity.enabled }} | ||
| azure.workload.identity/use: "true" |
There was a problem hiding this comment.
azure.workload.identity/use: "true" is only required for pod
when
--enable-oidc-issuerand--enable-workload-identityis turned on the AKS cluster, and the application enable the workload identity byazure.workload.identity/use: "true", the workload identity webhook will addEnvironmentVariables and addProjectedTokenVolumeMount. For example, the following spec are auto injected to the workload identity pod.We don't have to add the related environment variables and projected service account into aks-mcp pod spec.