Azure AKS - give entire cluster access to Azure Key Vault

D'Antico1, Alexander 41 Reputation points
2022-04-20T06:44:33.87+00:00

I'm trying to find a way to give an entire AKS cluster to Azure Key vault. I have temporarily got this working by following the below process:

Go to the VMSS of the cluster -> Identity -> Set System Assigned Status to 'On'
Add this Managed identity as an access policy to Key Vault.

This works, however whenever I stop and start the cluster, I have to re-create this managed identity in the vmss and re-add it to Key Vault. I have tried using the User Assigned Identities for the vmss as well but that does not seem to work.

I also cannot use the azure pod identities/CSI features for other reasons so I'm just looking for a simple way to give my cluster permanent access to key Vault.

Thanks in advance

Azure Key Vault
Azure Key Vault
An Azure service that is used to manage and protect cryptographic keys and other secrets used by cloud apps and services.
1,126 questions
Azure Kubernetes Service (AKS)
Azure Kubernetes Service (AKS)
An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.
1,867 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. vipullag-MSFT 24,206 Reputation points Microsoft Employee
    2022-04-21T05:57:17.943+00:00

    @D'Antico1, Alexander

    Welcome to Microsoft Q&A Platform, thanks for posting your query here.

    Azure AD Workload Identity is the new approach which "binds" Service Principle to service account and offer native access as long as you are using latest official Azure client library for authentication. Please follow steps just for the keyvault situation you are looking at (Ref:https://azure.github.io/azure-workload-identity/docs/quick-start.html).

    Assigning managed identities will have manual steps and AKS doesn't support or endorse manually modifying resources inside the node resource group.

    Hope that helps.
    If the suggested response helped you resolve your issue, please 'Accept as answer', so that it can help others in the community looking for help on similar topics.

    0 comments