Azure Key Vault with Managed Identities on Kubernetes

Prerequisites

• Azure Subscription
• Azure CLI

Setup Managed Identity and Azure Key Vault

1. Login to Azure and set the default subscription

   # Log in Azure
   az login
   
   # Set your subscription to the default subscription
   az account set -s [your subscription id]
   

2. Create an Azure Key Vault in a region

   az keyvault create --location [region] --name [your keyvault] --resource-group [your resource group]
   

3. Create the managed identity(Optional)

   This step is required only if the AKS Cluster is provisoned without the flag “–enable-managed-identity”. If the cluster is provisioned with manahed identity, than is suggested to use the autogenerated managed identity that is associated to the Resource Group MC_*.

   $identity = az identity create -g [your resource group] -n [you managed identity name] -o json | ConvertFrom-Json
   

   Below the command to retrieve the managed identity in the autogenerated scenario:

   az aks show -g <AKSResourceGroup> -n <AKSClusterName>
   

   For more detail about the roles to assign to integrate AKS with Azure Services Role Assignment.

4. Retrieve Managed Identity ID

   The two main scenario are:

   • Service Principal, in this case the Resource Group is the one in which is deployed the AKS Service Cluster

   $clientId= az aks show -g <AKSResourceGroup> -n <AKSClusterName> --query servicePrincipalProfile.clientId -otsv
   

   • Managed Identity, in this case the Resource Group is the one in which is deployed the AKS Service Cluster

   $clientId= az aks show -g <AKSResourceGroup> -n <AKSClusterName> --query identityProfile.kubeletidentity.clientId -otsv
   

5. Assign the Reader role to the managed identity

   For AKS cluster, the cluster resource group refers to the resource group with a MC_ prefix, which contains all of the infrastructure resources associated with the cluster like VM/VMSS.

   az role assignment create --role "Reader" --assignee $clientId --scope /subscriptions/[your subscription id]/resourcegroups/[your resource group]
   

6. Assign the Managed Identity Operator role to the AKS Service Principal Refer to previous step about the Resource Group to use and which identity to assign

   az role assignment create  --role "Managed Identity Operator"  --assignee $clientId  --scope /subscriptions/[your subscription id]/resourcegroups/[your resource group]
   
   az role assignment create  --role "Virtual Machine Contributor"  --assignee $clientId  --scope /subscriptions/[your subscription id]/resourcegroups/[your resource group]
   

7. Add a policy to the Key Vault so the managed identity can read secrets

   az keyvault set-policy --name [your keyvault] --spn $clientId --secret-permissions get list
   

8. Enable AAD Pod Identity on AKS

   kubectl apply -f https://raw.githubusercontent.com/Azure/aad-pod-identity/master/deploy/infra/deployment-rbac.yaml
      
   # For AKS clusters, deploy the MIC and AKS add-on exception by running -
   kubectl apply -f https://raw.githubusercontent.com/Azure/aad-pod-identity/master/deploy/infra/mic-exception.yaml
   

9. Configure the Azure Identity and AzureIdentityBinding yaml

   Save the following yaml as azure-identity-config.yaml:

   apiVersion: "aadpodidentity.k8s.io/v1"
   kind: AzureIdentity
   metadata:
     name: [you managed identity name]
   spec:
     type: 0
     resourceID: [you managed identity id]
     clientID: [you managed identity Client ID]
   ---
   apiVersion: "aadpodidentity.k8s.io/v1"
   kind: AzureIdentityBinding
   metadata:
     name: [you managed identity name]-identity-binding
   spec:
     azureIdentity: [you managed identity name]
     selector: [you managed identity selector]
   

10. Deploy the azure-identity-config.yaml:

    kubectl apply -f azure-identity-config.yaml
    

Configure Dapr component

In Kubernetes mode, you store the certificate for the service principal into the Kubernetes Secret Store and then enable Azure Key Vault secret store with this certificate in Kubernetes secretstore.

1. Create azurekeyvault.yaml component file

   The component yaml uses the name of your key vault and the Cliend ID of the managed identity to setup the secret store.

   apiVersion: dapr.io/v1alpha1
   kind: Component
   metadata:
     name: azurekeyvault
     namespace: default
   spec:
     type: secretstores.azure.keyvault
     version: v1
     metadata:
     - name: vaultName
       value: [your_keyvault_name]
     - name: spnClientId
       value: [your_managed_identity_client_id]
   

2. Apply azurekeyvault.yaml component

   kubectl apply -f azurekeyvault.yaml
   

References

• Azure CLI Keyvault CLI
• Create an Azure service principal with Azure CLI
• AAD Pod Identity
• Secrets building block
• How-To: Retreive a secret
• How-To: Reference secrets in Dapr components
• Secrets API reference