Azure

How is AKS workload identity different from AKS pod managed identity?

March 12, 2023 Azure, Azure, Azure Kubernetes Service(AKS), Cloud Computing, Cloud Native, Cloud Strategy, Kubernetes, Managed Services, Microsoft, PaaS, Platforms No comments

AKS workload identity and AKS pod managed identity both provide a way to manage access to Azure resources from within a Kubernetes cluster. However, there are some key differences between the two features.

Scope

AKS pod managed identity provides a managed identity for each individual pod within a Kubernetes cluster. This allows you to grant access to Azure resources at a very granular level. AKS workload identity, on the other hand, provides a single AAD service principal for a Kubernetes namespace. This provides a broader scope for access to Azure resources within the namespace.

Access management

With AKS pod managed identity, you can assign roles or permissions directly to individual pods. This provides greater flexibility for managing access to Azure resources within the cluster. With AKS workload identity, access management is done through AAD roles and role assignments. This provides a more centralized approach to managing access to Azure resources within the namespace.

Security

AKS pod managed identity eliminates the need to store secrets or access tokens within pod configurations, which can improve the security of the Kubernetes cluster. AKS workload identity also eliminates the need to store secrets or access tokens within pod configurations. However, because the AAD service principal is shared by all pods within the namespace, there is a risk that if the service principal is compromised, all pods within the namespace could be affected.

In summary, AKS workload identity is a powerful feature of AKS that enables you to use Azure Active Directory to manage access to Azure resources from within a Kubernetes cluster. By creating a single AAD service principal for a Kubernetes namespace, AKS workload identity provides a centralized approach to access management. This can simplify the management of access to Azure resources and improve the security of your Kubernetes cluster.

While AKS pod managed identity and AKS workload identity both provide a way to manage access to Azure resources from within a Kubernetes cluster, they have different scopes and approaches to access management. By understanding the differences between the two features, you can choose the approach that best meets the needs of your organization.

What is different between Pod managed identity and AKS managed identity

March 12, 2023 Azure, Azure, Platforms No comments

Both Pod Managed Identity and AKS Managed Identity are identity management solutions provided by Azure, but they have some key differences.

Pod Managed Identity

Pod Managed Identity is an Azure feature that provides an identity for a single Kubernetes pod. It allows the pod to access Azure resources without the need for credentials such as passwords or keys.

With Pod Managed Identity, a Managed Identity is created for the pod, which is then granted access to the Azure resources that the pod needs to access. The pod can then use this Managed Identity to authenticate to Azure services, such as Azure Key Vault, Azure Container Registry, and Azure Storage.

AKS Managed Identity

AKS Managed Identity is an Azure feature that provides an identity for an entire AKS cluster. It allows the AKS cluster to access Azure resources without the need for service principals or credentials such as passwords or keys.

With AKS Managed Identity, a Managed Identity is created for the AKS cluster during the creation process. The Managed Identity is then granted access to the Azure resources that the cluster needs to access. The AKS cluster can then use this Managed Identity to authenticate to Azure services, such as Azure Key Vault, Azure Container Registry, and Azure Storage.

Differences between Pod Managed Identity and AKS Managed Identity

  1. Scope: Pod Managed Identity provides an identity for a single Kubernetes pod, while AKS Managed Identity provides an identity for an entire AKS cluster.
  2. Management: Pod Managed Identity is managed at the pod level, while AKS Managed Identity is managed at the cluster level.
  3. Access: Pod Managed Identity provides access to Azure resources for a single pod, while AKS Managed Identity provides access to Azure resources for an entire AKS cluster.
  4. Use cases: Pod Managed Identity is useful when an application running in a pod needs to access Azure resources, while AKS Managed Identity is useful when an entire AKS cluster needs to access Azure resources.
  5. Configuration: Pod Managed Identity requires additional configuration for each pod that needs to access Azure resources, while AKS Managed Identity only needs to be configured once for the entire AKS cluster.
  6. Security: AKS Managed Identity provides a more secure way of authenticating to Azure services, as it eliminates the need for service principals and reduces the risk of credentials being compromised.

In summary, Pod Managed Identity and AKS Managed Identity are two different identity management solutions provided by Azure that offer different scopes, management, access, use cases, configuration, and security levels. The choice between the two will depend on the specific requirements of the application and the level of management and security needed.

AKS pod managed identity

March 12, 2023 Azure, Azure, Azure Kubernetes Service(AKS), Cloud Computing, Cloud Native, Kubernetes, Managed Services, PaaS, Platforms No comments

Kubernetes has become one of the most popular container orchestration tools, and Azure Kubernetes Service (AKS) is a managed Kubernetes service provided by Microsoft Azure. With the increasing use of Kubernetes and AKS, there is a growing need to improve the security and management of access to cloud resources.

AKS pod managed identity is a feature of AKS that simplifies the management of access to Azure resources by creating an identity for each pod in a Kubernetes cluster. The AKS pod managed identity allows the pods to access Azure services securely without the need to manage credentials, passwords, or access tokens.

In this blog post, we’ll take a closer look at what AKS pod managed identity is, how it works, and its benefits.

What is AKS Pod Managed Identity?

AKS pod managed identity is a feature of AKS that enables the management of identities for pods in a Kubernetes cluster. When a pod is created with AKS pod managed identity enabled, a Managed Identity is automatically created for that pod. This Managed Identity is then used to authenticate the pod with Azure services such as Azure Key Vault, Azure Storage, and Azure SQL Database, among others.

AKS pod managed identity eliminates the need for storing secrets and credentials within the pod’s configuration, which can improve the security of the pod and simplify the management of access to cloud resources.

How AKS Pod Managed Identity Works

AKS pod managed identity uses Azure’s Managed Identity service, which is a feature of Azure Active Directory (AAD). When a pod is created in an AKS cluster with pod managed identity enabled, a Managed Identity is automatically created for that pod.

To use AKS pod managed identity, you must first enable the feature in your AKS cluster. This can be done using the Azure CLI or through the Azure portal. Once enabled, you can then create a Kubernetes manifest file that includes a ManagedIdentity resource definition for each pod that needs to access Azure resources.

Here’s an example of a Kubernetes manifest file that uses AKS pod managed identity:

#yaml 
apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  containers:
  - name: my-container
    image: my-image
    env:
    - name: AZURE_TENANT_ID
      value: "<tenant-id>"
    - name: AZURE_CLIENT_ID
      value: "<client-id>"
    - name: AZURE_CLIENT_SECRET
      valueFrom:
        secretKeyRef:
          name: my-secret
          key: my-secret-key
  identity:
    type: ManagedIdentity

In this example, the identity section defines a Managed Identity for the pod using the type: ManagedIdentity field. The AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET environment variables are also defined, which allow the pod to authenticate with Azure services using its Managed Identity.

Once the pod is created, you can then grant it access to Azure resources by assigning it the appropriate role or permissions. This can be done using Azure’s Role-Based Access Control (RBAC) system or through other access control mechanisms provided by Azure services.

Here’s another example manifest file that demonstrates how to use AKS Pod Managed Identity:

#yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: my-app
        image: myregistry/my-app:v1
        ports:
        - containerPort: 80
        env:
        - name: AzureServicesAuthConnectionString
          value: RunAs=App;AppId=<app-id>;TenantId=<tenant-id>;AppKey=<app-key>
      identity:
        type: ManagedIdentity

In this example, the identity section defines a Managed Identity for the pod using the type: ManagedIdentity field. The AzureServicesAuthConnectionString environment variable is also defined, which allows the pod to authenticate with Azure services using its Managed Identity.

Once the pod is created, you can then grant it access to Azure resources by assigning it the appropriate role or permissions. This can be done using Azure’s Role-Based Access Control (RBAC) system or through other access control mechanisms provided by Azure services.

Benefits of AKS Pod Managed Identity

AKS pod managed identity provides several benefits, including:

Improved security

AKS pod managed identity eliminates the need to store credentials or access tokens within the pod’s configuration. This reduces the risk of accidental exposure of sensitive data and improves the overall security of the pod and the cluster.

Simplified management

AKS pod managed identity simplifies the management of access to cloud resources by creating an identity for each pod in a Kubernetes cluster. This eliminates the need to manage service principals or credentials manually, which can reduce the administrative overhead and improve the efficiency of the cluster.

Greater flexibility

AKS pod managed identity provides greater flexibility by allowing you to grant access to Azure resources at a more granular level. You can assign roles or permissions directly to individual pods, which can reduce the risk of unauthorized access and improve the overall security posture of the cluster.

Easier compliance

AKS pod managed identity can make it easier to comply with regulatory requirements such as GDPR, HIPAA, and PCI DSS. By eliminating the need to store secrets and credentials within the pod’s configuration, you can reduce the risk of non-compliance and simplify the auditing process.

Better scalability

AKS pod managed identity can help improve the scalability of your Kubernetes clusters by reducing the overhead associated with managing service principals or credentials manually. This can enable you to scale your clusters more easily and efficiently, which can improve the overall performance and availability of your applications.

Conclusion

AKS pod managed identity is a powerful feature of AKS that can simplify the management of access to Azure resources, improve the security of your pods and clusters, and help you comply with regulatory requirements. By creating a Managed Identity for each pod in your Kubernetes cluster, AKS pod managed identity can eliminate the need to manage credentials and access tokens manually, which can reduce the administrative overhead and improve the efficiency of your operations.

In addition to AKS pod managed identity, Azure provides other identity and access management features such as AKS managed identity and workload management identity that can help you manage access to your Azure resources securely. By using these features in conjunction with AKS pod managed identity, you can create a comprehensive identity and access management solution for your Kubernetes workloads in Azure.

References

  • Use Azure Active Directory pod-managed identities in Azure Kubernetes Service (Preview)

AKS Workload Identity

March 11, 2023 Azure, Azure, Azure Kubernetes Service(AKS), Cloud Computing, Cloud Native, Computing, Intelligent Cloud, Kubernetes, Managed Services, Microsoft, PaaS, Platforms No comments

AKS workload identity is a feature of Azure Kubernetes Service (AKS) that enables you to use Azure Active Directory (AAD) to manage access to Azure resources from within a Kubernetes cluster. In this blog post, we’ll explore how AKS workload identity works and how to use it with an example code.

How does AKS workload identity work?

AKS workload identity works by creating an AAD service principal that is associated with a Kubernetes namespace. This service principal can be used by pods within the namespace to access Azure resources, such as storage accounts, without needing to store secrets or access tokens within the pod configuration.

When a pod needs to access an Azure resource, it sends a request to the Kubernetes API server, which forwards the request to the Azure Identity Binding Controller. The controller then looks up the AAD service principal associated with the namespace and retrieves an access token from AAD on behalf of the pod. This access token is then used to authenticate the pod to the Azure resource.

How to use AKS workload identity

To use AKS workload identity, you need to have an Azure subscription, an AKS cluster, and an AAD tenant. Here are the steps to set up AKS workload identity and use it in your application:

1. Create an AAD application registration

First, you need to create an AAD application registration for your AKS cluster. This application registration will be used to create the service principal that is associated with your Kubernetes namespace.

You can create an application registration by following these steps:

  1. Go to the Azure portal and navigate to your AAD tenant.
  2. Click on “App registrations” and then click on “New registration”.
  3. Give your application a name and select “Accounts in this organizational directory only” for the supported account types.
  4. Under “Redirect URI (optional)”, select “Web” and enter a dummy URI.
  5. Click on “Register”.

Make a note of the “Application (client) ID” and “Directory (tenant) ID” for later use.

2. Grant permissions to the AAD application registration

Next, you need to grant permissions to the AAD application registration to access the Azure resources that you want to use in your application.

You can grant permissions by following these steps:

  1. Go to the Azure portal and navigate to the resource that you want to grant access to.
  2. Click on “Access control (IAM)” and then click on “Add role assignment”.
  3. Select the role that you want to assign and then search for the name of your AAD application registration.
  4. Select your AAD application registration from the list and then click on “Save”.

3. Create a Kubernetes namespace with AKS workload identity enabled

Next, you need to create a Kubernetes namespace with AKS workload identity enabled. This namespace will be associated with the AAD service principal that you created in step 1.

You can create a namespace with AKS workload identity enabled by following these steps:

  1. Create a Kubernetes namespace with the following annotations:
#yaml code
apiVersion: v1
kind: Namespace
metadata:
  name: <your-namespace-name>
  annotations:
    "aadpodidentitybinding": "binding-name"
  1. Create an AKS identity binding with the following annotations:
#yaml codeapiVersion: aadpodidentity.k8s.io/v1
kind: AzureIdentityBinding
metadata:
  name: binding-name
spec:
  azureIdentity: <your-azure-identity>
  selector: <your-selector>

4. Use AKS workload identity in your application

Finally, you can use AKS workload identity in your application by configuring your application to use the service principal associated with your Kubernetes namespace.

Here’s an example code snippet in C# that demonstrates how to use AKS workload identity with the Azure SDK for .NET:

#csharp code
using System;
using System.Threading.Tasks;
using Microsoft.Azure.Storage;
using Microsoft.Azure.Storage.Blob;
using Microsoft.Azure.Services.AppAuthentication;

namespace AKSWorkloadIdentityExample
{
    class Program
    {
        static async Task Main(string[] args)
        {
            // create a new instance of AzureServiceTokenProvider
            var tokenProvider = new AzureServiceTokenProvider();

            // create a new instance of CloudStorageAccount using the AKS identity endpoint
            var storageAccount = new CloudStorageAccount(new Microsoft.Azure.Storage.Auth.TokenCredentialAdapter(tokenProvider), "<your-storage-account-name>", endpointSuffix: null, useHttps: true);

            // create a new instance of CloudBlobClient using the CloudStorageAccount
            var blobClient = storageAccount.CreateCloudBlobClient();

            // use the CloudBlobClient to retrieve the contents of a blob
            var container = blobClient.GetContainerReference("<your-container-name>");
            var blob = container.GetBlockBlobReference("<your-blob-name>");
            var contents = await blob.DownloadTextAsync();

            Console.WriteLine(contents);
        }
    }
}

In this example, we create a new instance of AzureServiceTokenProvider, which uses the AKS identity endpoint to retrieve an access token for the AAD service principal associated with the Kubernetes namespace. We then use this token provider to create a new instance of CloudStorageAccount, passing in the name of the storage account we want to access.

Next, we create a new instance of CloudBlobClient using the CloudStorageAccount, and use it to retrieve the contents of a blob. Note that we don’t need to pass any secrets or access tokens to the CloudBlobClient. Instead, the AKS identity endpoint handles authentication on our behalf, making it much easier to manage access to Azure resources from within our Kubernetes cluster.

I hope this example helps you understand how to use AKS workload identity with the Azure SDK for .NET!

Conclusion

AKS workload identity is a powerful feature of AKS that enables you to use AAD to manage access to Azure resources from within your Kubernetes cluster. By using AKS workload identity, you can avoid storing secrets or access tokens within your pod configurations, making it easier to manage security and access control in your application.

In this blog post, we’ve explored how AKS workload identity works and how to use it in your application. We’ve also seen an example code snippet that demonstrates how to use AKS workload identity with the Azure SDK for Go. Hopefully, this has given you a better understanding of how AKS workload identity can be used to simplify access control in your Kubernetes applications.

References

Azure Kubernetes Service (AKS) – Managed Identity

March 11, 2023 Azure, Azure, Azure Kubernetes Service(AKS), Cloud Computing, Cloud Native, Cloud Strategy, Emerging Technologies, Intelligent Cloud, Kubernetes, Managed Services, Microsoft, PaaS, Platforms No comments

Azure Kubernetes Service (AKS) is a fully managed Kubernetes container orchestration service provided by Microsoft Azure. It allows users to quickly and easily deploy, manage, and scale containerized applications on Azure. AKS has been a popular choice among developers and DevOps teams for its ease of use and its ability to integrate with other Azure services.

In this blog post, we will explore a new feature that has recently been introduced in AKS – the AKS Managed Identity Preview.

AKS Managed Identity

AKS Managed Identity is a feature that allows AKS clusters to use Azure Managed Identity to authenticate to other Azure services. With this feature, AKS clusters can now use their own identities to access other Azure services, such as Azure Key Vault, Azure Container Registry, and Azure Storage.

Previously, AKS clusters had to use service principals to authenticate to other Azure services. This meant that users had to create a service principal and manually configure it to access Azure resources. This process was time-consuming and error-prone, especially when managing multiple AKS clusters and Azure services.

With AKS Managed Identity, users can now simplify the process of authenticating to Azure services by using the Managed Identity feature of Azure. Managed Identity is a feature that provides an identity for a service or application that is managed by Azure. It eliminates the need for users to manage credentials, such as passwords or keys, by automatically handling the identity and access management tasks.

How AKS Managed Identity works

AKS Managed Identity Preview by creating an Azure Managed Identity for the AKS cluster during the creation process. The Managed Identity is then granted access to the Azure resources that the cluster needs to access.

Once the Managed Identity is created, users can configure the AKS cluster to use it to authenticate to Azure services. This is done by creating a Kubernetes secret that contains the Azure credentials of the Managed Identity.

The AKS cluster can then use the Kubernetes secret to authenticate to Azure services, such as Azure Key Vault, Azure Container Registry, and Azure Storage.

Benefits of AKS Managed Identity

AKS Managed Identity provides several benefits for users, including:

  1. Simplified authentication: AKS clusters can now use their own identities to authenticate to Azure services, eliminating the need for users to create and manage service principals.
  2. Improved security: Managed identities are a more secure way of authenticating to Azure services, as they eliminate the need for users to store and manage secrets such as passwords or keys.
  3. Reduced management overhead: With AKS Managed Identity Preview, users no longer need to manually configure service principals to access Azure services. This reduces management overhead and ensures that AKS clusters are always using the correct credentials.
  4. Better integration with other Azure services: AKS Managed Identity Preview allows AKS clusters to integrate more seamlessly with other Azure services, such as Azure Key Vault, Azure Container Registry, and Azure Storage.

What are Managed Identities?

Managed identities are essentially a wrapper around service principals, and make their management simpler.
Managed identities use certificate-based authentication, and each managed identities credential has an expiration of 90 days and it’s rolled after 45 days.
AKS uses both system-assigned and user-assigned managed identity types, and these identities are immutable.

Conclusion

AKS Managed Identity is a feature that provides a simpler and more secure way of authenticating AKS clusters to Azure services. By using Managed Identity, users can eliminate the need for service principals and simplify the process of managing Azure resources. AKS Managed Identity Preview also provides improved security and better integration with other Azure services, making it a valuable addition to the AKS feature set.

References

Read Use a managed identity in Azure Kubernetes Service from Microsoft Learn for more details

Diving Deeper into Docker: Exploring Dockerfiles, Commands, and OCI Specifications

March 9, 2023 Azure, Azure DevOps, Containers, Development Process, DevOps, DevSecOps, Docker, Engineering Practices, Microsoft, Resources, SecOps, Software Engineering, Virtualization No comments

Docker is a popular platform for developing, packaging, and deploying applications. In the previous blog, we provided an introduction to Docker and containers, including their benefits and architecture. In this article, we’ll dive deeper into Docker, exploring Dockerfiles, Docker commands, and OCI specifications.

Dockerfiles

Dockerfiles are text files that contain instructions for building Docker images. Dockerfiles specify the base image for the image, the software to be installed, and the configuration of the image. Here’s an example Dockerfile:

#bas code# Use the official Node.js image as the base image
FROM node:12

# Set the working directory in the container
WORKDIR /app

# Copy the package.json and package-lock.json files to the container
COPY package*.json ./

# Install dependencies
RUN npm install

# Copy the application code to the container
COPY . .

# Set the command to run when the container starts
CMD ["npm", "start"]

This Dockerfile specifies that the base image for the container is Node.js version 12. It then sets the working directory in the container, copies the package.json and package-lock.json files to the container, installs the dependencies, copies the application code to the container, and sets the command to run when the container starts.

Docker Commands

Docker provides a rich set of commands for managing containers and images. Here are some common Docker commands:

  1. docker build: Builds a Docker image from a Dockerfile.
  2. docker run: Runs a Docker container from an image.
  3. docker ps: Lists the running Docker containers.
  4. docker stop: Stops a running Docker container.
  5. docker rm: Deletes a stopped Docker container.
  6. docker images: Lists the Docker images.
  7. docker rmi: Deletes a Docker image.

OCI Specifications

OCI (Open Container Initiative) is a set of open standards for container runtime and image format. Docker is compatible with OCI specifications, which means that Docker images can be run on any OCI-compliant runtime. OCI specifications define how containers are packaged, distributed, and executed.

The OCI runtime specification defines the standard interface between the container runtime and the host operating system. It specifies how the container is started, stopped, and managed.

The OCI image specification defines the standard format for container images. It specifies how the image is packaged and distributed, including the metadata and configuration files required to run the container.

Conclusion

Docker is a powerful platform for developing, packaging, and deploying applications. Dockerfiles provide a simple way to specify the configuration of a Docker image, while Docker commands make it easy to manage containers and images. The OCI specifications provide a set of open standards for container runtime and image format, enabling Docker images to be run on any OCI-compliant runtime. By using Docker and OCI specifications, developers can create portable and consistent environments for their applications.