Add support for AKS workload identity #42
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
arashnd
force-pushed
the
support-aks-workload-identity
branch
from
7d4c9d6 to
9db665e
Compare
arashnd
force-pushed
the
support-aks-workload-identity
branch
from
2a8bbbc to
11753c5
Compare
arashnd
force-pushed
the
support-aks-workload-identity
branch
from
ce52722 to
cec0127
Compare
Member
|
Hi! 👋 I answered you on the CGRP slack, but slack is struggling today so I am writing here too just in case. |
Contributor
Author
|
Thanks a lot, highly appreciate it 🙏 |
This commit adds full support for testing Azure Blob storage with managed identities on AKS. The implementation follows the same patterns as the existing VM and App Service test environments. Key changes: Infrastructure (Terraform): - Add AKS cluster with OIDC issuer and workload identity enabled - Configure both node identity (kubelet) and workload identity (federated credentials) - Deploy SSH-enabled pod using linuxserver/openssh-server - Expose SSH service via LoadBalancer for VPN tunneling - Add variables: create_aks, aks_node_count, aks_ssh_username - Add outputs: aks_cluster_name, aks_ssh_ip, aks_ssh_username, aks_ssh_password Testing Infrastructure: - Add AksVpn class to establish VPN connection via kubectl port-forward - Add bin/proxy-aks script for manual testing - Add test_aks Rake task following existing patterns - Add aks_test job to GitHub Actions workflow - Extract MSI credentials from pod for testing both identity types Development Environment: - Add kubectl to devenv.nix packages - Update README with comprehensive AKS testing documentation - Document both node identity and workload identity support The setup supports on-demand infrastructure creation and automatic teardown via the existing GitHub Actions workflow, minimizing costs.
Updates the AKS test setup to use SSH key authentication instead of password authentication, making it consistent with the VM test setup. Changes: - Remove random_password resource for AKS - Update container env to use PUBLIC_KEY instead of USER_PASSWORD - Remove PASSWORD_ACCESS env var (defaults to key-based auth) - Remove aks_ssh_password output from Terraform - Update bin/proxy-aks to use SSH keys with sshuttle - Update AksVpn Ruby class to use publickey auth_method - Add SSH key setup step to aks_test GitHub Actions job - Remove sshpass dependency from devenv.nix and workflow This brings AKS authentication in line with the existing VM pattern.
…-environment-011CV2i8qn3iyGrD2TdiU7Cs
Member
|
I added support running the tests on AKS with workload identity. They pass: https://github.com/testdouble/azure-blob/actions/runs/19283901033 I'll try to review the rest this week. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
@JoeDupuis thanks again for great work!
This PR is attempts to add support for AKS/k8s workload/pod identity,
I can write some tests but not sure where to start / what kind of test coverage is required.