Terraform Azure AKS - how to set UAMI as kubelet_identity for AKS cluster

user_7500000 0
Viewed 1042

Looking at terraform documentation I have trouble determining how to assign UAMI as kubelet_identity for aks cluster.

The identity { ... } block which sets controlPlane UAMI as described here is not what I am looking for.

The question is - is there a terraform way I can assign additional UAMI apart from the one in identity {..} block and use it to access ACR?

I want to set a separate UAMI as a kubelet identity as described here

azure-rm terraform azure
2 Answers

is there a terraform way I can assign additional UAMI apart from the one in identity {..} block and use it to access ACR?

According to the details you provided, you can create an additional UAMI and associate it with the AKS cluster kubelet identity, then assign the role to the UAMI, example code here: resource "azurerm_kubernetes_cluster" "example" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1"

  default_node_pool {
    name       = "default"
    node_count = 1
    vm_size    = "Standard_D2_v2"
  }

  identity {
    type = "SystemAssigned"
  }

  kubelet_identity {
    client-id = azurerm_user_assigned_identity.kubelet.client_id
    object-id = azurerm_user_assigned_identity.kubelet.principal_id
    user_assigned_identity_id = azurerm_user_assigned_identity.kubelet.id
  }
  ...
}

resource "azurerm_role_assignment" "acr_for_kubelet" {
  principal_id         = azurerm_user_assigned_identity.kubelet.client_id
  scope                = azurerm_container_registry.container_registry.id
  role_definition_name = "AcrPull"
}

Update:

Actually, when you create the AKS and enable the system-assigned managed identity, then it will create the two user-assigned identities for the AKS cluster, one is to access other resources, and one is to manage the AKS cluster itself and this one is the kubelet identity.

It doesn't make sense to assign the kubelet identity permission to access the ACR. What you need to do is to assign the AKS identity permission to access the ACR. Or use the secret and service account inside the Kubernetes to access the ACR.

user_97739370

You need something like this,

resource "azurerm_kubernetes_cluster" "kube_cluster" {
  name                = local.cluster_name
  dns_prefix          = local.cluster_name
  location            = var.location
  resource_group_name = local.resource_group

  default_node_pool {
    name       = "default"
    node_count = 2
    vm_size    = "Standard_DS2_v2"
  }

  identity {
    type                      = "UserAssigned"
    user_assigned_identity_id = data.azurerm_user_assigned_identity.managed_identity.id
  }
}

resource "azurerm_role_assignment" "acr_role_assignment" {
  principal_id         = azurerm_kubernetes_cluster.kube_cluster.kubelet_identity[0].object_id
  scope                = data.azurerm_container_registry.container_registry.id
  role_definition_name = "AcrPull"
}

You can view the whole script here

user_17494030
Related