kedacore/keda

Automatically inject the identityId while using azure-workload provider

Aperta

#5911 aperta il 26 giu 2024

 (9 commenti) (2 reazioni) (0 assegnatari)Go (1457 fork)auto 404
feature-requesthelp wantedstale-bot-ignore

Metriche repository

Star
 (10.372 stelle)
Metriche merge PR
 (Metriche PR in attesa)

Descrizione

Proposal

I am using the same setup as @chrismilson posted on https://github.com/kedacore/keda/issues/5451. However, I want to override the identityId (Azure UMI clientId) without hardcoding it.

I couldn't find a way to do something like

apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
  name: pipeline-trigger-auth-workload
spec:
  podIdentity:
    provider: azure-workload
    identityIdFrom:
      configMapKeyRef:
        key: clientId
        name: "auto-generated-cm-identity-settings"
# OR
    identityIdFromEnv: CONTAINER/AZURE_CLIENT_ID

Use-Case

I'm using TriggerAuthentication and azure-workload. However, currently I have to either manually/hardcode the identityId, share permissions with the main keda UMI or use a PAT.

I couldn't find a way to automatically inject the UMI's clientId. In my case, the UMI is generated automatically using the Azure Service Operator, so I don't know the clientId in advanced. I inject the clientId to the pod using an automatically generated configMap:

env:
- name: AZURE_CLIENT_ID
  valueFrom:
    configMapKeyRef:
      key: clientId
      name: "auto-generated-cm-identity-settings"

Is this a feature you are interested in implementing yourself?

No

Anything else?

Depending on how complex the implementation is, I might be able to do it myself. First, I'd like to hear your opinion regarding this issue and maybe you would have a better/already existing solution for me.

Thank you!

Guida contributor