kedacore/keda

Automatically inject the identityId while using azure-workload provider

Open

#5,911 opened on Jun 26, 2024

 (8 comments) (2 reactions) (0 assignees)Go (1,457 forks)auto 404
feature-requesthelp wantedstale-bot-ignore

Repository metrics

Stars
 (10,372 stars)
PR merge metrics
 (PR metrics pending)

Description

Proposal

I am using the same setup as @chrismilson posted on https://github.com/kedacore/keda/issues/5451. However, I want to override the identityId (Azure UMI clientId) without hardcoding it.

I couldn't find a way to do something like

apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
  name: pipeline-trigger-auth-workload
spec:
  podIdentity:
    provider: azure-workload
    identityIdFrom:
      configMapKeyRef:
        key: clientId
        name: "auto-generated-cm-identity-settings"
# OR
    identityIdFromEnv: CONTAINER/AZURE_CLIENT_ID

Use-Case

I'm using TriggerAuthentication and azure-workload. However, currently I have to either manually/hardcode the identityId, share permissions with the main keda UMI or use a PAT.

I couldn't find a way to automatically inject the UMI's clientId. In my case, the UMI is generated automatically using the Azure Service Operator, so I don't know the clientId in advanced. I inject the clientId to the pod using an automatically generated configMap:

env:
- name: AZURE_CLIENT_ID
  valueFrom:
    configMapKeyRef:
      key: clientId
      name: "auto-generated-cm-identity-settings"

Is this a feature you are interested in implementing yourself?

No

Anything else?

Depending on how complex the implementation is, I might be able to do it myself. First, I'd like to hear your opinion regarding this issue and maybe you would have a better/already existing solution for me.

Thank you!

Contributor guide