Automatically inject the identityId while using azure-workload provider
#5,911 opened on Jun 26, 2024
Repository metrics
- Stars
- (10,372 stars)
- PR merge metrics
- (PR metrics pending)
Description
Proposal
I am using the same setup as @chrismilson posted on https://github.com/kedacore/keda/issues/5451. However, I want to override the identityId (Azure UMI clientId) without hardcoding it.
I couldn't find a way to do something like
apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
name: pipeline-trigger-auth-workload
spec:
podIdentity:
provider: azure-workload
identityIdFrom:
configMapKeyRef:
key: clientId
name: "auto-generated-cm-identity-settings"
# OR
identityIdFromEnv: CONTAINER/AZURE_CLIENT_ID
Use-Case
I'm using TriggerAuthentication and azure-workload. However, currently I have to either manually/hardcode the identityId, share permissions with the main keda UMI or use a PAT.
I couldn't find a way to automatically inject the UMI's clientId. In my case, the UMI is generated automatically using the Azure Service Operator, so I don't know the clientId in advanced. I inject the clientId to the pod using an automatically generated configMap:
env:
- name: AZURE_CLIENT_ID
valueFrom:
configMapKeyRef:
key: clientId
name: "auto-generated-cm-identity-settings"
Is this a feature you are interested in implementing yourself?
No
Anything else?
Depending on how complex the implementation is, I might be able to do it myself. First, I'd like to hear your opinion regarding this issue and maybe you would have a better/already existing solution for me.
Thank you!