Workload identity #2460
Workload identity #2460
Conversation
| @@ -144,7 +153,7 @@ class Ingress(schema.Base): | |||
|
|
|||
| class InputSchema(schema.Base): | |||
| domain: Optional[str] = None | |||
There was a problem hiding this comment.
revert changes to this file
|
Looks like it's failing due to playwright tests due to the UI changes, but I'd like to merge while we work on fixing playwright tests. |
|
Hi @Adam-D-Lewis, can you open an issue on docs to add a simple example on how to use this? I can add a PR later based on that. |
| @@ -144,7 +144,7 @@ resource "kubernetes_manifest" "forwardauth-middleware" { | |||
| apiVersion = "traefik.containo.us/v1alpha1" | |||
| kind = "Middleware" | |||
| metadata = { | |||
| name = "traefik-forward-auth" | |||
| name = var.forwardauth_middleware_name | |||
There was a problem hiding this comment.
If I got this correctly, you just created an output for the traefik-forward-auth and you are calling the components here onwards, right?
There was a problem hiding this comment.
We previously hard coded the forward auth middleware name. I added a variable for it (not strictly necessary for what I needed with mlflow plugin). I also created an output for whatever name is chosen. This was necessary for an mlflow plugin. I needed to put authentication in front of the mlflow pod so I re-use the existing forward auth service, middleware, and pod.
See https://github.com/Quansight/nebari-mlflow-plugin/blob/0eeb522380e635ac4c5ac6d3ba843427acc6923f/src/nebari_plugin_mlflow_aws/__init__.py#L207-L221
There was a problem hiding this comment.
cool! The reason I asked was because DaskGateway also uses it, so I just wanted to make sure that the service would still work
viniciusdc
added
provider: Azure
status: in review 👀
| output "cluster_oidc_issuer_url" { | ||
| description = "The OpenID Connect issuer URL that is associated with the AKS cluster" | ||
| value = azurerm_kubernetes_cluster.main.oidc_issuer_url | ||
| } |
There was a problem hiding this comment.
When oidc_issuer_enabled is False, does this output return null, or does terraform raises an error?
Hey Vini, check this out. I explained the process of using workload identity. nebari-dev/nebari-docs#461 |
Cool I believe I addressed all this in the other comments. Let me know if there's anything else. |
Reference Issues or PRs
Adds the ability to use workload identity on Azure similar to what we have with IRSA on the AWS provider. This allows us to tie a k8S service account to a Azure managed identity so we can get managed identity credentials into a pod simply by adding a label and service account to the pod and an annotation on the service account. I'm making mlflow Nebari plugin and I'm using it to give access to a blob storage bucket to mlflow.
Basically just adds a bit more possible customization to the AKS cluster, and this customization is disabled by default.
What does this implement/fix?
Put a
xin the boxes that applyTesting
Any other comments?