Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added UI & BiCep update for issue 551. #681

Closed
wants to merge 1 commit into from
Closed

Added UI & BiCep update for issue 551. #681

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion bicep/main.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1166,6 +1166,15 @@ var systemPoolPresets = {
}
}

@description('Enables the use of a customer user-assigned managed identity for the control plane')
param useuserassignedidentityforkublet bool = false

@description('Enables the use of a customer user-assigned managed identity for the control plane')
param KubeletCustomUserIdentity string = ''

@description('Enables the use of a customer user-assigned managed identity for the control plane')
param KubeletCustomUserIdentityResourceGroup string = ''

var systemPoolBase = {
name: JustUseSystemPool ? nodePoolName : 'npsystem'
vmSize: agentVMSize
Expand Down Expand Up @@ -1336,6 +1345,11 @@ var aksProperties = union({
nodeResourceGroupProfile: {
restrictionLevel: restrictionLevelNodeResourceGroup
}
identityProfile: (useuserassignedidentityforkublet == 'no') ? null : {
kubeletidentity: {
resourceId : resourceId('${KubeletCustomUserIdentityResourceGroup}','Microsoft.ManagedIdentity/userAssignedIdentities', '${KubeletCustomUserIdentity}')
}
}
},
outboundTrafficType == 'managedNATGateway' ? managedNATGatewayProfile : {},
defenderForContainers && createLaw ? azureDefenderSecurityProfile : {},
Expand All @@ -1360,7 +1374,7 @@ resource aks 'Microsoft.ContainerService/managedClusters@2023-07-02-preview' = {
}
} : {
type: 'SystemAssigned'
}
}
sku: {
name: 'Base'
tier: akssku
Expand Down
34 changes: 33 additions & 1 deletion helper/src/components/addonsTab.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -534,7 +534,7 @@

<Stack.Item align="start">
<Label required={true}>
Workload Identity : Enable Azure Workload Identity on the AKS Cluster
Use a managed identity : Enable Azure Workload Identity on the AKS Cluster
(<a target="_new" href="https://learn.microsoft.com/en-us/azure/aks/workload-identity-deploy-cluster">*preview</a>)
(<a target="_new" href="https://github.com/Azure/azure-workload-identity">project</a>)
</Label>
Expand All @@ -544,6 +544,38 @@

<Separator className="notopmargin" />

<Stack.Item align="start">
<Label required={true}>
Kubelet identity: Allow the Kubelet on each node to run as a user-assigned managed identity.
(<a target="_new" href="https://learn.microsoft.com/en-us/azure/aks/use-managed-identity#bring-your-own-managed-identity">docs</a>)
</Label>
<MessageBar messageBarType={MessageBarType.info} styles={{ root: { marginBottom: '10px' } }}>
This option is only applicable providing a custom user managed account is also used for the control plane.
Without it, you will see an error similar to "Custom Kubelet Identity Only Supported On User Assigned MSI Cluster".
Select the "Security Principals --&gt; Cluster with additional security controls" option above and this will be enabled automatically.
</MessageBar>

<ChoiceGroup
styles={{ root: { marginLeft: '50px' } }}
selectedKey={addons.useuserassignedidentityforkubelet}

Check warning on line 560 in helper/src/components/addonsTab.js

View workflow job for this annotation

GitHub Actions / Spelling 

Unknown word (useuserassignedidentityforkubelet)
options={[
{ key: 'no', text: 'Do not use a custom user-assigned identity for the kubelet' },
{ key: 'yesExisting', text: 'Yes, use a pre-existing user-assigned identity for the kubelet.' }
]}
onChange={(ev, { key }) => updateFn("useuserassignedidentityforkubelet", key)}
/>

{addons.useuserassignedidentityforkubelet !== 'no' &&

Check warning on line 568 in helper/src/components/addonsTab.js

View workflow job for this annotation

GitHub Actions / Spelling 

Unknown word (useuserassignedidentityforkubelet)
<>
<TextField label="User Assigned Identity Name" styles={{ root: { marginBottom: '10px', marginLeft: '50px', width: '300px' } }} required placeholder="e.g. aksControl" onChange={(ev, v) => {updateFn("kubeletCustomUserIdentity", v)}} value={addons.kubeletCustomUserIdentity} />
<TextField label="Resource Group Name" styles={{ root: { marginBottom: '10px', marginLeft: '50px', width: '300px' } }} required placeholder="e.g. akaIdentities" onChange={(ev, v) => {updateFn("kubeletCustomUserIdentityResourceGroup", v)}} value={addons.kubeletCustomUserIdentityResourceGroup} />
</>
}

</Stack.Item>

<Separator className="notopmargin" />

<Stack.Item align="start">
<Label required={true}>
GitOps with Flux
Expand Down
1 change: 1 addition & 0 deletions helper/src/components/deployTab.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,7 @@ export default function DeployTab({ defaults, updateFn, tabValues, invalidArray,
...(cluster.enable_aad && { enable_aad: true, ...(cluster.enableAzureRBAC === false && cluster.aad_tenant_id && { aad_tenant_id: cluster.aad_tenant_id }) }),
...(cluster.enable_aad && cluster.AksDisableLocalAccounts !== defaults.cluster.AksDisableLocalAccounts && { AksDisableLocalAccounts: cluster.AksDisableLocalAccounts }),
...(cluster.enable_aad && cluster.enableAzureRBAC && { enableAzureRBAC: true, ...(deploy.clusterAdminRole && { adminPrincipalId: "$(az ad signed-in-user show --query id --out tsv)" }) }),
...(addons.useuserassignedidentityforkubelet !=="no") && {KubeletCustomUserIdentity : addons.kubeletCustomUserIdentity, KubeletCustomUserIdentityResourceGroup : addons.kubeletCustomUserIdentityResourceGroup },
...(addons.registry !== "none" && {
registries_sku: addons.registry,
...(deploy.acrPushRole && { acrPushRolePrincipalId: "$(az ad signed-in-user show --query id --out tsv)"}),
Expand Down
5 changes: 4 additions & 1 deletion helper/src/config.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,7 +115,10 @@
"automationAccountScheduledStartStop": "",
"automationTimeZone": "Etc/UTC",
"automationStartHour": 8,
"automationStopHour" : 19
"automationStopHour" : 19,
"useuserassignedidentityforkubelet" : "no",
"kubeletCustomUserIdentity" : "",
"kubeletCustomUserIdentityResourceGroup" : ""
},
"net": {
"vnetFirewallManagementSubnetAddressPrefix": "10.240.51.0/26",
Expand Down
Loading