Available from 1.6.0 release
NOTE: The AKS pod-managed identities add-on installs AAD Pod Identity in Managed mode.
Starting from 1.6.0 release, 2 modes of operation are supported for pod-identity
This is the default mode in which pod-identity will be deployed. In this mode, there are 2 components, MIC (Managed Identity Controller) and NMI (Node Managed Identity). MIC handles the identity assignment/removal from the underlying vm/vmss when new pods using the identity are created/deleted.
In this mode, there is only the NMI component deployed in the cluster. The identity assignment needs to be manually performed.
aad-pod-identity components to an RBAC-enabled cluster in managed mode:
kubectl apply -f https://raw.githubusercontent.com/Azure/aad-pod-identity/master/deploy/infra/managed-mode-deployment.yaml
NOTE Managed mode is only supported in namespaced mode. This ensures pods in namespace are only matched with
AzureIdentityBinding in the same namespace.
AAD Pod Identity allows users to customize their installation via Helm.
helm repo add aad-pod-identity https://raw.githubusercontent.com/Azure/aad-pod-identity/master/charts
helm install aad-pod-identity aad-pod-identity/aad-pod-identity --set operationMode=managed
For a list of customizable values that can be injected when invoking
helm install, please see the Helm chart configurations.
To assign the identity to the VM, run the following command -
az vm identity assign -g <VM resource group name> -n <VM name> --identities <resource ID of managed identity>
To assign the identity to VMSS, run the following command -
az vmss identity assign -g <VM resource group name> -n <VMSS name> --identities <resource ID of managed identity>
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.