Available from 1.6.0 release
AAD Pod Identity supports 2 modes of operation:
If you already have AAD Pod Identity setup with Standard mode and would like to migrate to Managed mode:
NOTE: AAD Pod Identity in Managed Mode only works in namespaced mode. This means the
AzureIdentityBindingneeds to be in the same namespace as the application pod referencing it. This it to ensure RBAC best practices. If you’re running in non-namespace mode, move the
AzureIdentityBindingto the correct namespaces before proceeding with the steps.
Assign the pod identities to the VM/VMSS:
To assign the identity to the VM, run the following command:
az vm identity assign -g <VM resource group name> -n <VM name> --identities <resource ID of managed identity>
To assign the identity to VMSS, run the following command:
az vmss identity assign -g <VM resource group name> -n <VMSS name> --identities <resource ID of managed identity>
Delete the MIC deployment and NMI daemonset
kubectl delete deploy <mic deployment name> -n <namespace> kubectl delete daemonset <nmi daemonset name> -n <namespace>
Delete the MIC service accounts and cluster-role
kubectl delete sa aad-pod-id-mic-service-account -n <namespace> kubectl delete clusterrole aad-pod-id-mic-role kubectl delete clusterrolebinding aad-pod-id-mic-binding
Delete AzureAssignedIdentity custom resource definition
AzureAssignedIdentity is created and managed by MIC in standard mode. This is not required for managed mode.
Refer to this doc on how to delete the
Install AAD Pod Identity in managed mode
Refer to this doc on how install AAD Pod Identity in managed mode.
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.