Azure AKS-让整个群集访问Azure键值库
我正在尝试找到一种将整个AKS群集提供给Azure密钥库的方法。我暂时通过遵循以下过程来实现此功能：
- 转到群集的VMS-＆gt;身份 - ＆gt;将系统分配给“ On”为“ on”
- 添加此托管身份作为键值策略。
但是，每当我停下来开始群集时，我都必须重新创建该托管身份并将其重新添加到密钥库中。我也尝试使用用户为VMS分配的身份，但这似乎不起作用。
出于其他原因，我也无法使用Azure POD Identities/CSI功能，因此我只是在寻找一种简单的方法来使我的群集永久访问密钥库。
提前致谢
I'm trying to find a way to give an entire AKS cluster to Azure Key vault. I have temporarily got this working by following the below process:
- Go to the VMSS of the cluster -> Identity -> Set System Assigned Status to 'On'
- Add this Managed identity as an access policy to Key Vault.
This works, however whenever I stop and start the cluster, I have to re-create this managed identity and re-add it to Key Vault. I have tried using the User Assigned Identities for the vmss as well but that does not seem to work.
I also cannot use the azure pod identities/CSI features for other reasons so I'm just looking for a simple way to give my cluster permanent access to key Vault.
Thanks in advance
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
停止和重新启动群集/节点POD将失去所有导致POD损失的资源 。因此，在您重新启动之前，VMS将没有POD。 和另一个IP地址创建新的POD。
如果您重新启动群集/节点，则将使用其他名称 .com/azure/aad-pod-distionity/essution/898“ rel =“ nofollow noreferrer”> github 讨论，我发现 麦克风（托管身份群集）删除了当没有配置POD使用该身份时，来自基础VMS的身份。因此，您必须重新创建VMS的托管身份。
您可以参考此 link 为了更好地了解如何从Azure Aks访问KeyVault。
Stopping and restarting cluster/nodes pod will lose all the resources that leads to loss of pods. So, there will be no pod under VMSS until you restart. In case you restart your cluster/node, the new pod will be created with different name and with another IP address.
From this github discussion, I found that MIC (Managed Identity Cluster) removes the identity from the underlying VMSS when no pods are configured to use that identity. So, you have to recreate the Managed Identity for VMSS.
You can refer this link for better understanding how to access keyvault from Azure AKS.