Azure / Azure/AKS

[Feature] User Assigned Managed Identitiy with Application Gateway for Containers Addon

Open
#5,626 1 comment 0 reactions 2 assignees Claimed by @therealmitchconnors View on GitHub
app-gateway-for-containers feature-request
Dominant language
TypeScript
Stars
2.1k
Forks
395
Avg merge
2d 22h
Merged PRs (30d)
13

Description

**Is your feature request related to a problem? Please describe.**

I would like to create my own application gateway for containers using IaC and use the AKS Managed Addon "application-load-balancer" for deploying the Helm Chart.
At the moment this addon also creates a identity which shouldn't be modified.

Optional: Set the appropriate GitHub label(s) to indicate the AKS feature or area your feature request relates to.
**I cannot do that**
Image

**Describe the solution you'd like**

I would like to use my own user assigned managed identity, because my application gateway for containers and my vnet are both in different resource groups than the aks infrastructure resource group.

**Describe alternatives you've considered**

Creating the role assignments to the identity created by the addon myself.

```hcl
data "azurerm_user_assigned_identity" "alb_addon" {
name = "applicationloadbalancer-${local.cluster_name}"
resource_group_name = local.cluster_infrastructure_resource_group_name
}

resource "azurerm_role_assignment" "alb_addon_network_contributor" {
principal_id = data.azurerm_user_assigned_identity.alb_addon.principal_id
role_definition_name = "Network Contributor"
scope = var.cluster_config.network.vnet_resource_id
}

resource "azurerm_role_assignment" "alb_addon_appgw_configuration_manager" {
principal_id = data.azurerm_user_assigned_identity.alb_addon.principal_id
role_definition_name = "AppGw for Containers Configuration Manager"
scope = module.gateway.resource_id
}
```

I would not like to do this because:

A: "It is unsupported to modify the identity or namespace when provisioning integration with the add-on. If you wish to customize your deployment, consider [deployment with helm](https://learn.microsoft.com/en-us/azure/application-gateway/for-containers/quickstart-deploy-application-gateway-for-containers-alb-controller-helm)."

B: The node infrastructure resource group shouldn't be configured.

**Additional context**

https://learn.microsoft.com/en-us/azure/application-gateway/for-containers/quickstart-deploy-application-gateway-for-containers-alb-controller-addon?tabs=azure-cli%2Cazure-cli2#managed-identity

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.