v0.0.10: Not clear why az cli and RBAC assignment is needed when using managed identity mode
- Dominant language
- Go
- Stars
- 14
- Forks
- 28
- Avg merge
- 4d 13h
- Merged PRs (30d)
- 12
Description
I'm using aks-flex-node in an Azure VM with MI enabled. Following the steps in the usage guide for service principal and also looking at the e2e test pipeline flow its not clear why:
- We need to install az cli in the VM when using MI and do an az login
- Need to perform an RBAC assignment (owner role per usage guide for service principal)
- uninstall.sh script removes az cli so if one had installed it for other reasons this ends up removing it.
When using MI based auth for kubelet expectation would be that only the role binding creation is required for the AAD enabled cluster.
So would be nice if an option to skip az cli install/login/rbac assignment is enabled for MI mode.
Contributor guide
No contributing guide indexed for this repository
Research direction
Read the usage guide and e2e test pipeline flow first, then inspect uninstall.sh to trace the Azure CLI, login, and RBAC steps used for managed identity mode. Done should clarify which steps are required for MI and provide the requested way to avoid unnecessary installation, login, or assignment while preserving the needed role binding.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- authentication, authorization, cli, cloud
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100