Azure / Azure/AKSFlexNode

v0.0.10: Not clear why az cli and RBAC assignment is needed when using managed identity mode

Open
#92 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
14
Forks
28
Avg merge
4d 13h
Merged PRs (30d)
12

Description

I'm using aks-flex-node in an Azure VM with MI enabled. Following the steps in the usage guide for service principal and also looking at the e2e test pipeline flow its not clear why:

- We need to install az cli in the VM when using MI and do an az login
- Need to perform an RBAC assignment (owner role per usage guide for service principal)
- uninstall.sh script removes az cli so if one had installed it for other reasons this ends up removing it.

When using MI based auth for kubelet expectation would be that only the role binding creation is required for the AAD enabled cluster.

So would be nice if an option to skip az cli install/login/rbac assignment is enabled for MI mode.

Contributor guide

No contributing guide indexed for this repository

Research direction

Read the usage guide and e2e test pipeline flow first, then inspect uninstall.sh to trace the Azure CLI, login, and RBAC steps used for managed identity mode. Done should clarify which steps are required for MI and provide the requested way to avoid unnecessary installation, login, or assignment while preserving the needed role binding.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
authentication, authorization, cli, cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.