hashicorp / hashicorp/consul

Allow specifying user-assigned identity id when using Azure auto-join and MSI

Open
#9,754 1 comment 0 reactions 0 assignees View on GitHub
theme/consul-nomad type/enhancement
Dominant language
Go
Stars
30.1k
Forks
4.6k
Avg merge
2d 6h
Merged PRs (30d)
43

Description

#### Feature Description

When using managed identities with Azure cloud auto-join, the auto-join will not work if multiple user-assigned identities exist on the machine. Per [Microsoft documentation](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/known-issues#what-identity-will-imds-default-to-if-dont-specify-the-identity-in-the-request):
_If system assigned managed identity is not enabled, and multiple user assigned managed identities exist, then specifying a managed identity in the request is required._
In this instance, consul is unable to obtain an authorization token because the identity id cannot be specified and a default no longer exists.

#### Use Case(s)

We were intending to leverage consul on our nomad cluster, as well as on legacy systems. As such, we created two managed identities - one for a consul client and one for nomad clients that needed additional access for Azure CSI plugins. On our nomad clients we added both of these identities to new machines, causing a failure to join the existing consul cluster.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.