Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] EnvInjector pod does not support azure workload identity #623

Open
waterfoul opened this issue Oct 16, 2023 · 2 comments
Open

[BUG] EnvInjector pod does not support azure workload identity #623

waterfoul opened this issue Oct 16, 2023 · 2 comments
Labels
bug Something isn't working

Comments

@waterfoul
Copy link

Note: Make sure to check out known issues (https://akv2k8s.io/troubleshooting/known-issues/) before submitting

Components and versions
Select which component(s) the bug relates to with [X].

[ ] Controller, version: 1.5.0 (docker image tag)
[X] Env-Injector (webhook), version: 1.5.0 (docker image tag)
[ ] Other

Describe the bug
When the env injector (not the webhook) starts without the auth service it only supports VM identities and won't use azure workload identity. The issue arises on https://github.com/SparebankenVest/azure-key-vault-to-kubernetes/blob/master/cmd/azure-keyvault-env/authentication.go#L91 where it calls NewFromEnvironment without any way of using NewFromAzidentity

To Reproduce
Steps to reproduce the behavior:

  1. Disable the auth service
  2. Setup a pod with AZ Workload Identity
  3. Start the pod
    Observe: The pod fails to find the identity

Expected behavior
The pod starts

Logs
If applicable, add logs to help explain your problem.

"failed to read secret from azure key vault" err="adal: Refresh request failed. Status Code = '400'. Response body: {\"error\":\"invalid_request\",\"error_description\":\"Identity not found\"} Endpoint http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&client_id=bb2edad4-2d5f-4e8a-a11f-b69d277ff284&resource=https%3A%2F%2Fvault.azure.net" 

Additional context
This does work with the auth service enabled and AUTH_TYPE "environment-azidentity". I propose the env injecotr pod gets it's own auth type env var (ENV_INJECTOR_AUTH_TYPE) with accepts "environment-azidentity" or "environment" (default)

@waterfoul waterfoul added the bug Something isn't working label Oct 16, 2023
@pzaj2
Copy link

pzaj2 commented Dec 8, 2023

@waterfoul Having the same scenario, did you manage to get it working in the end?

@phuc-nguyen2-ts
Copy link

Having the same issue with the error log exactly the same as you, would you be able to find a solution?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

3 participants