github.com/Azure/aad-pod-identity@v1.8.17/website/content/en/docs/Demo/tutorial.md (about) 1 --- 2 title: "AAD Pod Identity Tutorial" 3 linkTitle: "AAD Pod Identity Tutorial" 4 weight: 2 5 description: > 6 A step by step tutorial for deploying AAD Pod Identity 7 --- 8 9 This tutorial is based on [this repository](https://github.com/xtellurian/aad-pods). 10 11 ## Prerequisites 12 13 - [Azure Account](https://azure.microsoft.com/en-us/free/) 14 15 In this tutorial we are going to be using the Azure CLI, bash scripts, and kubectl. There are three sections, and each section contains several scripts to run. You'll find all the scripts in the `tutorial` directory. 16 17 To begin, clone this repository 18 19 ```sh 20 git clone https://github.com/Azure/aad-pod-identity 21 cd aad-pod-identity/tutorial 22 ``` 23 24 ### Using Azure CLI, kubectl and bash 25 26 The following steps require the [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli?view=azure-cli-latest), make sure to download and [login](https://docs.microsoft.com/en-us/cli/azure/authenticate-azure-cli?view=azure-cli-latest) before starting. 27 28 If you're on Windows, you should use [Windows Subsystem for Linux](https://docs.microsoft.com/en-us/windows/wsl/install-win10) or another Bash terminal. 29 30 You can install kubectl via the Azure CLI, or by [another method](https://kubernetes.io/docs/tasks/tools/install-kubectl/) 31 32 `az aks install-cli` 33 34 ## 1. Create a Kubernetes Cluster on Azure (AKS) 35 36 ### 1.1. Register the required resource types 37 38 `./1-init-aks/1-azure-provider-registration.sh` 39 40 AKS requires the following resources: Microsoft.Network, Microsoft.Storage, Microsoft.Compute, Microsoft.ContainerService. Register them on your subscription with the above script. 41 42 43 ### 1.2. Create a Resource Group 44 45 Set an environment variable in your shell, for the name of your resource group. 46 47 `export RG="k8s-test"` 48 49 This resource group is for your AKS cluster. Create it with this command. 50 51 `./1-init-aks/2-create-rg.sh` 52 53 ### 1.3. Create Azure Kubernetes Service 54 55 This will create an AKS instance in the resource group created above. It may take a couple of minutes to complete. Set the name of the this command in the shell. 56 57 ```sh 58 K8S_NAME="Cluster-Name" 59 ./1-init-aks/3-create-aks.sh 60 ``` 61 62 63 ### 1.4. Configure the kubernetes CLI - `kubectl` 64 65 With `kubectl` installed, run the following script 66 67 `./1-init-aks/4-configure-cli.sh` 68 69 Now the `kubectl` command should control your AKS cluster. Try it out, it should look similar to below: 70 71 ```sh 72 $ kubectl get nodes 73 NAME STATUS ROLES AGE VERSION 74 aks-nodepool1-15831963-0 Ready agent 01h v1.9.6 75 ``` 76 77 ## 2. Configure AKS with required infrastructure on the cluster 78 79 Pod Identity requires two components: 80 81 1. Managed Identity Controller (MIC). A pod that binds Azure Ids to other pods - creates azureAssignedIdentity CRD. 82 2. Node Managed Identity (NMI). Identifies the pod based on the remote address of the incoming request, and then queries the k8s (through MIC) for a matching Azure Id. It then make a adal request to get the token for the client id and returns as a response to the request. Implemented as a [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/). 83 84 Deploy the infrastructure with the following command to deploy MIC, NMI, and MIC CRDs. 85 86 `./2-config-aks/2-deploy-infra.sh` 87 88 NOTE: If you have RBAC enabled, use the following deployment instead: 89 90 ``` 91 kubectl create -f ../../deploy/infra/deployment-rbac.yaml 92 ``` 93 94 ## 3. Deploy the demo 95 96 The demo is basic, but does prove the concept. 97 98 ### 3.1. Create an Azure Id 99 100 We will be assigning the demo pod an [Azure Managed Service Identity](https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/overview). The Azure Id will need to be in the same Resource Group *as was created automatically by the provisioning of the AKS cluster* [see this issue for more information](https://github.com/Azure/aad-pod-identity/issues/38). 101 102 You might find the Resource Group name with 103 104 `az group list | grep $RG` 105 106 Then set the environment variable 107 108 `export MC_RG="resource-group-name"` 109 110 Run the following to create an azure id 111 112 `./3-deploy-demo/1-create-azure-id.sh` 113 114 ### 3.2. Deploy demo 115 116 The `/deploy/demo/deployment.yaml` describes the pod that will be deployed. 117 118 It automatically adds the following values from your environment: 119 120 - subscriptionid: Id of your Azure Subscription 121 - clientid: From the Azure Id you created in the step above 122 - resourcegroup: From the Azure Id you created above 123 124 Run the following to deploy the demo 125 126 `./3-deploy-demo/2-deploy-demo.sh` 127 128 ### 3.3. Deploy Azure Id to Kubernetes 129 130 We need to tell the cluster about the Id we created, so it can bind it to the pod (the next step). To do that, we will deploy the spec found in `/deploy/demo/aadpodidentity.yaml`. 131 132 Run the following to deploy the Azure ID to Kubernetes: 133 134 `./3-deploy-demo/3-deploy-id-to-k8s.sh` 135 136 ### 3.4. Bind the Id to our demo pod 137 138 Last thing we need to do is bind the Id we created in step 1, and deployed in step 3, to the pod we deployed in step 2. 139 140 Deploy the binding with the following 141 142 `./3-deploy-demo/4-deploy-id-binding.sh` 143 144 ## Did it work? 145 146 You'll need to check the logs of each pod to know if everything worked. 147 148 First, get the pod names with the following command: 149 150 ```sh 151 $ kubectl get pods 152 NAME READY STATUS RESTARTS AGE 153 demo-757967c54-64pzr 1/1 Running 0 1h # the demo pod 154 mic-64ddcf5f65-h4hft 1/1 Running 0 19h # the MIC pod 155 nmi-b9xbg 1/1 Running 0 1h # the NMI pod 156 ``` 157 158 ### Check the Managed Identity Controller pod 159 160 Check the logs of the MIC controller and see the binding successfully applied on the node. 161 162 ```sh 163 $ kubectl logs mic-64ddcf5f65-h4hft 164 .... 165 I0606 23:19:45.867711 1 crd.go:123] Got id podid to assign 166 I0606 23:19:45.867829 1 crd.go:142] Creating assigned Id: demo-5788d95785-ghzwv-default-podid 167 I0606 23:19:45.874002 1 cloudprovider.go:170] Find aks-nodepool1-15831963-0 in resource group: MC_k8s-test_clusterFrank_eastus 168 I0606 23:20:11.051552 1 cloudprovider.go:162] Underlying cloud provider operation took 25.04421296s 169 I0606 23:20:11.051846 1 mic.go:259] Sync took: 25.220821436s 170 I0606 23:20:11.052905 1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"default", Name:"myIdBinding", UID:"19a07e0e-69e0-11e8-9e9f-4addade2df92", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"89529", FieldPath:""}): type: 'Normal' reason: 'binding applied' Binding myIdBinding applied on node aks-nodepool1-15831963-0 for pod demo-5788d95785-ghzwv-default-podid 171 ``` 172 173 ### Check the Node Managed Identity pod 174 175 Check the logs of the NMI pod to see only info level logging and 200 responses. If you see 403 or 404 responses, then something is wrong. 176 177 ```sh 178 $ kubectl logs nmi-b9xbg 179 ... 180 time="2018-06-07T01:30:04Z" level=info msg="Status (200) took 55422159 ns" req.method=GET req.path=/metadata/identity/oauth2/token req.remote=10.244.0.25 181 time="2018-06-07T01:30:04Z" level=info msg="matched identityType:0 clientid:a40e83f9-6198-4633-afae-d860eb5b7f7c resource:https://management.azure.com/" req.method=GET req.path=/metadata/identity/oauth2/token req.remote=10.244.0.25 182 ``` 183 184 ### Check the demo pod 185 186 The demo pod should be reporting on the virtual machines in the resource group. If you see intermittant 403 responses, that is OK. 187 188 ```sh 189 $ kubectl logs demo-757967c54-64pzr 190 ... 191 time="2018-06-07T01:32:30Z" level=error msg="failed list all vm compute.VirtualMachinesClient#List: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code=\"AuthorizationFailed\" Message=\"The client '48affddb-9972-4b7e-a82b-c5d32d2a3dd5' with object id '48affddb-9972-4b7e-a82b-c5d32d2a3dd5' does not have authorization to perform action 'Microsoft.Compute/virtualMachines/read' over scope '/subscriptions/c5760548-23c2-4223-b41e-5d68a8320a0c/resourceGroups/MC_k8s-test_clusterFrank_eastus/providers/Microsoft.Compute'.\"" podip=10.244.0.25 podname=demo-757967c54-64pzr podnamespace=demo-757967c54-64pzr 192 time="2018-06-07T01:32:30Z" level=info msg="successfully acquired a token using the MSI, msiEndpoint(http://169.254.169.254/metadata/identity/oauth2/token)" podip=10.244.0.25 podname=demo-757967c54-64pzr podnamespace=demo-757967c54-64pzr 193 time="2018-06-07T01:32:30Z" level=info msg="successfully acquired a token, userAssignedID MSI, msiEndpoint(http://169.254.169.254/metadata/identity/oauth2/token) clientID(a40e83f9-6198-4633-afae-d860eb5b7f7c)" podip=10.244.0.25 podname=demo-757967c54-64pzr podnamespace=demo-757967c54-64pzr 194 time="2018-06-07T01:32:30Z" level=info msg="successfully made GET on instance metadata, {\"compute\":{\"location\":\"eastus\",\"name\":\"aks-nodepool1-15831963-0\",\"offer\":\"UbuntuServer\",\"osType\":\"Linux\",\"placementGroupId\":\"\",\"platformFaultDomain\":\"0\",\"platformUpdateDomain\":\"0\",\"publisher\":\"Canonical\",\"resourceGroupName\":\"MC_k8s-test_clusterFrank_eastus\",\"sku\":\"16.04-LTS\",\"subscriptionId\":\"c5760548-23c2-4223-b41e-5d68a8320a0c\",\"tags\":\"acsengineVersion:v0.17.0-aks;creationSource:aks-aks-nodepool1-15831963-0;orchestrator:Kubernetes:1.9.6;poolName:nodepool1;resourceNameSuffix:15831963\",\"version\":\"16.04.201805090\",\"vmId\":\"3fea4c7e-4aaf-400f-a588-2a851f6fd0cf\",\"vmSize\":\"Standard_DS1_v2\"},\"network\":{\"interface\":[{\"ipv4\":{\"ipAddress\":[{\"privateIpAddress\":\"10.240.0.4\",\"publicIpAddress\":\"\"}],\"subnet\":[{\"address\":\"10.240.0.0\",\"prefix\":\"16\"}]},\"ipv6\":{\"ipAddress\":[]},\"macAddress\":\"000D3A13DEE3\"}]}}" podip=10.244.0.25 podname=demo-757967c54-64pzr podnamespace=demo-757967c54-64pzr 195 ``` 196 197 ### Check the descriptions 198 199 `kubectl describe azureidentity` 200 201 `kubectl describe azureidentitybinding` 202 203 ### AAD Pod Identity In Action 204 205 [](https://www.youtube.com/watch?v=BXhIMJYDO4w)