Add Samples for Azure Key Vault Provider for Secrets Store CSI Driver - #8
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
Adds an end-to-end sample for mounting Azure Key Vault secrets into AKS pods using the Azure Key Vault provider for Secrets Store CSI Driver, covering both Workload Identity and the AKS add-on managed identity mode. It also wires the AKS add-on into the existing cluster provisioning scripts and adjusts one existing sample script’s Azure CLI usage.
Changes:
- Add new
samples/key-vault-csi-driversample with scripts for both Workload Identity and user-assigned managed identity access modes. - Update AKS provisioning scripts to enable the
azure-keyvault-secrets-provideradd-on (and add Key Vault creation in those scripts). - Update PostgreSQL flexible-server sample to use different Azure CLI flags for firewall rule + DB operations.
Reviewed changes
Copilot reviewed 20 out of 20 changed files in this pull request and generated 18 comments.
Show a summary per file
| File | Description |
|---|---|
| scripts/01-user-assigned-managed-identity.sh | Enables the Key Vault CSI add-on and adds Key Vault creation; currently missing role assignment for the add-on identity. |
| scripts/01-system-assigned-managed-identity.sh | Enables the Key Vault CSI add-on, creates a Key Vault, and assigns a Key Vault role to the add-on identity. |
| samples/web-app-postgresql-flexible-server/scripts/01-deploy-resources.sh | Updates Azure CLI flags for firewall rule and DB creation (flag changes appear incorrect vs other repo samples). |
| samples/key-vault-csi-driver/README.md | Documents the new sample and the two identity access modes. |
| samples/key-vault-csi-driver/00-variables.sh | Adds shared variables for the new Key Vault CSI driver samples. |
| samples/key-vault-csi-driver/workload-identity/00-variables.sh | Adds workload-identity sample variables (namespace, SA, SPC, pod). |
| samples/key-vault-csi-driver/workload-identity/01-enable-addon.sh | Enables the AKS azure-keyvault-secrets-provider add-on for the workload-identity path. |
| samples/key-vault-csi-driver/workload-identity/02-create-key-vault-and-secrets.sh | Creates a Key Vault and test secrets for the workload-identity path. |
| samples/key-vault-csi-driver/workload-identity/03-create-managed-identity.sh | Creates a user-assigned MI + federated credential for Workload Identity and assigns Key Vault access. |
| samples/key-vault-csi-driver/workload-identity/04-create-secret-provider-class.sh | Creates a SecretProviderClass using Workload Identity parameters. |
| samples/key-vault-csi-driver/workload-identity/05-create-demo-pod.sh | Deploys a demo pod labeled for workload identity and mounting secrets via CSI. |
| samples/key-vault-csi-driver/workload-identity/06-list-secrets.sh | Reads mounted secret files from /mnt/secrets in the demo pod. |
| samples/key-vault-csi-driver/user-assigned-managed-identity/00-variables.sh | Adds user-assigned MI mode sample variables (namespace, SPC, pod). |
| samples/key-vault-csi-driver/user-assigned-managed-identity/01-enable-addon.sh | Enables the AKS azure-keyvault-secrets-provider add-on for the add-on identity path. |
| samples/key-vault-csi-driver/user-assigned-managed-identity/02-create-key-vault-and-secrets.sh | Creates a Key Vault and test secrets for the add-on identity path. |
| samples/key-vault-csi-driver/user-assigned-managed-identity/03-create-role-assignment.sh | Grants the add-on managed identity access to the Key Vault. |
| samples/key-vault-csi-driver/user-assigned-managed-identity/04-create-secret-provider-class.sh | Creates a SecretProviderClass configured for VM managed identity mode. |
| samples/key-vault-csi-driver/user-assigned-managed-identity/05-create-demo-pod.sh | Deploys a demo pod that mounts secrets via CSI using the add-on identity. |
| samples/key-vault-csi-driver/user-assigned-managed-identity/06-list-secrets.sh | Reads mounted secret files from /mnt/secrets in the demo pod. |
| README.md | Adds the new Key Vault CSI driver sample to the repository’s sample list. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
93
to
97
| az postgres flexible-server firewall-rule create \ | ||
| --resource-group "$RESOURCE_GROUP_NAME" \ | ||
| --name "$PG_SERVER_NAME" \ | ||
| --rule-name "$FIREWALL_RULE_NAME" \ | ||
| --server-name "$PG_SERVER_NAME" \ | ||
| --name "$FIREWALL_RULE_NAME" \ | ||
| --start-ip-address 0.0.0.0 \ |
Comment on lines
103
to
107
| az postgres flexible-server db show \ | ||
| --database-name "$PG_DATABASE_NAME" \ | ||
| --name "$PG_DATABASE_NAME" \ | ||
| --server-name "$PG_SERVER_NAME" \ | ||
| --resource-group "$RESOURCE_GROUP_NAME" \ | ||
| --only-show-errors &>/dev/null |
Comment on lines
111
to
115
| az postgres flexible-server db create \ | ||
| --database-name "$PG_DATABASE_NAME" \ | ||
| --name "$PG_DATABASE_NAME" \ | ||
| --server-name "$PG_SERVER_NAME" \ | ||
| --resource-group "$RESOURCE_GROUP_NAME" \ | ||
| --charset UTF8 \ |
| @@ -0,0 +1,227 @@ | |||
| #/bin/bash | |||
| @@ -0,0 +1,50 @@ | |||
| #/bin/bash | |||
Comment on lines
+101
to
+103
| # Assign the Key Vault Administrator role to the managed identity on the node resource group | ||
| ROLE="Key Vault Administrator" | ||
| PRINCIPAL_ID="$PRINCIPAL_ID" |
Comment on lines
+204
to
+207
| # Show OIDC Issuer URL | ||
| if [[ -n $AKS_OIDC_ISSUER_URL ]]; then | ||
| echo "The OIDC Issuer URL of the [$AKS_NAME] cluster is [$AKS_OIDC_ISSUER_URL]" | ||
| fi |
Comment on lines
+21
to
+22
| echo "Retrieving [$FILE] secret from [$KEY_VAULT_NAME] key vault..." | ||
| kubectl exec $POD --stdin --tty -n $NAMESPACE -- cat /mnt/secrets/$FILE;echo;sleep 1 |
Comment on lines
+21
to
+22
| echo "Retrieving [$FILE] secret from [$KEY_VAULT_NAME] key vault..." | ||
| kubectl exec $POD --stdin --tty -n $NAMESPACE -- cat /mnt/secrets/$FILE;echo;sleep 1 |
| --windows-admin-password $windows_admin_password \ | ||
| --node-vm-size $node_size \ | ||
| --enable-addons monitoring \ | ||
| --enable-addons monitoring,azure-keyvault-secrets-provider \ |
SMF-695 Add Samples for Azure Key Vault Provider for Secrets Store CSI Driver
AKS workloads mount Azure Key Vault secrets into pods with the upstream |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
AKS workloads mount Azure Key Vault secrets into pods with the upstream
secrets-store-csi-driverplussecrets-store-csi-driver-provider-azure, enabled by theazureKeyvaultSecretsProvideraddon (az aks ... --enable-addons azure-keyvault-secrets-provider). The Azure emulator stored theaddonProfilesblock but did nothing with it: enabling the addon had no effect, no addon identity was created, no driver was installed, and aSecretProviderClassmount never returned a value. This PR adds two samples for this AKS feature. For more information, seesamples/key-vault-csi-driver/README.mdFixes SMF-695
Changes
This pull request changes the following files:
-
scripts/01-system-assigned-managed-identity.sh: adds support Azure Key Vault Provider for Secrets Store CSI Driver.-
scripts/01-user-assigned-managed-identity.sh: adds support Azure Key Vault Provider for Secrets Store CSI Driver.samples/key-vault-csi-driver/: contains two samples to test Azure Key Vault Provider for Secrets Store CSI Driver on a real AKS cluster Azure as well on an emulated AKS cluster.