Azure Kubernetes Service (AKS) – Managed Identity

Azure Kubernetes Service (AKS) is a fully managed Kubernetes container orchestration service provided by Microsoft Azure. It allows users to quickly and easily deploy, manage, and scale containerized applications on Azure. AKS has been a popular choice among developers and DevOps teams for its ease of use and its ability to integrate with other Azure services.

In this blog post, we will explore a new feature that has recently been introduced in AKS – the AKS Managed Identity Preview.

AKS Managed Identity

AKS Managed Identity is a feature that allows AKS clusters to use Azure Managed Identity to authenticate to other Azure services. With this feature, AKS clusters can now use their own identities to access other Azure services, such as Azure Key Vault, Azure Container Registry, and Azure Storage.

Previously, AKS clusters had to use service principals to authenticate to other Azure services. This meant that users had to create a service principal and manually configure it to access Azure resources. This process was time-consuming and error-prone, especially when managing multiple AKS clusters and Azure services.

With AKS Managed Identity, users can now simplify the process of authenticating to Azure services by using the Managed Identity feature of Azure. Managed Identity is a feature that provides an identity for a service or application that is managed by Azure. It eliminates the need for users to manage credentials, such as passwords or keys, by automatically handling the identity and access management tasks.

How AKS Managed Identity works

AKS Managed Identity Preview by creating an Azure Managed Identity for the AKS cluster during the creation process. The Managed Identity is then granted access to the Azure resources that the cluster needs to access.

Once the Managed Identity is created, users can configure the AKS cluster to use it to authenticate to Azure services. This is done by creating a Kubernetes secret that contains the Azure credentials of the Managed Identity.

The AKS cluster can then use the Kubernetes secret to authenticate to Azure services, such as Azure Key Vault, Azure Container Registry, and Azure Storage.

Benefits of AKS Managed Identity

AKS Managed Identity provides several benefits for users, including:

1. Simplified authentication: AKS clusters can now use their own identities to authenticate to Azure services, eliminating the need for users to create and manage service principals.
2. Improved security: Managed identities are a more secure way of authenticating to Azure services, as they eliminate the need for users to store and manage secrets such as passwords or keys.
3. Reduced management overhead: With AKS Managed Identity Preview, users no longer need to manually configure service principals to access Azure services. This reduces management overhead and ensures that AKS clusters are always using the correct credentials.
4. Better integration with other Azure services: AKS Managed Identity Preview allows AKS clusters to integrate more seamlessly with other Azure services, such as Azure Key Vault, Azure Container Registry, and Azure Storage.

What are Managed Identities?

Managed identities are essentially a wrapper around service principals, and make their management simpler.
Managed identities use certificate-based authentication, and each managed identities credential has an expiration of 90 days and it’s rolled after 45 days.
AKS uses both system-assigned and user-assigned managed identity types, and these identities are immutable.

Conclusion

AKS Managed Identity is a feature that provides a simpler and more secure way of authenticating AKS clusters to Azure services. By using Managed Identity, users can eliminate the need for service principals and simplify the process of managing Azure resources. AKS Managed Identity Preview also provides improved security and better integration with other Azure services, making it a valuable addition to the AKS feature set.

References

Read Use a managed identity in Azure Kubernetes Service from Microsoft Learn for more details