AKS pod in CrashLoop error due to managed identity integration

Chetan Prakash Saraswat 26

We have an AKS cluster on which one of our Deployments which now uses DefaultAzureCredential class to fetch connection strings stored in Azure Key Vault. We have provide the "System Assigned Managed Identity" contributor access to Key Vault to read the secrets. However the deployment keeps on getting error with "CrashLoopBackoff" error. We think its probably due to some configuration which we are missing for the AKS identity to use the key vault. Live Logs on pod do not show any specific error as to why its happening, as it primarily lists out the below code . Is CSI enabled secret provider the only way to do this. Can we not use our code to fetch key vault secrets using below method??

builder.Configuration.AddAzureKeyVault(new Uri(builder.Configuration["KeyVault:Uri"]), new DefaultAzureCredential());

1 answer

Deepanshukatara-6769 10,215 Reputation points

2024-11-07T10:23:25.55+00:00
Hello Chetan , Welcome to MS Q&A

Yes, you can use your code to fetch secrets from Azure Key Vault in AKS using the Azure SDK. Here is an example of how you can do this in a .NET application:

Install the necessary NuGet packages:

Configure your application to use Azure Key Vault:

Set up your environment:

Deploy your application to AKS:

This approach allows your application to directly fetch secrets from Azure Key Vault using the Azure SDK, without relying on the CSI-enabled Secrets Store provider

Reference:

https://video2.skills-academy.com/en-us/azure/key-vault/secrets/quick-create-net?tabs=azure-cli

Please let us know if any further questions

Kindly accept if it helps

Thanks
Deepanshu
Please sign in to rate this answer.
Chetan Prakash Saraswat 26 Reputation points

2024-11-07T10:31:28.8066667+00:00

We are already using the DefaultAzure Credential class which when run locally via Visual Studio picks VS login to fetch the key vault secrets and uses the saved connection string there to query the database. However the "actual question" is whether once we deploy the same over AKS and then used the "AKS's " system assigned managed identity and provide it, the "Key Vault contributor" role to read secrets, should that be fine and should work right?.. We have seen our deployment resulting in "CrashLopp" error due to this. Most of the answers on public forums ask to either use "CSI driver" or "pod identity" or "workload federated", however if code itself is able to fetch the secrets, why can't we use the "system assigned managed identity" of the aks cluster to fetch the secrets.

Deepanshukatara-6769 10,215 Reputation points

2024-11-07T10:39:45.8566667+00:00

Yes, you can use an AKS system-assigned managed identity to fetch Key Vault secrets using the Azure SDK.it should if it is failing it maybe diff error

Chetan Prakash Saraswat 26 Reputation points

2024-11-07T10:47:15.35+00:00

Using the system assigned managed identity of the AKS cluster kept on failing the pod while deploying, however when we used the VMSS's system assigned managed identity it worked and the same deployment was successful. Maybe we are missing something here.. Which identity is to be preferred if my code is fetching the credentials from the key vault and further if the key vault secret is fetching the connection string from Azure SQL DB, do we have to provide any further access to any of these identities in SQL?

Deepanshukatara-6769 10,215 Reputation points

2024-11-07T11:59:37.2333333+00:00

For fetching Key Vault secrets in Azure Kubernetes Service (AKS), it is recommended to use pod-managed identities. Pod-managed identities allow pods to request an access token in real time, which can then be used to access Azure resources, including Azure Key Vault. This approach enhances security by avoiding hardcoded credentials in your application code.

Regarding access to Azure SQL Database, if your pod needs to access Azure SQL Database, you will need to ensure that the appropriate permissions are granted to the managed identity associated with the pod. This typically involves configuring role assignments in Azure to allow the managed identity to access the Azure SQL Database.

References:

Best practices for pod security in Azure Kubernetes Service (AKS)

Best practices for authentication and authorization in Azure Kubernetes Service (AKS)
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

AKS pod in CrashLoop error due to managed identity integration

1 answer

Your answer