Don't create cilium-azure secret when azure.clientID is not set #40269
Conversation
When using Azure workload identity (the AKS-recommended authentication method), it is the AWI mutating admission webhook that injects client id, tenant id and so on into pods. If cilium-operator's pod spec already has the environment variable AZURE_CLIENT_ID mounted from the secret, the webhook does not overwrite it with the correct value, workload identity credential fails to acquire a token, and cilium-operator cannot sync IPAM information. And if neither client id nor client secret are specified, there is no need to create the cilium-azure secret. This commit modifies the cilium helm chart to skip creating the cilium-azure secret and the environment variable bindings to it in cilium-operator's pod spec when azure.clientID helm value is not set. Signed-off-by: Anton Tykhyy <atykhyy@gmail.com>
|
/test |
|
Looks good. Should this be backported? Would you call this a bug? |
|
I'd say it's a minor chart bug, but given that nobody has reported it before, the setup where it occurs (Cilium with Azure IPAM authenticated using Azure workload identity) is probably not widespread, so may not be worth backporting. The documentation for setting up Cilium with Azure IPAM has not only not been updated to take advantage of Azure workload identity - it was removed in v1.16, although Cilium still works in this mode. One reason might be that Azure AKS is offering Cilium as a pre-deployed CNI option. I don't want to use it because it does not support host firewall. |
|
ci-eks hit known issue #40403 |
|
Thanks for the fix @atykhyy . I merged this, but did not nominate it for backport based on your comment. |
When using Azure workload identity (the AKS-recommended authentication method), it is the AWI mutating admission webhook that injects client id, tenant id and so on into pods. If cilium-operator's pod spec already has the environment variable
AZURE_CLIENT_IDmounted from the secret, the webhook does not overwrite it with the correct value, workload identity credential fails to acquire a token, and cilium-operator cannot sync IPAM information. And if neither client id nor client secret are specified, there is no need to create the cilium-azure secret.This commit modifies the cilium helm chart to skip creating the cilium-azure secret and the environment variable bindings to it in cilium-operator's pod spec when
azure.clientIDhelm value is not set.