-
Notifications
You must be signed in to change notification settings - Fork 297
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
add AKS with kubelogin + MSI example (#1523)
* Add AKS Kubelogin example code * Update kubelogin path and add instructions in README
- Loading branch information
Showing
3 changed files
with
78 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,49 @@ | ||
using k8s; | ||
using System; | ||
using System.IO; | ||
using System.Text; | ||
|
||
var server = "https://example.hcp.eastus.azmk8s.io"; // the server url of your aks | ||
var clientid = "00000000-0000-0000-0000-000000000000"; // the client id of the your msi | ||
var kubelogin = @"C:\bin\kubelogin.exe"; // the path to the kubelogin.exe | ||
|
||
using var configstream = new MemoryStream(Encoding.ASCII.GetBytes($""" | ||
apiVersion: v1 | ||
clusters: | ||
- cluster: | ||
insecure-skip-tls-verify: true | ||
server: {server} | ||
name: aks | ||
contexts: | ||
- context: | ||
cluster: aks | ||
user: msi | ||
name: aks | ||
current-context: aks | ||
kind: Config | ||
users: | ||
- name: msi | ||
user: | ||
exec: | ||
apiVersion: client.authentication.k8s.io/v1beta1 | ||
args: | ||
- get-token | ||
- --login | ||
- msi | ||
- --server-id | ||
- 6dae42f8-4368-4678-94ff-3960e28e3630 | ||
- --client-id | ||
- {clientid} | ||
command: {kubelogin} | ||
env: null | ||
""")); | ||
|
||
var config = KubernetesClientConfiguration.BuildConfigFromConfigFile(configstream); | ||
IKubernetes client = new Kubernetes(config); | ||
Console.WriteLine("Starting Request!"); | ||
|
||
var list = client.CoreV1.ListNamespacedPod("default"); | ||
foreach (var item in list.Items) | ||
{ | ||
Console.WriteLine(item.Metadata.Name); | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,24 @@ | ||
# AKS C# example using kubelogin + MSI | ||
|
||
This example shows how to use the [kubelogin](https://github.com/Azure/kubelogin) to authenticate using [managed identities](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview) with Azure Kubernetes Service (AKS) using the C# SDK. | ||
|
||
|
||
## Prerequisites | ||
|
||
- turn on AAD support for AKS, see [here](https://docs.microsoft.com/en-us/azure/aks/managed-aad) | ||
- create a managed identity for the AKS cluster | ||
- assign the managed identity the `Azure Kubernetes Service RBAC Cluster Admin` (or other RBAC permission) on the AKS cluster | ||
- assign the managed identity to the VM, see [here](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm) | ||
- install the [kubelogin](https://github.com/Azure/kubelogin) to your machine | ||
|
||
## Running the code | ||
|
||
*You must the the code on VM with MSI* | ||
|
||
- Replace `server` with the address of your AKS cluster | ||
- Replace `clientid` with the client id of the managed identity | ||
- Replace `kubelogin` with the path to the kubelogin executable | ||
|
||
``` | ||
dotnet run | ||
``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,5 @@ | ||
<Project Sdk="Microsoft.NET.Sdk"> | ||
<PropertyGroup> | ||
<OutputType>Exe</OutputType> | ||
</PropertyGroup> | ||
</Project> |