Terraform Azure AKS - how to set UAMI as kubelet_identity for AKS cluster

Question

Looking at terraform documentation I have trouble determining how to assign UAMI as kubelet_identity for aks cluster.

The identity { ... } block which sets controlPlane UAMI as described here is not what I am looking for.

The question is - is there a terraform way I can assign additional UAMI apart from the one in identity {..} block and use it to access ACR?

I want to set a separate UAMI as a kubelet identity as described here

Answer 1

is there a terraform way I can assign additional UAMI apart from the one in identity {..} block and use it to access ACR?

According to the details you provided, you can create an additional UAMI and associate it with the AKS cluster kubelet identity, then assign the role to the UAMI, example code here: resource "azurerm_kubernetes_cluster" "example" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1"

  default_node_pool {
    name       = "default"
    node_count = 1
    vm_size    = "Standard_D2_v2"
  }

  identity {
    type = "SystemAssigned"
  }

  kubelet_identity {
    client-id = azurerm_user_assigned_identity.kubelet.client_id
    object-id = azurerm_user_assigned_identity.kubelet.principal_id
    user_assigned_identity_id = azurerm_user_assigned_identity.kubelet.id
  }
  ...
}

resource "azurerm_role_assignment" "acr_for_kubelet" {
  principal_id         = azurerm_user_assigned_identity.kubelet.client_id
  scope                = azurerm_container_registry.container_registry.id
  role_definition_name = "AcrPull"
}

Update:

Actually, when you create the AKS and enable the system-assigned managed identity, then it will create the two user-assigned identities for the AKS cluster, one is to access other resources, and one is to manage the AKS cluster itself and this one is the kubelet identity.

It doesn't make sense to assign the kubelet identity permission to access the ACR. What you need to do is to assign the AKS identity permission to access the ACR. Or use the secret and service account inside the Kubernetes to access the ACR.

Answer 2

You need something like this,

resource "azurerm_kubernetes_cluster" "kube_cluster" {
  name                = local.cluster_name
  dns_prefix          = local.cluster_name
  location            = var.location
  resource_group_name = local.resource_group

  default_node_pool {
    name       = "default"
    node_count = 2
    vm_size    = "Standard_DS2_v2"
  }

  identity {
    type                      = "UserAssigned"
    user_assigned_identity_id = data.azurerm_user_assigned_identity.managed_identity.id
  }
}

resource "azurerm_role_assignment" "acr_role_assignment" {
  principal_id         = azurerm_kubernetes_cluster.kube_cluster.kubelet_identity[0].object_id
  scope                = data.azurerm_container_registry.container_registry.id
  role_definition_name = "AcrPull"
}

You can view the whole script here

Answer 3

There seems to be an option in Terraform to assign UAMI as a kubelet identity. https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster#kubelet_identity

Example:

identity {
    type         = "UserAssigned"
    identity_ids = var.control_plane_user_assigned_managed_identity_ids
  }

  kubelet_identity {
    client_id = var.kubelet_identity_client_id
    object_id = var.kubelet_identity_object_id
    user_assigned_identity_id = var.kubelet_identity_user_assigned_identity_id
  }

And as stated above you need to assign the kubelet identity to ACR as per doc (can be done via Terraform azurerm_role_assignment:

https://learn.microsoft.com/en-us/azure/aks/use-managed-identity#add-role-assignment

Use a pre-created kubelet managed identity
A Kubelet identity enables access granted to the existing identity prior to cluster creation. This feature enables scenarios such as connection to ACR with a pre-created managed identity.