You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/en/docs/configuration/acme/dns01/azuredns.md
+196Lines changed: 196 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,6 +5,202 @@ weight: 30
5
5
type: "docs"
6
6
---
7
7
8
+
To configure the AzureDNS DNS01 Challenge in a Kubernetes cluster there are 3 ways available:
9
+
10
+
-[Managed Identity Using AAD Pod Identities](#managed-identity-using-aad-pod-identities)
11
+
-[Managed Identity Using AKS Kubelet Identity](#managed-identity-using-aks-kubelet-identity)
12
+
-[Service Principal](#service-principal)
13
+
14
+
## Managed Identity Using AAD Pod Identities
15
+
16
+
[AAD Pod Identities](https://azure.github.io/aad-pod-identity) allows assigning a [Managed Identity](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview) to a pod. This removes the need for adding explicit credentials into the cluster to create the required DNS records.
17
+
18
+
> Note: When using Pod identity, even though assigning multiple identities to a single pod is allowed, currently cert-manager does not support this as it is not able to identify which identity to use.
19
+
20
+
Firstly an identity should be created that has access to contribute to the DNS Zone.
21
+
22
+
- Example creation using `azure-cli` and `jq`:
23
+
```bash
24
+
# Choose a unique Identity name and existing resource group to create identity in.
value = azurerm_user_assigned_identity.dns_identity.client_id
64
+
}
65
+
66
+
# Resource Id Used for identity binding
67
+
output "identity_resource_id" {
68
+
value = azurerm_user_assigned_identity.dns_identity.id
69
+
}
70
+
```
71
+
72
+
Next we need to ensure we have installed [AAD Pod Identity](https://azure.github.io/aad-pod-identity) using their walk-through. This will install the CRDs and deployment required to assign the identity.
73
+
74
+
Now we can create the identity resource and binding using the below manifest as an example:
75
+
76
+
```yaml
77
+
apiVersion: "aadpodidentity.k8s.io/v1"
78
+
kind: AzureIdentity
79
+
metadata:
80
+
annotations:
81
+
# recommended to use namespaced identites https://azure.github.io/aad-pod-identity/docs/configure/match_pods_in_namespace/
82
+
aadpodidentity.k8s.io/Behavior: namespaced
83
+
name: certman-identity
84
+
namespace: cert-manager # change to your preferred namespace
85
+
spec:
86
+
type: 0# MSI
87
+
resourceID: <Identity_Id> # Resource Id From Previous step
88
+
clientID: <Client_Id> # Client Id from previous step
89
+
---
90
+
apiVersion: "aadpodidentity.k8s.io/v1"
91
+
kind: AzureIdentityBinding
92
+
metadata:
93
+
name: certman-id-binding
94
+
namespace: cert-manager # change to your preferred namespace
95
+
spec:
96
+
azureIdentity: certman-identity
97
+
selector: certman-label # This is the label that needs to be set on cert-manager pods
98
+
```
99
+
100
+
Next we need to ensure the cert-manager pod has a relevant label to use the pod identity binding. This can be done by editing the deployment and adding the below into the `.spec.template.metadata.labels` field
101
+
102
+
```yaml
103
+
spec:
104
+
template:
105
+
metadata:
106
+
labels:
107
+
aadpodidbinding: certman-label # must match selector in AzureIdentityBinding
108
+
```
109
+
110
+
Or by using the helm values `podLabels`
111
+
112
+
```yaml
113
+
podLabels:
114
+
aadpodidbinding: certman-label
115
+
```
116
+
117
+
Lastly when we create the certificate issuer we only need to specify the `hostedZoneName`, `resourceGroupName` and `subscriptionID` fields for the DNS zone. Example below:
118
+
119
+
```yaml
120
+
apiVersion: cert-manager.io/v1
121
+
kind: Issuer
122
+
metadata:
123
+
name: example-issuer
124
+
spec:
125
+
acme:
126
+
...
127
+
solvers:
128
+
- dns01:
129
+
azureDNS:
130
+
subscriptionID: AZURE_SUBSCRIPTION_ID
131
+
resourceGroupName: AZURE_DNS_ZONE_RESOURCE_GROUP
132
+
hostedZoneName: AZURE_DNS_ZONE
133
+
# Azure Cloud Environment, default to AzurePublicCloud
134
+
environment: AzurePublicCloud
135
+
```
136
+
137
+
## Managed Identity Using AKS Kubelet Identity
138
+
139
+
When creating an AKS cluster in Azure there is the option to use a managed identity that is assigned to the kubelet. This identity is assigned to the underlying node pool in the AKS cluster and can then be used by the cert-manager pods to authenticate to Azure Active Directory.
140
+
141
+
There are some caveats with this approach, these mainly being:
142
+
143
+
- You will need to ensure only 1 managed identity is assigned to the node pool. This is due to cert-manager not currently being able to select the identity to use
144
+
- Any permissions granted to this identity will also be accessible to all containers running inside the Kubernetes cluster.
145
+
- Using AKS extensions like `Kube Dashboard` will not work with this method as this creates an additional identity that is assigned to the node pools.
146
+
147
+
To set this up, firstly you will need to retrieve the identity that the kubelet is using by querying the AKS cluster. This can then be used to create the appropriate permissions in the DNS zone.
148
+
149
+
- Example commands using `azure-cli`:
150
+
```bash
151
+
# Get AKS Kubelet Identity
152
+
PRINCIPAL_ID=$(az aks show -n $CLUSTERNAME -g $CLUSTER_GROUP --query "identityProfile.kubeletidentity.objectId" -o tsv)
153
+
154
+
# Get existing DNS Zone Id
155
+
ZONE_ID=$(az network dns zone show --name $ZONE_NAME --resource-group $ZONE_GROUP --query "id" -o tsv)
156
+
157
+
# Create role assignment
158
+
az role assignment create --role "DNS Zone Contributor" --assignee $PRINCIPAL_ID --scope $ZONE_ID
skip_service_principal_aad_check = true # Allows skipping propagation of identity to ensure assignment succeeds.
180
+
}
181
+
```
182
+
183
+
Then when creating the cert-manager issuer we only need to specify the `hostedZoneName`, `resourceGroupName` and `subscriptionID` fields for the DNS Zone. Example below:
184
+
```yaml
185
+
apiVersion: cert-manager.io/v1
186
+
kind: Issuer
187
+
metadata:
188
+
name: example-issuer
189
+
spec:
190
+
acme:
191
+
...
192
+
solvers:
193
+
- dns01:
194
+
azureDNS:
195
+
subscriptionID: AZURE_SUBSCRIPTION_ID
196
+
resourceGroupName: AZURE_DNS_ZONE_RESOURCE_GROUP
197
+
hostedZoneName: AZURE_DNS_ZONE
198
+
# Azure Cloud Environment, default to AzurePublicCloud
199
+
environment: AzurePublicCloud
200
+
```
201
+
202
+
## Service Principal
203
+
8
204
Configuring the AzureDNS DNS01 Challenge for a Kubernetes cluster requires
0 commit comments