Is it production ready

[mo-saeed]

Hi, so based on this announcement we should migrate to azure-workload-identity, the question is azure-workload-identity is ready for production use ?

[aramase]

Hello 👋🏻 we recommend switching to using Azure Workload Identity as AAD Pod Identity will be deprecated. We're waiting for #325 to be available after which we'll work on the GA release for Azure Workload Identity and start deprecating pod identity.

[akselleirv]

Hello @aramase, will this be GA the next release as I can see the issue that was blocking the release is now closed?

Will also the OIDC Issuer become GA by the time of this release?

[aramase]

Will also the OIDC Issuer become GA by the time of this release?

OIDC issuer is already GA.

will this be GA the next release as I can see the issue that was blocking the release is now closed?

If you're on AKS, I would recommend using the AKS managed add-on for workload identity https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview. It is currently in public preview and GA is planned for end of the year.

[akselleirv]

The docs on my side here says preview. Also when I tried creating a cluster with OIDC issuer enabled, then I had to register for the preview.

Maybe it is in preview in Norway East and GA for other locations?

[sozercan]

@akselleirv it is in the upcoming release notes, docs will need to be updated https://github.com/Azure/AKS/pull/3280/files#diff-06572a96a58dc510037d5efa622f9bec8519bc1beab13c9f251e97e657a9d4edR18

[akselleirv]

@sozercan great, thank you!

[mikerains]

Hello @aramase , on October 20, 2022 you wrote:

If you're on AKS, I would recommend using the AKS managed add-on for workload identity https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview. It is currently in public preview and GA is planned for end of the year.

The Workload Identity Overview you linked to still says it is preview today - can you update how close this is to GA?

[aramase]

The AKS GA is tentatively planned for March.

@miwithro for updates on the timeline in case of changes.

[santiago-gilz]

@aramase Will it be GA about March in Azure Commercial or Government also?

[kamilzzz]

Do we have any update regarding GA of AKS managed add-on for workload identity?

[aramase]

Do we have any update regarding GA of AKS managed add-on for workload identity?

As mentioned before, it's still targeted for end of March.

[smartaquarius10]

@aramase @miwithro, By when can we expect it to be production ready.. Is it possible to make it available by the end of April.

[aramase]

We released v1.0.0 for the OSS project and it is production ready!

If you're using the AKS add-on, @miwithro can comment on the GA date.

[smartaquarius10]

@aramase Thanks. Currently, we are using aad pod identity as well. Can we use them both as we have to perform impact analysis. If found any issue at least, we can rollback everything and keep aad identity as is.

And, soon we are planning to create a new cluster. Though I’ll go through the complete docs but do we have to make any change at the time of making the cluster so that to make it compatible with Azure workload identity.

[smartaquarius10]

@aramase Can we have both and slowly decommission AAD pod identity.

[smartaquarius10]

@miwithro, Hope you are doing well. Actually, in 7 days I have to create a new AKS cluster..
By when can we expect this addon to be prod ready --enable-workload-identity

[kamilzzz]

I believe it is already GA - https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview

https://azure.microsoft.com/en-us/updates/ga-azure-active-directory-workload-identity-with-aks-2/

[smartaquarius10]

@kamilzzz Its open source project is GA.. But, is the addon also in GA? I ran this command and can't find the it in the list of available addons

az aks addon list-available

[
{
"description": "- configure ingress with automatic public DNS name creation",
"name": "http_application_routing"
},
{
"description": "- turn on Log Analytics monitoring. Uses the Log Analytics Default Workspace if it exists, else creates one. Specify "--workspace-resource-id" to use an existing workspace.\nIf monitoring addon is enabled --no-wait argument will have no effect.",
"name": "monitoring"
},
{
"description": "- enable AKS Virtual Node. Requires --aci-subnet-name to provide the name of an existing subnet for the Virtual Node to use.\naci-subnet-name must be in the same vnet which is specified by --vnet-subnet-id (required as well).",
"name": "virtual-node"
},
{
"description": "- n/a",
"name": "kube-dashboard"
},
{
"description": "- enable Azure policy. The Azure Policy add-on for AKS enables at-scale enforcements and safeguards on your clusters in a centralized, consistent manner.\nLearn more at aka.ms/aks/policy.",
"name": "azure-policy"
},
{
"description": "- enable Application Gateway Ingress Controller addon (PREVIEW).",
"name": "ingress-appgw"
},
{
"description": "- enable confcom addon, this will enable SGX device plugin by default (PREVIEW).",
"name": "confcom"
},
{
"description": "- enable Open Service Mesh addon (PREVIEW).",
"name": "open-service-mesh"
},
{
"description": "- enable Azure Keyvault Secrets Provider addon (PREVIEW).",
"name": "azure-keyvault-secrets-provider"
},
{
"description": "- enable GitOps (PREVIEW).",
"name": "gitops"
},
{
"description": "- enable web application routing (PREVIEW).",
"name": "web_application_routing"
}
]

[smartaquarius10]

@kamilzzz My bad I was checking it as addon. Please check this az feature.. It is in preview

az feature list | head -n 2009|tail -n 8

{
    "id": "xxxxxxxxxxxxxx",
    "name": "microsoft.ContainerService/EnableWorkloadIdentityPreview",
    "properties": {
      "state": "NotRegistered"
    },
    "type": "Microsoft.Features/providers/features"
  },

[smartaquarius10]

@aramase Hii anish, I was going through your youtube video. Just wanted to know if this flag enable-oidc-issuer is still in preview or GA available. Because for manual setup of Azure workload identity this flag is anyways needed

[kevinharing]

Why is the sidecar "not supported for production use"? Does it break down or is it just a matter of support from Microsoft that's missing?