Migrate from Pod-identity to workload-identity | Microsoft Azure | Page 1

minor totem Mar 15, 2023, 9:45 PM

#

Hi,

I try to migrate from pod-identity to workload-identity. We also use SecretProviderClass to fetch secerts from our KeyVaults. The problem is that the pods do not start up because of an error within the pod

Response body: {"error":"invalid_request","error_description":"Multiple user assigned identities exist, please specify the clientId / resourceId of the identity in the token request"} Endpoint

How can I find out what's wrong? I enabled azure-keyvault-secrets-provider, workload-identity and oidc-issuer.

solemn gate Mar 16, 2023, 6:12 AM

#

have you seen this by chance? https://github.com/Azure/aad-pod-identity/issues/1152#issuecomment-1136546053

GitHub

Multiple user assigned identities exist, please specify the clientI...

Have you Read Troubleshooting Guide Read Known Issues Searched on GitHub issues Describe the bug Getting token from pod fails. we are using Default Azure Credential (python) in the code to fetch th...

minor totem Mar 16, 2023, 8:15 AM

#

Yea, I've seen this. They solved it by restarting MIC, NMI pods, but I uninstalled Pod-Identity in order to migrate to Workload-Identity.

#

So I only have the these pods
aks-secrets-store-csi-driver
aks-secrets-store-provider-azure
wi-webhoook-controller-manager

solemn gate Mar 16, 2023, 4:18 PM

#

this article was published last week https://learn.microsoft.com/en-us/azure/aks/workload-identity-migrate-from-pod-identity?source=recommendations

Modernize your Azure Kubernetes Service (AKS) application to use wo...

In this Azure Kubernetes Service (AKS) article, you learn how to configure your Azure Kubernetes Service pod to authenticate with workload identity.

#Migrate from Pod-identity to workload-identity