Secure Workload Identity and Secrets Using OIDC and Azure Key Vault

Table of Contents

1. Challenge

   Review the existing configuration

   Retrieve the details of the Kubernetes service named frontend in the simple-grocery-store namespace, and access the Public IP address.

2. Challenge

   Configure AKS cluster with OIDC and Key Vault secrets provider

   • Enable OIDC issuer and Workload Identity on the AKS cluster
   • Enable Azure Key Vault Secrets Provider on the AKS cluster
3. Challenge

   Retrieve and store Cosmos DB connection string in Azure Key Vault

   Retrieve the Cosmos DB connection string and store it in the Key Vault in a secret named MongoDb-Connection-String.

4. Challenge

   Set up workload identity federation for AKS using the managed identity

   • Create a Service account in the simple-grocery-store namespace with an annotation that links it the existing managed identity id-aks-secrets
   • Create a federated identity credential that links the Kubernetes service account to the managed identity
   • Create a SecretProviderClass to sync secrets from Azure Key Vault
5. Challenge

   Update product service deployment to use workload identity and Key Vault secrets

   • Update the product-service deployment in the simple-grocery-store namespace to use the new service account and mount the secrets from the SecretProviderClass
   • Mount the the mongodb-connection-string secret using the secretProviderClass as an environment variable named MONGO_URI
6. Challenge

   Verify secret configuration and connectivity to Cosmos DB

   • Confirm the rollout of the updated deployment
   • Retrieve the deployment logs to confirm connectivity to the database
   • Review the web application to confirm products are loaded from the database