Skip to content

Commit 435e4bd

Browse files
ywk253100ywk253100
committed
Add instructions to enable the certificate-based authentication
Add instructions to enable the certificate-based authentication Signed-off-by: Wenkai Yin(尹文开) <[email protected]>
1 parent e093db3 commit 435e4bd

File tree

3 files changed

+153
-79
lines changed

3 files changed

+153
-79
lines changed

‎README.md

+68-6
Original file line numberDiff line numberDiff line change
@@ -150,14 +150,14 @@ of your cluster's resources before continuing._
150150
151151
## Set permissions for Velero
152152
153-
There are several ways Velero can authenticate to Azure: (1) by using a Velero-specific [service principal][20]; (2) by using [Azure AD Workload Identity][23]; or (3) by using a storage account access key.
153+
There are several ways Velero can authenticate to Azure: (1) by using a Velero-specific [service principal][20] with secret-based authentication; (2) by using a Velero-specific [service principal][20] with certificate-based authentication; (3) by using [Azure AD Workload Identity][23]; or (4) by using a storage account access key.
154154
155155
If you plan to use Velero to take Azure snapshots of your persistent volume managed disks, you **must** use the service principal or Azure AD Workload Identity method.
156156
157157
If you don't plan to take Azure disk snapshots, any method is valid.
158158

159159
### Specify Role
160-
_**Note**: This is only required for (1) by using a Velero-specific service principal and (2) by using Azure AD Workload Identity._
160+
_**Note**: This is only required for (1) by using a Velero-specific service principal with secret-based authentication, (2) by using a Velero-specific service principal with certificate-based authentication and (3) by using Azure AD Workload Identity._
161161

162162
1. Obtain your Azure Account Subscription ID:
163163
```
@@ -241,15 +241,15 @@ There are two ways to specify the role: use the built-in role or create a custom
241241
_(Optional) If you are using a different Subscription for backups and cluster resources, make sure to specify both subscriptions
242242
inside `AssignableScopes`._
243243

244-
### Option 1: Create service principal
244+
### Option 1: Create service principal with secret-based authentication
245245

246246
1. Obtain your Azure Account Tenant ID:
247247

248248
```bash
249249
AZURE_TENANT_ID=`az account list --query '[?isDefault].tenantId' -o tsv`
250250
```
251251

252-
2. Create a service principal.
252+
2. Create a service principal with secet-based authentication.
253253

254254
If you'll be using Velero to backup multiple clusters with multiple blob containers, it may be desirable to create a unique username per cluster rather than the default `velero`.
255255
@@ -296,7 +296,69 @@ There are two ways to specify the role: use the built-in role or create a custom
296296
297297
> Available values for `AZURE_CLOUD_NAME`: `AzurePublicCloud`, `AzureUSGovernmentCloud`, `AzureChinaCloud`
298298
299-
### Option 2: Use Azure AD Workload Identity
299+
### Option 2: Create service principal with certificate-based authentication
300+
301+
1. Obtain your Azure Account Tenant ID:
302+
303+
```bash
304+
AZURE_TENANT_ID=`az account list --query '[?isDefault].tenantId' -o tsv`
305+
```
306+
307+
2. Create a service principal with certificate-based authentication.
308+
309+
If you'll be using Velero to backup multiple clusters with multiple blob containers, it may be desirable to create a unique username per cluster rather than the default `velero`.
310+
311+
Create service principal and let the CLI creates a self-signed certificate for you. Make sure to capture the certificate.
312+
313+
_(Optional) If you are using a different Subscription for backups and cluster resources, make sure to specify both subscriptions
314+
in the `az` command using `--scopes`._
315+
316+
```bash
317+
AZURE_CLIENT_CERTIFICATE_PATH=`az ad sp create-for-rbac --name "velero" --role $AZURE_ROLE --query 'fileWithCertAndPrivateKey' -o tsv \
318+
--scopes /subscriptions/$AZURE_SUBSCRIPTION_ID[ /subscriptions/$AZURE_BACKUP_SUBSCRIPTION_ID] --create-cert`
319+
```
320+
321+
NOTE: Ensure that value for `--name` does not conflict with other service principals/app registrations.
322+
323+
After creating the service principal, obtain the client id.
324+
325+
```bash
326+
AZURE_CLIENT_ID=`az ad sp list --display-name "velero" --query '[0].appId' -o tsv`
327+
```
328+
3. (Optional)Assign additional permissions to the service principal (For useAAD=true with built-in role)
329+
330+
If you use the custom role which has the blob data permissions, skip this step.
331+
332+
If you chose the AAD route, this is an additional permissions required for the service principal to be able to access the storage account.
333+
```bash
334+
az role assignment create --assignee $AZURE_CLIENT_ID --role "Storage Blob Data Contributor" --scope /subscriptions/$AZURE_SUBSCRIPTION_ID
335+
```
336+
337+
Refer: [useAAD parameter in BackupStorageLocation.md](./backupstoragelocation.md#backup-storage-location)
338+
339+
4. Convert the certificate to one line string:
340+
```bash
341+
AZURE_CLIENT_CERTIFICATE=`awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}' $AZURE_CLIENT_CERTIFICATE_PATH`
342+
```
343+
344+
5. Now you need to create a file that contains all the relevant environment variables. The command looks like the following:
345+
346+
```bash
347+
cat << EOF > ./credentials-velero
348+
AZURE_SUBSCRIPTION_ID=${AZURE_SUBSCRIPTION_ID}
349+
AZURE_TENANT_ID=${AZURE_TENANT_ID}
350+
AZURE_CLIENT_ID=${AZURE_CLIENT_ID}
351+
AZURE_CLIENT_CERTIFICATE="${AZURE_CLIENT_CERTIFICATE}"
352+
AZURE_RESOURCE_GROUP=${AZURE_RESOURCE_GROUP}
353+
AZURE_CLOUD_NAME=AzurePublicCloud
354+
EOF
355+
```
356+
357+
> Note: `${AZURE_CLIENT_CERTIFICATE} must be enclosed in double quotes`
358+
359+
> Available values for `AZURE_CLOUD_NAME`: `AzurePublicCloud`, `AzureUSGovernmentCloud`, `AzureChinaCloud`
360+
361+
### Option 3: Use Azure AD Workload Identity
300362
301363
These instructions have been adapted from the [Azure AD Workload Identity Quick Start][24] documentation.
302364
@@ -404,7 +466,7 @@ Before proceeding, ensure that you have installed [workload identity mutating ad
404466
> Available values for `AZURE_CLOUD_NAME`: `AzurePublicCloud`, `AzureUSGovernmentCloud`, `AzureChinaCloud`
405467
406468
407-
### Option 3: Use storage account access key
469+
### Option 4: Use storage account access key
408470
409471
_Note: this option is **not valid** if you are planning to take Azure snapshots of your managed disks with Velero._
410472

‎go.mod

+24-24
Original file line numberDiff line numberDiff line change
@@ -5,44 +5,44 @@ go 1.21
55
toolchain go1.21.6
66

77
require (
8-
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.8.0
8+
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.10.0
99
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v4 v4.2.1
10-
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.1.0
10+
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.3.1
1111
github.com/gofrs/uuid v4.3.1+incompatible
1212
github.com/pkg/errors v0.9.1
1313
github.com/sirupsen/logrus v1.9.3
1414
github.com/spf13/pflag v1.0.5
15-
github.com/stretchr/testify v1.8.4
16-
github.com/vmware-tanzu/velero v0.0.0-20240312081256-79e9e31d8ddd
15+
github.com/stretchr/testify v1.9.0
16+
github.com/vmware-tanzu/velero v0.0.0-20240327101532-cd0632c5dbfa
1717
k8s.io/api v0.29.0
1818
k8s.io/apimachinery v0.29.0
1919
sigs.k8s.io/azuredisk-csi-driver v1.26.0
2020
)
2121

2222
require (
23-
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.1 // indirect
24-
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.3.0 // indirect
23+
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.1 // indirect
24+
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.5.0 // indirect
2525
github.com/joho/godotenv v1.4.0 // indirect
26-
google.golang.org/genproto/googleapis/rpc v0.0.0-20230920204549-e6e6cdab5c13 // indirect
26+
google.golang.org/genproto/googleapis/rpc v0.0.0-20240311132316-a219d84964c2 // indirect
2727
)
2828

2929
require (
30-
github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0 // indirect
31-
github.com/AzureAD/microsoft-authentication-library-for-go v1.1.1 // indirect
30+
github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.2 // indirect
31+
github.com/AzureAD/microsoft-authentication-library-for-go v1.2.1 // indirect
3232
github.com/davecgh/go-spew v1.1.1 // indirect
3333
github.com/emicklei/go-restful/v3 v3.11.0 // indirect
34-
github.com/fatih/color v1.15.0 // indirect
34+
github.com/fatih/color v1.16.0 // indirect
3535
github.com/go-logr/logr v1.4.1 // indirect
3636
github.com/go-openapi/jsonpointer v0.19.6 // indirect
3737
github.com/go-openapi/jsonreference v0.20.2 // indirect
3838
github.com/go-openapi/swag v0.22.3 // indirect
3939
github.com/gobwas/glob v0.2.3 // indirect
4040
github.com/gogo/protobuf v1.3.2 // indirect
41-
github.com/golang-jwt/jwt/v5 v5.0.0 // indirect
42-
github.com/golang/protobuf v1.5.3 // indirect
41+
github.com/golang-jwt/jwt/v5 v5.2.0 // indirect
42+
github.com/golang/protobuf v1.5.4 // indirect
4343
github.com/google/gnostic-models v0.6.8 // indirect
4444
github.com/google/gofuzz v1.2.0 // indirect
45-
github.com/google/uuid v1.3.1 // indirect
45+
github.com/google/uuid v1.6.0 // indirect
4646
github.com/hashicorp/go-hclog v1.4.0 // indirect
4747
github.com/hashicorp/go-plugin v1.6.0 // indirect
4848
github.com/hashicorp/yamux v0.1.1 // indirect
@@ -52,26 +52,26 @@ require (
5252
github.com/kylelemons/godebug v1.1.0 // indirect
5353
github.com/mailru/easyjson v0.7.7 // indirect
5454
github.com/mattn/go-colorable v0.1.13 // indirect
55-
github.com/mattn/go-isatty v0.0.19 // indirect
55+
github.com/mattn/go-isatty v0.0.20 // indirect
5656
github.com/mitchellh/go-testing-interface v1.14.1 // indirect
5757
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
5858
github.com/modern-go/reflect2 v1.0.2 // indirect
5959
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
6060
github.com/oklog/run v1.1.0 // indirect
61-
github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 // indirect
61+
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
6262
github.com/pmezard/go-difflib v1.0.0 // indirect
6363
github.com/spf13/afero v1.9.2 // indirect
6464
github.com/spf13/cobra v1.7.0 // indirect
65-
github.com/stretchr/objx v0.5.0 // indirect
66-
golang.org/x/crypto v0.17.0 // indirect
67-
golang.org/x/net v0.19.0 // indirect
68-
golang.org/x/oauth2 v0.13.0 // indirect
69-
golang.org/x/sys v0.16.0 // indirect
70-
golang.org/x/term v0.15.0 // indirect
65+
github.com/stretchr/objx v0.5.2 // indirect
66+
golang.org/x/crypto v0.21.0 // indirect
67+
golang.org/x/net v0.22.0 // indirect
68+
golang.org/x/oauth2 v0.18.0 // indirect
69+
golang.org/x/sys v0.18.0 // indirect
70+
golang.org/x/term v0.18.0 // indirect
7171
golang.org/x/text v0.14.0 // indirect
72-
golang.org/x/time v0.3.0 // indirect
73-
google.golang.org/appengine v1.6.7 // indirect
74-
google.golang.org/grpc v1.58.3 // indirect
72+
golang.org/x/time v0.5.0 // indirect
73+
google.golang.org/appengine v1.6.8 // indirect
74+
google.golang.org/grpc v1.62.1 // indirect
7575
google.golang.org/protobuf v1.33.0 // indirect
7676
gopkg.in/inf.v0 v0.9.1 // indirect
7777
gopkg.in/yaml.v2 v2.4.0 // indirect

0 commit comments

Comments
 (0)