diff --git a/content/en/docs/private-platform/configuration/pmp-configure-k8s.md b/content/en/docs/private-platform/configuration/pmp-configure-k8s.md index 1c9f61c9b65..608ccddd8cb 100644 --- a/content/en/docs/private-platform/configuration/pmp-configure-k8s.md +++ b/content/en/docs/private-platform/configuration/pmp-configure-k8s.md @@ -138,7 +138,7 @@ The settings in this section configure the images. * **S3 Bucket** - This option requires an access key ID and secret access key for authentication. * **Azure Blob** - This option requires the Azure Workload identity authentication. The default service account is used in the build pod for downloading the *mxbuild* package. To configure the managed identity and service account, perform the following steps: - 1. Create a managed identity in the Azure portal + 1. Create a managed identity in the Azure portal. 2. Configure federated credentials for the Kubernetes service account. 3. In the **Managed Identity** section, add a role assignment with the following role: @@ -211,7 +211,7 @@ The settings in this section configure the storage for build output artifacts. * **Mda Storage Option** - Configure where to store the build output artifacts. The supported values are S3 Bucket and Azure Blob. This option requires the Azure Workload identity authentication. The default service account is used in the build pod for uploading the build artifacts. To configure the managed identity and service account, perform the following steps: - 1. Create or reuse a managed identity on Azure portal, and configure federated credentials for the Kubernetes service account. + 1. Create or reuse a Managed Identity on Azure portal, and configure federated credentials for the Kubernetes service account. This identity will be used as the Private Mendix Platform Managed Identity (PMP-MI). 2. In the **Managed Identity**, add a role assignment with the following role: * **Storage Blob Data Contributor** - This role permits Private Mendix Platform to read and write MDA blobs (upload deployment packages, read package metadata and SBOM contents). Private Mendix Platform requires the role to upload deployment packages. Read only access is not sufficient. As a best practice, for increased security, this role should be scoped at the container level, although scoping it to the storage account is also permitted. @@ -227,9 +227,9 @@ The settings in this section configure the storage for build output artifacts. azure.workload.identity/client-id: {client-id-pmp} ``` - This step is not required if Private Mendix Platform is using a MI from Azure Managed Identity-based storage plans. In that case, the ServiceAccount already has the correct annotation. + This step is not required if Private Mendix Platform is using a Managed Identity from Azure Managed Identity-based storage plans. In that case, the ServiceAccount already has the correct annotation. - 4. Add the following role assignments to the Private Mendix Platform Managed Identity: + 4. Add the following role assignments to the PMP-MI: * **Storage Blob Data Contributor** - This role permits Private Mendix Platform to read and write MDA blobs (upload deployment packages, read package metadata and SBOM contents). Private Mendix Platform requires the role to upload deployment packages. Read only access is not sufficient. As a best practice, for increased security, this role should be scoped at the container level, although scoping it to the storage account is also permitted. * **Storage Blob Delegator** - This role permits Private Mendix Platform to delegate access to blobs by generating presigned (user delegation SAS) download URLs. It grants no data access of its own. MDA downloads may fail even when a blob data role is correctly assigned if Delegator is missing. This role must be scoped to the storage account.