Skip to content

Managed Identity naming update #12243

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
katarzyna-koltun-mx wants to merge 1 commit into
base: development
Choose a base branch
from
Open

Managed Identity naming update #12243

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions content/en/docs/private-platform/configuration/pmp-configure-k8s.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@ The settings in this section configure the images.
* **S3 Bucket** - This option requires an access key ID and secret access key for authentication.
* **Azure Blob** - This option requires the Azure Workload identity authentication. The default service account is used in the build pod for downloading the *mxbuild* package. To configure the managed identity and service account, perform the following steps:

1. Create a managed identity in the Azure portal
1. Create a managed identity in the Azure portal.
2. Configure federated credentials for the Kubernetes service account.
3. In the **Managed Identity** section, add a role assignment with the following role:

Expand Down Expand Up @@ -211,7 +211,7 @@ The settings in this section configure the storage for build output artifacts.

* **Mda Storage Option** - Configure where to store the build output artifacts. The supported values are S3 Bucket and Azure Blob. This option requires the Azure Workload identity authentication. The default service account is used in the build pod for uploading the build artifacts. To configure the managed identity and service account, perform the following steps:

1. Create or reuse a managed identity on Azure portal, and configure federated credentials for the Kubernetes service account.
1. Create or reuse a Managed Identity on Azure portal, and configure federated credentials for the Kubernetes service account. This identity will be used as the Private Mendix Platform Managed Identity (PMP-MI).
2. In the **Managed Identity**, add a role assignment with the following role:

* **Storage Blob Data Contributor** - This role permits Private Mendix Platform to read and write MDA blobs (upload deployment packages, read package metadata and SBOM contents). Private Mendix Platform requires the role to upload deployment packages. Read only access is not sufficient. As a best practice, for increased security, this role should be scoped at the container level, although scoping it to the storage account is also permitted.
Expand All @@ -227,9 +227,9 @@ The settings in this section configure the storage for build output artifacts.
azure.workload.identity/client-id: {client-id-pmp}
```

This step is not required if Private Mendix Platform is using a MI from Azure Managed Identity-based storage plans. In that case, the ServiceAccount already has the correct annotation.
This step is not required if Private Mendix Platform is using a Managed Identity from Azure Managed Identity-based storage plans. In that case, the ServiceAccount already has the correct annotation.

4. Add the following role assignments to the Private Mendix Platform Managed Identity:
4. Add the following role assignments to the PMP-MI:

* **Storage Blob Data Contributor** - This role permits Private Mendix Platform to read and write MDA blobs (upload deployment packages, read package metadata and SBOM contents). Private Mendix Platform requires the role to upload deployment packages. Read only access is not sufficient. As a best practice, for increased security, this role should be scoped at the container level, although scoping it to the storage account is also permitted.
* **Storage Blob Delegator** - This role permits Private Mendix Platform to delegate access to blobs by generating presigned (user delegation SAS) download URLs. It grants no data access of its own. MDA downloads may fail even when a blob data role is correctly assigned if Delegator is missing. This role must be scoped to the storage account.
Expand Down
Loading