Securily access ADLS from kubernetes

Swetank Gupta 1 Reputation point
2021-08-18T10:07:06.537+00:00

I want to securely access ADLS Gen2 from my java applications deployed in kubernetes cluster. Is there a way I can do it without providing access token and Azure AD can handle the security out of the box for me probably with managed identity / OAuth / something else
Also, I am using client credentials flow to get access token for the same, would I be able to use refresh token to generate a new access token?

Azure Data Lake Storage
Azure Data Lake Storage
An Azure service that provides an enterprise-wide hyper-scale repository for big data analytic workloads and is integrated with Azure Blob Storage.
1,349 questions
Azure Kubernetes Service (AKS)
Azure Kubernetes Service (AKS)
An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.
1,859 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,541 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Shashi Shailaj 7,581 Reputation points Microsoft Employee
    2021-08-20T20:37:55.593+00:00

    Hello @Swetank Gupta ,

    ADLS gen2 is essentially a storage account with specific settings enabled. In general a VM can be used to access a storage account using managed identity . As you do not want to request an access token within your application which would only be possible if you create a service principal in active directory and use that in your application to call ADLS gen2 instance , only way left for your would be to use a managed identity to authenticate pods themselves with other services. This is possible if you are using Azure kubernetes service and is mentioned in the article https://learn.microsoft.com/en-us/azure/aks/operator-best-practices-identity . You would have to setup AKS to use Azure AD . If you are running your own kubernetes instance on azure VMs , then you can probably try to see if the Kubernetes pod are able to use the host Linux VMs managed Identity . I am not sure if it works or not as I have not done anything like this before.

    Coming to your next question about Client credentials oAuth flow. If you are using Client credentials flow , you wont get a access token-refresh token pair as you get normally in case when you use authorization code grant flow. In case of client credentials flow one has to handle this within their code. once you get the token you need to save the expiry timestamp which will be 60 minutes when it was generated. If you are running any operation like accessing data from an endpoint you would have to periodically check whether you are going to reach the time or not and accordingly request for a new token again using the same flow.

    Hope the information helps. If you have any further queries , feel free to let us know and we will be happy to help . If the information in this post was useful , please do accept the post as answer which will help other members of the community . I have added a few links , please take some time to go through them and I am sure you would be able to get more clarity on this . As I am not a developer hence I have limited experience with app configuration technologies however If there is something which you are not sure of , feel free to ask and I will try to get more help internally to clarify your queries . It may take a little time but we will be happy to help .

    Thank you.

    0 comments