.net Rest Service running in Azure Kuberneste Service need to access Azure key vault protected with AAD

Question

Hi All,

Please let me know if my below design works fine

I have a .net Core Rest service running in Azure kubernetes,this .net service need to access the Azure keyVault (protected with Azure Active directory ) to get access the Key and Secrets.

I have assigned the System assigned Service principle to my Kubernetes Service cluster, for this service principle i will provide read access to Azure key vault.

is this design works?

Answer 1

@Amar-Azure-Practice Apologies for the delay in response and all the inconvienience caused because of the issue.

Use of managed identity for Azure resources lets a pod authenticate itself against Azure services that support it, such as Storage or SQL. The pod is assigned an Azure Identity that lets them authenticate to Azure Active Directory and receive a digital token. This digital token can be presented to other Azure services that check if the pod is authorized to access the service and perform the required actions. This approach means that no secrets are required for database connection strings.Hence assigning System assigned Managed Identity is a good approach.

With a managed identity, your application code doesn't need to include credentials to access a service, such as Azure Storage. As each pod authenticates with its own identity, so you can audit and review access. If your application connects with other Azure services, use managed identities to limit credential reuse and risk of exposure.

You can refer to this article for detailed approach on best security practices with AKS.

As mentioned in this article "If you're using a service principal, grant permissions for it to access your key vault and retrieve secrets. Assign the Reader role, and grant the service principal permissions to get secrets from your key vault" which as mentioned in the query has been already done and should be sufficient enough for integration part.

Hope it helps!!!

Please 'Accept as answer' if it helped, so that it can help others in the community looking for help on similar topics