Connect Azure keyvault and container registry to on-prem kubernetes cluster

Question

Good morning.

I'm trying to connect a kubernetes cluster running on prem in our DC with Azure's key vault and container registry.

I cannot find any exhaustive documentation on how to do that (everything revolves around AKS).
Is it possible to achieve what I'm after?

Answer 1

@Andrea Florio ,this should be possible if you are able to create a cloud identity as well for you k8s cluster on-prem..
The below links can be helpful to implement the same.
ACR => https://learn.microsoft.com/en-us/azure/container-registry/container-registry-authentication?tabs=azure-cli
KV => https://github.com/Azure/secrets-store-csi-driver-provider-azure

Answer 2

Hi @Andrea Florio ,

I'm also looking into do something like that. I have not tried this yet but this may be able to help you a little more:

Is your on-prem synched with Azure AD?
I believe you may need to do something like this: https://learn.microsoft.com/en-us/answers/questions/523856/how-to-use-vms-with-azuread.html

Than will depend on the VM/Server OS. is Your k8 running on Linux?: https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-linux-vm-access-arm
Once the identity is installed you should be able to see it when creating a Vault Policy.

Case it becomes to hard, you can drop that approach and try to use an Azure Service Principal :
https://dev.to/azure/azure-tip-how-to-get-your-kubernetes-cluster-service-principal-and-use-it-to-access-other-azure-services-2735

Once you have k8 with Service Principal, you just need to create a vault policy for the service principal