Skip to content
Kannika

Microsoft Azure

This page describes the available authentication methods when using Microsoft Azure.

For Microsoft Azure, the following authentication methods are available:

Once your preferred authentication method has been configured, follow the instructions to use it in your Backup or Restore resource.

Azure Container Token Credentials

Section titled “Azure Container Token Credentials”

Azure Container Token Credentials are defined in the .spec.azureContainerToken field of the Credentials resource.

It can be used in combination with the following resources:

Shared Access Signature (SAS) Token

Section titled “Shared Access Signature (SAS) Token”

SAS Tokens may be used for accessing Azure Containers. The token must be set in a Secret which is then referenced by the Credentials resource.

apiVersion: kannika.io/v1alpha
kind: Credentials
metadata:
  name: azure-container-token
spec:
  azureContainerToken:
    description: "Azure Container SAS Token"  # Optional description
    sasTokenFrom:
      secretKeyRef:
        name: azure-container-sas-token       # Reference to the secret containing the SAS token
        key: secretSasToken                   # Key in the secret containing the SAS token

And here is the corresponding secret:

apiVersion: v1
kind: Secret
type: Opaque
data:
  secretSasToken: |
    <SAS Token base64-encoded>
metadata:
  name: azure-container-sas-token

IAM Service Account Authentication

Section titled “IAM Service Account Authentication”

A Kubernetes ServiceAccount (SA) can be attached to provide a specific identity to the processes running within the pods.

This configuration is primarily used to enable Workload Identity, where the Kubernetes ServiceAccount is mapped to a cloud provider IAM role. This mechanism allows pods to securely access external systems, such as cloud storage, without the need for managing static secrets or credentials. 

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-service-account
  annotations:
    azure.workload.identity/client-id: your-azure-client-id

Then on the Armory resource, configure the service account.

apiVersion: io.kannika/v1alpha
kind: Backup
metadata:
  name: backup
  labels:
    azure.workload.identity/use: "true"
  annotations:
    io.kannika/propagate-labels: "azure.workload.identity/use"
spec:
  source: "kafka"
  sink: "storage"
  serviceAccountName: "my-service-account"
  # Alternatively, propagate labels via spec.labels
  labels:
    azure.workload.identity/use: "true"