- Trying to upgrade ESO to 1.0.0
- Created a Clustersecretstore for China Env with workload identity as per the CRD to Azure Key Vaults with Service account as reference
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
name: kv-abc-keyvault
spec:
controller: ""
provider:
azurekv:
authType: WorkloadIdentity
environmentType: ChinaCloud
vaultUrl: https://kv-abc-keyvault.vault.azure.cn
serviceAccountRef:
name: example
namespace: test
apiVersion: v1
kind: ServiceAccount
metadata:
name: example
namespace: test
annotations:
azure.workload.identity/client-id: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
azure.workload.identity/tenant-id: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
labels:
azure.workload.identity/use: "true"
- But clustersecret store is showing error (The tenant ID is correct. I have confirmed)
unable to resolve an endpoint: ResolveEndpoints(): TenantDiscoveryResponse: issuer from OIDC discovery 'https://login.partner.microsoftonline.cn/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/v2.0' does not match authority 'https://login.chinacloudapi.cn/xxxxxxxxxxxxxxxxxxxxxxxxxxxxx/' or a known pattern
-
AKS in Azure China uses the OIDC issuer https://login.partner.microsoftonline.cn/<tenant>/v2.0, but ESO ChinaCloud environment hardcodes the Azure AD authority https://login.chinacloudapi.cn.
-
CRD does not expose fields like: aadEndpoint servicePrincipalEndpoint resourceManagerEndpoint So it is currently impossible to use Workload Identity in Azure China.
-
Is it possible to fix this?
-
Or possible to add support for overriding AAD endpoints for Azure China, or update the ChinaCloud configuration to match the AKS Workload Identity issuer (login.partner.microsoftonline.cn)
AKS in Azure China uses the OIDC issuer
https://login.partner.microsoftonline.cn/<tenant>/v2.0, but ESO ChinaCloud environment hardcodes the Azure AD authorityhttps://login.chinacloudapi.cn.CRD does not expose fields like:
aadEndpointservicePrincipalEndpointresourceManagerEndpointSo it is currently impossible to use Workload Identity in Azure China.Is it possible to fix this?
Or possible to add support for overriding AAD endpoints for Azure China, or update the ChinaCloud configuration to match the AKS Workload Identity issuer (login.partner.microsoftonline.cn)