Skip to content

Commit 15be8ef

Browse files
katarzyna-koltun-mxkatarzyna-koltun-mx
committed
edits
1 parent bf15318 commit 15be8ef

File tree

1 file changed

+111
-85
lines changed

1 file changed

+111
-85
lines changed

‎content/en/docs/private-platform/configuration/pmp-configure-azure-key-vault.md‎

Lines changed: 111 additions & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -152,101 +152,127 @@ Private Mendix Platform uses Azure AD Workload Identity to securely access Azure
152152

153153
To create a User-Assigned Managed Identity, perform the following steps:
154154

155-
1. Navigate to the IAM service in the AWS Management Console.
156-
2. Click **Create role** and configure the following:
157-
158-
* **Trusted entity** - Select **Web identity**
159-
* **Identity provider** - Choose your EKS cluster's OIDC provider
160-
* **Audience** - `sts.amazonaws.com`
161-
162-
3. Click **Next** to proceed to permissions.
163-
4. Create or attach a custom policy with the following permissions:
164-
165-
```yaml
166-
{
167-
"Version": "2012-10-17",
168-
"Statement": [
169-
{
170-
"Effect": "Allow",
171-
"Action": [
172-
"secretsmanager:GetSecretValue",
173-
"secretsmanager:DescribeSecret"
174-
],
175-
"Resource": "arn:aws:secretsmanager:*:*:secret:PMP-*"
176-
}
177-
]
178-
}
179-
```
180-
181-
5. Name the role, for example, *PMP-SecretsManager-Role*.
182-
6. Make a note of the **Role ARN** for the next steps.
183-
184-
#### Configuring the EKS Service Account
185-
186-
To configure the EKS service account, perform the following steps:
187-
188-
1. Navigate to your EKS cluster in the AWS Management Console.
189-
2. In the **Configuration** tab, select **Service accounts**.
190-
3. Click **Create** to create a new service account.
191-
4. Enter a name for the service account, for example, *pmp-secrets-access*.
192-
5. Under **IAM role**, select the role you created above.
193-
6. Click **Create** to finalize the service account creation.
194-
7. Update your Kubernetes deployment to use the new service account by adding the following annotation to your deployment YAML:
195-
196-
```text
197-
apiVersion: apps/v1
198-
kind: Deployment
199-
metadata:
200-
name: pmp-deployment
201-
annotations:
202-
eks.amazonaws.com/role-arn: arn:aws:iam::<your-account-id>:role/pmp-secret-access
203-
spec:
204-
template:
205-
spec:
206-
serviceAccountName: pmp-secret-access
207-
```
208-
209-
8. Apply the changes to your Kubernetes cluster using the following command: `kubectl apply -f <your-deployment-file>.yaml`.
210-
9. Verify that the service account is correctly configured by checking the logs of your application.
211-
212-
It should be able to access the secrets stored in AWS Secret Manager.
155+
1. In the Azure Portal, search for and select **Managed Identities**.
156+
2. Click **Create**.
157+
3. Select your **Subscription** and **Resource Group**.
158+
4. Choose a **Region**.
159+
5. Enter a **Name** (for example, *PMP-KeyVault-Identity*).
160+
6. Review and click **Create**.
161+
7. Once deployed, navigate to the new identity.
162+
8. From the **Overview** page, make note of the **Client ID**. This will be needed later to configure the service account.
163+
164+
#### Grant the Managed Identity Access to Key Vault
165+
166+
To grant the Managed Identity access to the Key Vault, perform the following steps:
167+
168+
1. Navigate to the Key Vault you created earlier.
169+
2. Go to the **Access control (IAM)** section.
170+
3. Click **Add > Add role assignment**.
171+
4. Select the **Key Vault Secrets User** role. This role allows Get and List operations for secrets.
172+
5. Click **Next**.
173+
6. For **Assign access to**, select **Managed identity**.
174+
7. Click **Select members** and search for the **User-Assigned Managed Identity** you created (for example, **PMP-KeyVault-Identity**).
175+
8. Select the identity, and then click **Review + assign**.
176+
177+
#### Configuring the Federated Identity
178+
179+
To configure the federated identity, perform the following steps:
180+
181+
1. Navigate back to your User-Assigned Managed Identity (for example, **PMP-KeyVault-Identity**) in the Azure Portal.
182+
2. Go to the **Federated credentials** section.
183+
3. Click **Add credential**.
184+
4. From the **Federated credential scenario** list, select **Kubernetes accessing Azure resources**.
185+
5. Enter the following details:
186+
187+
* **Kubernetes namespace** - The namespace where your Private Mendix Platform is deployed (for example, **pmp-prod**).
188+
* **Service account name** - The name of the Kubernetes service account your PMP deployment will use (for example, **pmp-secret-accessor**).
189+
* **Issuer** - The OIDC Issuer URL of your AKS cluster.
190+
191+
Click **Add**.
192+
193+
#### Modifying the Operation Configuration
194+
195+
For more information about advanced configuration settings, see [Advanced Operator Configuration](/developerportal/deploy/private-cloud-cluster/#advanced-operator-configuration).
196+
197+
To modify the configuration, perform the following steps:
198+
199+
1. Update the configuration to [use the service token](https://docs.mendix.com/developerportal/deploy/private-cloud-cluster/#advanced-deployment-settings).
200+
201+
Set `runtimeAutomountServiceAccountToken: true` to allow Mendix app pods to get a Kubernetes Service Account token.
202+
203+
```text
204+
apiVersion: privatecloud.mendix.com/v1alpha1
205+
kind: OperatorConfiguration
206+
spec:
207+
# Optional: provide Mendix app Pods to get a Kubernetes Service Account token
208+
runtimeAutomountServiceAccountToken: true
209+
```
210+
211+
2. Add a custom pod label which informs the Operator to use workload identities. For more information, see [General Pod Labels](https://docs.mendix.com/developerportal/deploy/private-cloud-cluster/#general-pod-labels).
212+
213+
```text
214+
apiVersion: privatecloud.mendix.com/v1alpha1
215+
kind: OperatorConfiguration
216+
spec:
217+
# ...
218+
# Other configuration options values
219+
# Optional: custom pod labels
220+
customPodLabels:
221+
# Optional: general pod labels (applied to all app-related pods)
222+
general:
223+
# Example: enable Azure Workload Identity
224+
azure.workload.identity/use: "true"
225+
```
226+
227+
#### Configuring the Kubernetes Service Account
228+
229+
To configure the Kubernetes service account, perform the following steps:
230+
231+
1. Create a Kubernetes service account with the name you specified above (for example, **pmp-secret-accessor**).
232+
2. Annotate this service account to link it to your User-Assigned Managed Identity.
233+
234+
```text
235+
kubectl -n <{Kubernetes namespace}> create serviceaccount <{environment name}>
236+
kubectl -n <{Kubernetes namespace}> annotate serviceaccount <{environment name}> privatecloud.mendix.com/environment-account=true
237+
kubectl -n <{Kubernetes namespace}> annotate serviceaccount <{environment name}> azure.workload.identity/client-id=<{managed identity client id}>
238+
```
239+
240+
3. Apply this service account to your cluster by using the following command: `kubectl apply -f <your-service-account-file>.yaml`.
241+
4. Update your Private Mendix Platform deployment YAML to use this service account:
242+
243+
```text
244+
apiVersion: apps/v1
245+
kind: Deployment
246+
metadata:
247+
name: pmp-deployment
248+
spec:
249+
template:
250+
spec:
251+
serviceAccountName: pmp-secret-accessor
252+
```
253+
254+
5. Apply the changes to your deployment by using the following command: `kubectl apply -f <your-deployment-file>.yaml`.
213255

214256
### Configuring the Credentials
215-
257+
216258
Private Mendix Platform supports multiple secret storage backends. You can configure different types of credentials (VCS PAT, email server credentials, and so on) to use your preferred secret management solution.
217259

218-
#### Example Configuration - AWS Secrets Manager and VCS PAT
219-
220-
The following example shows how you can configure Private Mendix Platform to work with AWS Secrets Manager and VCS PAT.
260+
#### Example Configuration - Azure Key Vault and VCS PAT
261+
262+
The following example shows how you can configure Private Mendix Platform to work with Azure Key Vault and VCS PAT.
221263

222264
1. Navigate to the Private Mendix Platform administrator panel.
223265
2. Go to the **Version Control** settings.
224266
3. Select the service which you want to configure (for example, GitHub, GitLab, or Bitbucket).
225267
4. Enter all required configuration details.
226-
5. In the **Credentials** section, select **AWS Secrets Manager**.
227-
6. Enter the name of the secret that you created earlier, for example, *PMP-Credentials*.
228-
229-
The **Key name** field displays the auto-generated key path in read-only format.
230-
231-
7. Ensure that your AWS Secrets Manager secret contains the credential using the proper key structure.
268+
5. In the **Credentials** section, select **Azure Key Vault**.
269+
6. Enter the **Secret Name (Vault Name)** of your Key Vault (for example, **PMP-Production-Vault**).
232270

233-
For example, if you are using Bitbucket, the key name for `Project Admin PAT` would be `VCS.BitbucketProjectAdminPAT`, where `VCS` is the module name, and `BitbucketProjectAdminPAT` is the credential name.
234-
235-
The secret template contains a sample key structure which you can use:
236-
237-
```text
238-
{ //...other keys
239-
"VCS": {
240-
// ...other keys
241-
"BitbucketProjectAdminPAT": "your-bitbucket-pat",
242-
// ...other keys
243-
},
244-
// ...other keys
245-
}
246-
```
271+
The Key name field displays the auto-generated key path in read-only format. For example, if you are using Bitbucket, the key name for Project Admin PAT would be *VCS-BitbucketProjectAdminPAT*.
247272

273+
7. Ensure that your Azure Key Vault secret's **Value** contains the correct credential value for that particular key.
248274
8. Repeat the process for other credentials as needed, ensuring you follow the naming conventions for each service.
249275

250-
## Storing the Credentials Directly in the Database
251-
252-
Instead of using the AWS Secret Manager, you can still use the legacy option to store the credentials in the Private Mendix Platform database. To do this, you must select **Database** from the storage options dropdown, and then enter the credentials directly in an input field. The credentials are encrypted and stored in the Private Mendix Platform database.
276+
### Storing the Credentials Directly in the Database
277+
278+
Instead of using the Azure Key Vault, you can still use the legacy option to store the credentials in the Private Mendix Platform database. To do this, you must select **Database** from the list of storage options, and then enter the credentials directly in an input field. The credentials are encrypted and stored in the Private Mendix Platform database.

0 commit comments

Comments
 (0)