Explanation for Kubelet Identity Role Assignment

[haithamshahin333]

Hi Team,

Could you provide an explanation around why the Kubelet Identity needs Virtual Machine Contributor?

https://github.com/mspnp/aks-secure-baseline/blob/853ccd92bd8199c2a5486fda8947688e1353b065/cluster-stamp.json#L730

Appreciate the guidance!

[ferantivero]

Thanks for your inquiry @haithamshahin333 , please let us share with you the following comments we added in our ARM templates giving some details for this:

https://github.com/mspnp/aks-secure-baseline/blob/3f3090b2cdf46493b18115af33d00158d6ba0707/cluster-stamp.json#L727

as well as what is documented at the add-pod-identity repository around role assignments.

[haithamshahin333]

Thanks @ferantivero - so is the kubelet and not the cluster identity that makes those updates? It makes sense that some identity that AKS is associated with would need the proper roles, but my thought was that it would be done with the cluster identity and not the kubelet identity (and the cluster identity already has contributor over the cluster infrastructure resource group).

[ferantivero]

In this Reference Implementation we configured the ASK cluster with user-assigned managed identity authentication method.

When a pod is scheduled in an AKS cluster using user-assigned auth method, the add-pod-identity is going to attempt to use the user-assigned managed identity that is being returned by identityProfile.kubeletidentity to assign the managed identity associated to the "new" pod in creation phase to the underlying VMSS used by the node pool.

Some final thoughts,

1. Please note that add-pod-identity by its own design dictated which cluster identity (kubelet in this case) out many identities is used as part of managed identities assignments.
2. Most likely, in the future we are going to be inclined to usage of an AKS Pod Identity v2 add-on which will change how this present insides the cluster.

For further information why this kubelet manage identity is being used instead of any other one, you could ask this very same at the add-pod-identity repo.