BLOGAzureブログ

                            
export RESOURCE_GROUP="licensecounter-blog-redisCache-rg"
export CLUSTER_NAME="licensecounter-blog-AKSCluster"
                            
                        

                            
az aks create --resource-group "${RESOURCE_GROUP}"\
 --name "${CLUSTER_NAME}"\
 --enable-oidc-issuer\
 --enable-workload-identity\
 --generate-ssh-keys
                            
                        

                            
export AKS_OIDC_ISSUER="$(az aks show --name "${CLUSTER_NAME}" --resource-group "${RESOURCE_GROUP}" --query "oidcIssuerProfile.issuerUrl" --output tsv)"
                            
                        

                            
echo $AKS_OIDC_ISSUER

https://japaneast.oic.prod-aks.azure.com/1e0e9558-c816-4936-a147-bef523f3e718/3e75997f-b5ee-4055-9b8f-9cb62bb40de0/
                            
                        

                            
az aks get-credentials --name "${CLUSTER_NAME}" --resource-group "${RESOURCE_GROUP}"

Merged "licensecounter-blog-AKSCluster" as current context in /home/yusuke_yatsurugi/.kube/config
                            
                        

                            
export SERVICE_ACCOUNT_NAMESPACE="default"
export SERVICE_ACCOUNT_NAME="workload-identity-sa"
export USER_ASSIGNED_IDENTITY_NAME="licensecounter-blog-userAssignedId"
export FEDERATED_IDENTITY_CREDENTIAL_NAME="myFedIdentity"
export USER_ASSIGNED_CLIENT_ID="$(az identity show --resource-group "${RESOURCE_GROUP}" --name "${USER_ASSIGNED_IDENTITY_NAME}" --query 'clientId' --output tsv)"
                            
                        

                            
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
annotations:
    azure.workload.identity/client-id: "${USER_ASSIGNED_CLIENT_ID}"
name: "${SERVICE_ACCOUNT_NAME}"
namespace: "${SERVICE_ACCOUNT_NAMESPACE}"
EOF

serviceaccount/workload-identity-sa created
                            
                        

                            
az identity federated-credential create --name ${FEDERATED_IDENTITY_CREDENTIAL_NAME} --identity-name "${USER_ASSIGNED_IDENTITY_NAME}" --resource-group "${RESOURCE_GROUP}" --issuer "${AKS_OIDC_ISSUER}" --subject system:serviceaccount:"${SERVICE_ACCOUNT_NAMESPACE}":"${SERVICE_ACCOUNT_NAME}" --audience api://AzureADTokenExchange
                            
                        

                        
az acr build --image sample/connect-from-aks-sample:1.0\
 --registry acrypzm3qbq7ni5i\
 --file Dockerfile .
                        
                    

                        
az aks update --name akscluster\
 --resource-group licensecounter-blog-redisCache-rg\
 --attach-acr acrypzm3qbq7ni5i
                        
                    

                            
az aks get-credentials --resource-group "${RESOURCE_GROUP}" --name "${CLUSTER_NAME}"

Merged "licensecounter-blog-AKSCluster" as current context in /home/yusuke_yatsurugi/.kube/config
                            
                        

                            
kubectl get nodes

NAME                                STATUS   ROLES    AGE   VERSION
aks-nodepool1-41487293-vmss000000   Ready    <none>   32m   v1.30.9
aks-nodepool1-41487293-vmss000001   Ready    <none>   32m   v1.30.9
aks-nodepool1-41487293-vmss000002   Ready    <none>   32m   v1.30.9                                
                            
                        

                        
apiVersion: v1
kind: Pod
metadata:
    name: entrademo-pod
    labels:
      azure.workload.identity/use: "true"  # Required. Only pods with this label can use workload identity.
spec:
    serviceAccountName: workload-identity-sa
    containers:
    - name: entrademo-container
      image: acrypzm3qbq7ni5i.azurecr.io/sample/connect-from-aks-sample:1.0
      imagePullPolicy: Always
      command: ["dotnet", "ConnectFromAKS.dll"] 
      resources:
        limits:
          memory: "256Mi"
          cpu: "500m"
        requests:
          memory: "128Mi"
          cpu: "250m"
      env:
          - name: AUTHENTICATION_TYPE
            value: "ACCESS_KEY" # change to ACCESS_KEY to authenticate using access key
          - name: REDIS_HOSTNAME
            value: "licensecounterakscluster.redis.cache.windows.net"
          - name: REDIS_ACCESSKEY
            value: "UeN4ckv3Z8qtV4MlGnWzcBIAKtfJJhHneAzCaBgWqk4=" 
          - name: REDIS_PORT
            value: "6380" # change to 10000 for Azure Managed Redis
    restartPolicy: Never
                        
                    

                        
kubectl apply -f podspec.yaml

pod/entrademo-pod created
                        
                    

                        
kubectl get pods

NAME            READY   STATUS      RESTARTS   AGE
entrademo-pod   0/1     Completed   0          24s
                        
                    

                        
kubectl logs entrademo-pod

This sample shows how to connect to an Azure Redis cache using an Microsoft Entra identity or an access key. You can also run this sample locally with your user principal configured as a Redis User for your redis instance.
Connecting to {cacheHostName} with an access key..
Retrieved value from Redis: Hello, Redis!