This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(156.8, 78%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECP%3C/text%3E%3C/svg%3E)
We have an AKS cluster on which one of our Deployments which now uses DefaultAzureCredential class to fetch connection strings stored in Azure Key Vault. We have provide the "System Assigned Managed Identity" contributor access to Key Vault to read the secrets. However the deployment keeps on getting error with "CrashLoopBackoff" error. We think its probably due to some configuration which we are missing for the AKS identity to use the key vault. Live Logs on pod do not show any specific error as to why its happening, as it primarily lists out the below code . Is CSI enabled secret provider the only way to do this. Can we not use our code to fetch key vault secrets using below method??
builder.Configuration.AddAzureKeyVault(new Uri(builder.Configuration["KeyVault:Uri"]), new DefaultAzureCredential());
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(294.40000000000003, 47%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMR%3C/text%3E%3C/svg%3E)
Just checking in to see if you had a chance to see response provided by Deepanshukatara-6769 to your question. Please tell us if it was helpful and feel free to reach out to us if you have any queries.
If you feel that your queries have been resolved, please accept the answer by clicking the "Upvote" and "Accept Answer" on the post.
Just checking in to see if you had a chance to see response provided by Deepanshukatara-6769 to your question. Please tell us if it was helpful and feel free to reach out to us if you have any queries.
If you feel that your queries have been resolved, please accept the answer by clicking the "Upvote" and "Accept Answer" on the post.
Hello Chetan , Welcome to MS Q&A
Yes, you can use your code to fetch secrets from Azure Key Vault in AKS using the Azure SDK. Here is an example of how you can do this in a .NET application:
This approach allows your application to directly fetch secrets from Azure Key Vault using the Azure SDK, without relying on the CSI-enabled Secrets Store provider
Reference:
https://learn.microsoft.com/en-us/azure/key-vault/secrets/quick-create-net?tabs=azure-cli
Please let us know if any further questions
Kindly accept if it helps
Thanks
Deepanshu
We are already using the DefaultAzure Credential class which when run locally via Visual Studio picks VS login to fetch the key vault secrets and uses the saved connection string there to query the database. However the "actual question" is whether once we deploy the same over AKS and then used the "AKS's " system assigned managed identity and provide it, the "Key Vault contributor" role to read secrets, should that be fine and should work right?.. We have seen our deployment resulting in "CrashLopp" error due to this. Most of the answers on public forums ask to either use "CSI driver" or "pod identity" or "workload federated", however if code itself is able to fetch the secrets, why can't we use the "system assigned managed identity" of the aks cluster to fetch the secrets.
Yes, you can use an AKS system-assigned managed identity to fetch Key Vault secrets using the Azure SDK.it should if it is failing it maybe diff error
Using the system assigned managed identity of the AKS cluster kept on failing the pod while deploying, however when we used the VMSS's system assigned managed identity it worked and the same deployment was successful. Maybe we are missing something here.. Which identity is to be preferred if my code is fetching the credentials from the key vault and further if the key vault secret is fetching the connection string from Azure SQL DB, do we have to provide any further access to any of these identities in SQL?
For fetching Key Vault secrets in Azure Kubernetes Service (AKS), it is recommended to use pod-managed identities. Pod-managed identities allow pods to request an access token in real time, which can then be used to access Azure resources, including Azure Key Vault. This approach enhances security by avoiding hardcoded credentials in your application code.
Regarding access to Azure SQL Database, if your pod needs to access Azure SQL Database, you will need to ensure that the appropriate permissions are granted to the managed identity associated with the pod. This typically involves configuring role assignments in Azure to allow the managed identity to access the Azure SQL Database.
References:
So tried using the VMSS's system assigned managed identity and the deployment went fine and no more "CrashLoopbackOff".. So i think if we can use the AKS's system assigned managed identity with the DefaultAzureCredentials Class instead of applying any of the above mentioned references like Pod Security or Workload Identity Federation based security.. Could you please confirm if a basic usage of the Cluster's "System Assigned Managed Identity" and provide it "Contributor" Access to Key Vault secrets using below code would work?
Program.cs
RegisterDependencyServices.cs
Hi @Chetan Prakash Saraswat, can you please confirm if you have done this?
usage of the Cluster's "System Assigned Managed Identity" and provide it "Contributor" Access to Key Vault secrets using below code would work?
Deepanshukatara-6769, Can you please check and assist Chetan Prakash further!
Thank You!
Like I informed in last comment, the initial issue was raised as the "deployment" itself was failing with using the AKS cluster's "system assigned managed identity" and provide it the "Contributor" access to the Key Vault. However when i used the VMSS's "system assigned managed identity" the deployment went through. So if anyone can confirm which "system assigned managed identity" is to be used for a normal usage for fetching Key Vaults secrets using DefaultAzureCredential() class.. The documentation in many forums is to use the clusters managed identity and some docs mention to use the VMSS's one..
Hoping, Deepanshukatara-6769 would help here.
Meanwhile, I will check internally and get back to you with some valuable information.
Thank You!
Hello Chetan
To fetch Key Vault secrets using DefaultAzureCredential in Azure Kubernetes Service (AKS), you should use the system-assigned managed identity that is created by default when you deploy an AKS cluster. This managed identity is associated with the AKS cluster and can be assigned the necessary Azure RBAC role as needed
References:
Just checking in to see if you had a chance to see response provided by Deepanshukatara-6769 to your question. Please tell us if it was helpful and feel free to reach out to us if you have any queries.
If you feel that your queries have been resolved, please accept the answer by clicking the "Upvote" and "Accept Answer" on the post.