Hi all, was curious on how to setup a managed identity in Azure on LakeFS, I can't entirely follow how to setup the deployment. For service principal it was clear though to set envvars

Hi Ion, Did you try this one? https://docs.lakefs.io/howto/deploy/azure.html#2-authentication-method

It's not entirely clear, I just need to set AZURE_CLIENT_ID only and then it magically works?

It is more than AZURE_CLIENT_ID. First option, using identity-based auth:

AZURE_CLIENT_ID      =  $appId
AZURE_TENANT_ID      =  $tenant
AZURE_CLIENT_SECRET  =  $password

Second option, using storage account creds:

blockstore.azure.storage_account
blockstore.azure.storage_access_key

The link indicates you can use a managed identity, but there is no guide on how

Can you elevate a little bit about what you are trying to do? Do you try to run lakeFS on AKS? If so, creating a managed identity with

Storage Blob Data Contributor

role for your storage account should work. You just will need to set up Azure as your block store and type and configure your storage account. It can be done by setting env vars like this:

LAKEFS_BLOCKSTORE_TYPE=azure
LAKEFS_BLOCKSTORE_AZURE_STORAGE_ACCOUNT=<YourAzureStorageAccountName>

Or using your

lakefs.yaml

config file like this:

blockstore:
  type: azure
  azure:
    storage_account: <YourAzureStorageAccountName>

Yes LakeFS on AKS, the managed identity already has this RBAC on the required storage accounts. One thing that's unclear is how do I tell lakefs to use that managed identity

If your AKS is configured with a system-assigned managed identity, lakeFS will automatically use this identity for Azure resource access. If multiple user-assigned managed identities are assigned to your service, you can specify which identity lakeFS should use by setting the

AZURE_CLIENT_ID

environment variable to the client ID of the managed identity.

Yeah I don't believe the cluster is set up that way, since its shared across multiple teams

There also ways to assign managed identities to specific pods

Interesting! Thanks for the share

Sure! Please let me know if you managed to make it work for you!