Skip to content

Commit

Permalink
Fix error in key vault docs for v2.7. (kedacore#759)
Browse files Browse the repository at this point in the history
  • Loading branch information
v-shenoy authored May 12, 2022
1 parent 8774e87 commit 51d76fb
Showing 1 changed file with 5 additions and 6 deletions.
11 changes: 5 additions & 6 deletions content/docs/2.7/concepts/authentication.md
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,7 @@ spec:
path: {hasicorp-vault-secret-path} # Required.
azureKeyVault: # Optional.
vaultURI: {key-vault-address} # Required.
credentials: # Optional. Required when not using pod identity.
credentials: # Required.
clientId: {azure-ad-client-id} # Required.
clientSecret: # Required.
valueFrom: # Required.
Expand Down Expand Up @@ -231,20 +231,19 @@ You can pull secrets from Azure Key Vault into the trigger by using the `azureKe

The `secrets` list defines the mapping between the key vault secret and the authentication parameter.

You can use pod identity provider `azure` to authenticate to the key vault by specifying it in the
`TriggerAuthentication` / `ClusterTriggerAuthentication` definition.
Currently pod identity providers are not supported for key vault.

If you do not wish to use a pod identity provider, you need to register an [application](https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals) with Azure Active Directory and specify its credentials. The `clientId` and `tenantId` for the application are to be provided as part of the spec. The `clientSecret` for the application is expected to be within a kubernetes secret in the same namespace as the authentication resource.
You need to register an [application](https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals) with Azure Active Directory and specify its credentials. The `clientId` and `tenantId` for the application are to be provided as part of the spec. The `clientSecret` for the application is expected to be within a kubernetes secret in the same namespace as the authentication resource.

Ensure that "read secret" permissions have been granted to the managed identity / Azure AD application on the Azure Key Vault. Learn more in the Azure Key Vault [documentation](https://docs.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?tabs=azure-portal).
Ensure that "read secret" permissions have been granted to the Azure AD application on the Azure Key Vault. Learn more in the Azure Key Vault [documentation](https://docs.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?tabs=azure-portal).

The `cloud` parameter can be used to specify cloud environments besides `Azure Public Cloud`, such as known Azure clouds like
`Azure China Cloud`, etc. and even Azure Stack Hub or Air Gapped clouds.

```yaml
azureKeyVault: # Optional.
vaultURI: {key-vault-address} # Required.
credentials: # Optional. Required when not using pod identity.
credentials: # Required.
clientId: {azure-ad-client-id} # Required.
clientSecret: # Required.
valueFrom: # Required.
Expand Down

0 comments on commit 51d76fb

Please sign in to comment.