I am experimenting with mirrord, and I
# mirrord-helpr
raman_09340
05/19/2025, 7:56 AMI am experimenting with mirrord, and I thought i understood a lot of how it works. Where I couldn't figure out is:
How to use Workload Identity with this setup? I can see the workload identity token being injected into agent pod. Though the connection to other services i.e. Azure Storage Queues fail with Client Assertion. Wondering if there is anyone who has done setup where Workload Identity/ Service Account" have been used.
{
"target": {
"path": "pod/app-dev-charts-api-95874f8d5-b72ws",
"namespace": "app-dev"
},
"feature": {
"env": true,
"fs": "read",
"network": true
},
"agent": {
"log_level": "info",
"labels": {
"app": "workload",
"azure.workload.identity/use": "true"
},
"namespace": "app-dev",
"service_account": "sa-app-dev"
},
"kube_context": "au-aks-ctspoke-npd"
}
a
Aviram Hassan
05/19/2025, 7:57 AMhey @raman_09340 , welcome 🙂
I am quite sure you don't need to add the label, since the agent uses the same env/filesystem of the target pod, so if it has such workload identity it'd inherit it.
Aviram Hassan
05/19/2025, 7:58 AMI suspect the identity is determined in a file, that might be used locally due to some default configuration.
Do you know how does the identity gets "implemented" in the pod? is it a file?
r
raman_09340
05/19/2025, 7:58 AMyes, it dumps a service account token file
raman_09340
05/19/2025, 7:59 AMwhich is mounted to the pod.
a
Aviram Hassan
05/19/2025, 7:59 AMdo you know it's path?
r
raman_09340
05/19/2025, 7:59 AMyes
a
Aviram Hassan
05/19/2025, 7:59 AMcan you share? I'll then provide a config file
r
raman_09340
05/19/2025, 7:59 AM/var/run/secrets/kubernetes.io/serviceaccount
a
Aviram Hassan
05/19/2025, 8:00 AMthat should be accessible from remote automatically. Can you run a short test?
use the same mirrord.json
then
Copy code
mirrord exec -f mirrord.json -- bashr
raman_09340
05/19/2025, 8:00 AMin the above folder file is simply token
a
Aviram Hassan
05/19/2025, 8:00 AMthen in the bash, do
cat /var/run/secrets/kubernetes.io/serviceaccountAviram Hassan
05/19/2025, 8:00 AMlet me know if you get output of the remote file.
Aviram Hassan
05/19/2025, 8:00 AM(no need to share output ofc)
r
raman_09340
05/19/2025, 8:01 AMi will install the cli..
raman_09340
05/19/2025, 8:01 AMso far i was only using the vscode extension
a
Aviram Hassan
05/19/2025, 8:02 AMno worries, it's just easier to debug with the cli 🙂
r
raman_09340
05/19/2025, 8:03 AMyes, it dumps the token
a
Aviram Hassan
05/19/2025, 8:03 AMgreat! so now we know it's more about how the app accesses it
Aviram Hassan
05/19/2025, 8:04 AMWhat we see in some cases is that the SDK itself uses the local auth instead of the remote, because it has some "override" rules
r
raman_09340
05/19/2025, 8:04 AMso when app tries to access, say a cloud appliance i.e. Queue Endpoint. Is it going through the agent pod?
a
Aviram Hassan
05/19/2025, 8:04 AMlike, if you have a specific ENV it would use local auth instead of "cluster serviceaccount"
Aviram Hassan
05/19/2025, 8:04 AMyes @raman_09340 !
Aviram Hassan
05/19/2025, 8:04 AMare you available by any chance to share screen? It'd be probably easier to debug over a screen share 🙂
r
raman_09340
05/19/2025, 8:04 AMsure
a
Aviram Hassan
05/19/2025, 8:04 AMr
raman_09340
05/19/2025, 8:06 AMi am on the call.