|
|
@@ -5375,7 +5375,7 @@
|
|
|
<li>Workload Identity</li>
|
|
|
</ul>
|
|
|
<p>Regardless of which authentication method is used to authenticate to Azure Key Vault, the identity which is assigned to External Secrets Operator needs to have proper permissions to access the Key Vault. Both <a href="https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide">RBAC</a> and legacy <a href="https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy">Access Policy</a> based Key Vaults are supported.</p>
|
|
|
-<p>The required permissions depend on the type of objects you want to manage (secrets, keys, certificates) and the operations you want to perform (read, write, delete, etc.). For example, to grant External Secrets Operator permissions to synchronize secrets and certificates using an <code>ExternalSecret</code>, the minimum required permissions are either the <a href="https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/security#key-vault-secrets-user">Key Vault Secrets User</a> and <a href="https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/security#key-vault-certificates-user">Key Vault Certificates User</a> RBAC roles, alternatively for Access Policy based Key Vaults, the <code>Get</code> permission over secrets and certificates.</p>
|
|
|
+<p>The required permissions depend on the type of objects you want to manage (secrets, keys, certificates) and the operations you want to perform (read, write, delete, etc.). For example, to grant External Secrets Operator permissions to synchronize secrets and certificates using an <code>ExternalSecret</code>, the minimum required permissions are either the <a href="https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/security#key-vault-secrets-user">Key Vault Secrets User</a> and <a href="https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/security#key-vault-certificate-user">Key Vault Certificate User</a> RBAC roles, or alternatively for Access Policy based Key Vaults, the <code>Get</code> permission over secrets and certificates.</p>
|
|
|
<h4 id="service-principal">Service Principal</h4>
|
|
|
<p>To use a Service Principal's credentials for authentication, you need to create a Service Principal in Entra ID and grant it the necessary permissions to access the Key Vault. Then, you can create a Kubernetes Secret containing the Service Principal's credentials:</p>
|
|
|
<ul>
|
Skarlso