Migrating Edge from K3S to AKS with vault integration
Summary: andrewsouthcombe inquired about migrating Edge from K3S to Azure Kubernetes Service (AKS) with a focus on Azure Key Vault integration. They expressed concern over maintaining secret management during the migration. Community_Alex, identified as Community_Alex, clarified that K3S to AKS migration isn't direct, as they're distinct deployment types, but suggested that AKS functioning requires a new Edge site. andrewsouthcombe later shared that Collibra support indicated that assigning a managed identity to the AKS cluster should ensure compatibility with the Key Vault. The final solution involved migrating the site from K3S to AKS by using backup commands specific to helm chart installations and adjusting the vault authentication method to sp-secret. This method allowed for successful synchronization of existing database connections and assets on AKS.
We currently have Edge installed in Azure VMs using K3S. We are using Azure Key Vault for secret management with managed identity authentication. We plan to migrate to Azure Kubernetes Service but the documentation doesn't really cover this type of migration, or what happens with vaults. I believe the migration process is:
- Backup your current edge site and save the file
- uninstall the current edge site
- Install on AKS supplying the backup file
I have two questions related to this:
- What happens with the key vault in this scenario? Does installing from the backup recreate it as-is or do I need to recreate the integration and update the edge connections?
- Is managed identity authentication supported when Edge is running on AKS? The docs state: "In order to use the Managed Identity assigned to Azure Virtual Machine authentication method, you must install your Edge site inside of the Azure VM." but this is ambiguous. Does this mean it only works if you have on K3S on an azure VM and that AKS is not supported? Or does it mean the AKS nodes have to be Azure VMs? https://productresources.collibra.com/docs/collibra/latest/Content/Edge/EdgeSecurity/ta_integrate-edge-with-vault.htm
Eleftheria Makrydaki
·1 year ago · EditedBased on @celenemcfall 's answer.
I hope this helps, thank you!
Andrew Southcombe
OP1 year agoWe did actually get this working to migrate the same site from K3S to AKS. We have thousands of databases so we didn't want to waste time reloading them all from a new Edge site. We did the following to migrate from K3S to AKS (installed via helm chart).
There are two different backup commands provided, one for edge installed via edgecli and one for edge installed via helm. We ran the backup command provided (kubectl get -n <my-namespace> secrets -l edge.collibra.com/backup -o yaml > <PATH_OF_BACKUP_FILE>) which produced a backup file in the format expected for helm chart installations
We then uninstalled our K3S site and transferred out the backup file
We ran the re-installation process via helm chart on the following link applying the secrets file generated on K3s Reinstall an Edge site
We used managed identity auth for vault integration on K3s but couldn't get this working on AKS. So the final step was to run the edgecli vault command detailed on the following link and change the vault authentication method to sp-secret with a service principal and client secret Edit vault integration configuration via Edge CLI
Once we did this, our existing edge site and connections worked fine from AKS and the connections could access the secrets in the existing vault without any need to update them. We were able to resuming synchronising our existing DB assets from our existing DB connections
Alexandra Jorgenson
Admin1 year ago · EditedHi @andrewsouthcombe
There is no direct migration path from K3s to managed Kubernetes services like AKS, as they are two different deployment types. However, Vault integration has been successfully maintained using K3s-to-K3s backup and restore.
If you are interested in AKS, that is a totally new Edge site.
I am tagging @celenemcfall to the conversation if you have any further questions.
Andrew Southcombe
OP1 year agoThank you. I got some information from Collibra support that actually this should work if we assign our AKS cluster a managed identity and give this managed identity access to our key vault.