Aad-pod-identity: Support for Azure Red Hat OpenShift (ARO)

[dudash]

Describe the request
It would be great to get this working with Microsoft's ARO offering.

Explain why AAD Pod Identity needs it
To support Microsoft's ARO offering

Describe the solution you'd like
Docs and YAML configs updated to include ARO

Describe alternatives you've considered
N/A

Additional context
I gave this a quick try in ARO and ran across a few challenges/recommendations:

1. NMI issue with iptables

I0717 22:11:31.337604       1 main.go:61] Starting nmi process. Version: 1.6.1. Build date: 2020-05-22-17:50.
I0717 22:11:31.487350       1 crd.go:447] CRD lite informers started 
I0717 22:11:31.587658       1 main.go:85] Running NMI in namespaced mode: false
I0717 22:11:31.587731       1 nmi.go:52] Initializing in standard mode
I0717 22:11:31.587744       1 probes.go:42] Initialized health probe on port 8080
I0717 22:11:31.587753       1 probes.go:45] Started health probe
I0717 22:11:31.587953       1 metrics.go:329] Registered views for metric
I0717 22:11:31.588158       1 prometheus_exporter.go:22] Starting Prometheus exporter
I0717 22:11:31.588198       1 metrics.go:336] Registered and exported metrics on port 9090
I0717 22:11:31.588218       1 server.go:97] Listening on port 2579
F0717 22:11:31.593129       1 server.go:108] running [/sbin/iptables -t nat -N aad-metadata --wait]: exit status 3: modprobe: can't change directory to '/lib/modules': No such file or directory
iptables v1.8.3 (legacy): can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.

1. MIC expects /etc/kubernetes/azure.json so we need to create a secret instead. It looks like this should work for ARO too, but not 100% sure if that's your recommended approach with ARO.

2. Use SCCs to allow host and network access as needed (vs pod security policy) - ARO can leverage OpenShift SCCs. You could create custom SCCs or use some of the built-in ones that ship with ARO like:

   • oc adm policy add-scc-to-user hostnetwork -z aad-pod-id-nmi-service-account
   • oc adm policy add-scc-to-user hostaccess -z aad-pod-id-mic-service-account

[phillipgibson]

@dudash let me look this over with the team and see how we can get this going.

[lgmorand]

@phillipgibson any news ? I've several customers interested by it

[phillipgibson]

This has to be coordinated with the RedHat team. Checking in with them. No ETA at the moment.