Allow access to managed registries

eksctl utils associate-iam-oidc-provider \
--cluster <your-cluster> \
--approve

export CLUSTER_NAME="<your cluster name>"

eksctl create iamserviceaccount \
  --name plerion-collector-manager \
  --namespace plerion-system \
  --cluster "${CLUSTER_NAME}" \
  --attach-policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly \
  --approve \
  --override-existing-serviceaccounts

export RESOURCE_GROUP="<your resource group>" # replace it with your resource group name
export LOCATION="australiaeast" # replace it with the location of your cluster
export CLUSTER_NAME="<your cluster name>"
export SERVICE_ACCOUNT_NAMESPACE="default" # replace with your own value
export SERVICE_ACCOUNT_NAME="<service account name>" # replace with your own value
export AZURE_SUBSCRIPTION_ID="$(az account show --query id --output tsv)"
export AZURE_TENANT_ID="$(az account show --query tenantId --output tsv)"
export USER_ASSIGNED_IDENTITY_NAME="<your identity name>" # replace with your own value
export FEDERATED_IDENTITY_CREDENTIAL_NAME="<your own name>" # replace it with your own name
export ACR_NAME="<your acr name>" # replace it with your acr name

export AKS_OIDC_ISSUER=$(az aks show --name "${CLUSTER_NAME}" --resource-group "${RESOURCE_GROUP}" --query "oidcIssuerProfile.issuerUrl" --output tsv)

az identity create \
  --name "${USER_ASSIGNED_IDENTITY_NAME}" \
  --resource-group "${RESOURCE_GROUP}" \
  --location "${LOCATION}" \
  --subscription "${AZURE_SUBSCRIPTION_ID}"

export USER_ASSIGNED_CLIENT_ID="$(az identity show --resource-group "${RESOURCE_GROUP}" --name "${USER_ASSIGNED_IDENTITY_NAME}" --query 'clientId' --output tsv)"
export ACR_ID=$(az acr show --name ${ACR_NAME} --query id -o tsv)

az role assignment create --assignee ${USER_ASSIGNED_CLIENT_ID} --role 'AcrPull' --scope ${ACR_ID}

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    azure.workload.identity/client-id: "${USER_ASSIGNED_CLIENT_ID}"
    azure.workload.identity/tenant-id: "${AZURE_TENANT_ID}"
  name: "${SERVICE_ACCOUNT_NAME}"
  namespace: "${SERVICE_ACCOUNT_NAMESPACE}"
EOF

az identity federated-credential create \
 --name ${FEDERATED_IDENTITY_CREDENTIAL_NAME} \
 --identity-name "${USER_ASSIGNED_IDENTITY_NAME}" \
 --resource-group "${AZURE_RESOURCE_GROUP}" \
 --issuer "${AKS_OIDC_ISSUER}" \
 --subject system:serviceaccount:"${SERVICE_ACCOUNT_NAMESPACE}":"${SERVICE_ACCOUNT_NAME}" \
 --audience api://AzureADTokenExchange

helm upgrade plerion-collector-manager plerion/collector-manager --reuse-values \
  --namespace plerion-system \
  --set serviceAccount.annotations.'azure\.workload\.identity/client-id'=$USER_ASSIGNED_CLIENT_ID \
  --set serviceAccount.annotations.'azure\.workload\.identity/tenant-id'=$AZURE_TENANT_ID # Optional

helm upgrade plerion-collector-manager plerion/collector-manager --reuse-values \
  --namespace plerion-system \
  --set collector.azWorkloadIdentity=true

kubectl set serviceaccount deployment plerion-collector-manager $SERVICE_ACCOUNT_NAME