Repository navigation
PMP Key Vault updates - #12079
Merged
Merged
PMP Key Vault updates#12079
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Updated formatting for clarity in prerequisites section.
Nidhi251289
reviewed
Oct 26, 2026
|
|
||
| 1. Update the configuration to [use the service token](/developerportal/deploy/private-cloud-cluster/#advanced-deployment-settings). | ||
|
|
||
| Set `runtimeAutomountServiceAccountToken: true` to allow Mendix app pods to get a Kubernetes Service Account token. |
Contributor
There was a problem hiding this comment.
Did u checked with Shreyas for this option under Configuring Azure AD Workload Identity
Collaborator
Author
There was a problem hiding this comment.
@Shreyas0598 Could you take a look and verify that this part is correct?
Contributor
There was a problem hiding this comment.
@katarzyna-koltun-mx , @Nidhi251289 this was reported by ASML as a step they needed to do.
Shreyas0598
reviewed
Oct 29, 2026
Shreyas0598
reviewed
Oct 29, 2026
Shreyas0598
reviewed
Oct 29, 2026
| 5. Edit or create the target namespace and toggle **Enable Secret Store**. | ||
| 6. Select **Automatic (Azure Key Vault Only)** as the mode. | ||
|
|
||
| In automatic mode, if the environment uses an `azure-wi` storage or database plan, Mendix Operator creates the UAMI, including federated credentials, Secret Provider Class and ServiceAccount annotations during environment provisioning. Automatic mode is required for Azure Key Vault integration. Manual mode can be used to configure secret stores other than Azure Key Vault. |
Contributor
There was a problem hiding this comment.
Manual mode supports azure key vault, aws secrets manager and hashicorp vault.
Automatic mode only supports azure key vault.
It is not that the customer cannot use azure key vault when using manual mode.
Shreyas0598
reviewed
Oct 29, 2026
Shreyas0598
left a comment
Shreyas0598
left a comment
Contributor
There was a problem hiding this comment.
Added comments @katarzyna-koltun-mx kindly have a look
Clarified that other cluster types are supported for different purposes but do not support Azure Key Vault integration.
Clarified options for secret store mode selection, detailing automatic and manual modes for Azure Key Vault integration.
| * Database and blob storage connection secrets are not supported through this automatic flow. You must provision them manually. For more information, refer to the general Secret Store documentation. | ||
| * Azure-wi storage and database plans are not compatible with Interactor-Agent deployments that also use the external secret store. The `azure.workload.identity/client-id` annotation on the ServiceAccount can only hold one value at a time, and the Operator may overwrite it. This feature is supported only in Standalone mode. | ||
| * An environment can use either a `SecretProviderClass` or a regular Kubernetes Secret for its configuration, never both at the same time. | ||
| * Secret store cannot be enabled for the following custom properties: |
Collaborator
Author
There was a problem hiding this comment.
@Nidhi251289 @Shreyas0598 added as requested today.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.