Provision the Managed Identity
You can create the identity four ways. In the e6data setup wizard, choose Microsoft Azure, then a deployment method:Manual steps (Azure Portal)
- Create a User-Assigned Managed Identity - Managed Identities → + Create (subscription, resource group, name, region) → Review + Create.
- Add a federated credential - on the identity, Federated credentials → + Add → scenario Kubernetes accessing Azure resources → enter the Cluster Issuer URL, Namespace, and Service Account (provided by e6data) → Add.
- Assign RBAC - on the storage account, Access control (IAM) → + Add role assignment → Storage Blob Data Reader → principal type Managed Identity → select the identity → Review + Assign.
- Retrieve identity info - from the identity’s Overview, note the Client ID and Tenant ID.
Once you register the identity (next section), e6data deploys a pod in its managed Serverless subscription that uses the federated credential to read your storage. Because access is keyless and federated, no secret ever leaves your tenant.
Register the Storage Credential
A Storage Credential is a reusable, keyless connection you create once and reuse across catalogs.- In the Compute Plane, go to Settings → Storage Credentials and select + New Credential.
- Enter a Name (for example,
azure-shared-cred) and optional description. - Enter the Tenant ID and Client ID (and optionally the storage account name). Leave Client Secret empty - access is keyless.
- Select Create. The credential shows Connected.
See also
- Connect ADLS and a catalog - use this credential in a catalog.
- Troubleshooting - identity and access errors.