Improvement #655 (#656)

Co-authored-by: Mark Chmarny <mchmarny@users.noreply.github.com>
Co-authored-by: Aman Bhardwaj <amanbha@users.noreply.github.com>
Co-authored-by: Yaron Schneider <yaronsc@microsoft.com>

howto/setup-secret-store/azure-keyvault-managed-identity.md

@@ -4,10 +4,12 @@ This document shows how to enable Azure Key Vault secret store using [Dapr Secre
 
 ## Contents
 
-- [Prerequisites](#prerequisites)
-- [Setup Kubernetes to use managed identities and Azure Key Vault](#setup-kubernetes-to-use-managed-identities-and-azure-key-vault)
-- [Use Azure Key Vault secret store in Kubernetes mode with managed identities](#use-azure-key-vault-secret-store-in-kubernetes-mode-with-managed-identities)
-- [References](#references)
+- [Use Azure Key Vault secret store in Kubernetes mode using Managed Identities](#use-azure-key-vault-secret-store-in-kubernetes-mode-using-managed-identities)
+  - [Contents](#contents)
+  - [Prerequisites](#prerequisites)
+  - [Setup Kubernetes to use Managed identities and Azure Key Vault](#setup-kubernetes-to-use-managed-identities-and-azure-key-vault)
+  - [Use Azure Key Vault secret store in Kubernetes mode with managed identities](#use-azure-key-vault-secret-store-in-kubernetes-mode-with-managed-identities)
+  - [References](#references)
 
 ## Prerequisites
 
@@ -32,39 +34,68 @@ This document shows how to enable Azure Key Vault secret store using [Dapr Secre
     az keyvault create --location [region] --name [your keyvault] --resource-group [your resource group]
     ```
 
-3. Create the managed identity
+3. Create the managed identity(Optional)
+   
+    This step is required only if the AKS Cluster is provisoned without the flag "--enable-managed-identity". If the cluster is provisioned with manahed identity, than is suggested to use the autogenerated managed identity that is associated to the Resource Group MC_*.
 
     ```bash
     $identity = az identity create -g [your resource group] -n [you managed identity name] -o json | ConvertFrom-Json
     ```
 
-4. Assign the Reader role to the managed identity
+    Below the command to retrieve the managed identity in the autogenerated scenario:
+
+      ```bash
+      az aks show -g <AKSResourceGroup> -n <AKSClusterName>
+      ```
+    For more detail about the roles to assign to integrate AKS with Azure Services [Role Assignment](https://github.com/Azure/aad-pod-identity/blob/master/docs/readmes/README.role-assignment.md).
+
+4.  Retrieve Managed Identity ID
+  
+    The two main scenario are:
+    - Service Principal, in this case the Resource Group is the one in which is deployed the AKS Service Cluster
 
     ```bash
-    az role assignment create --role "Reader" --assignee $identity.principalId --scope /subscriptions/[your subscription id]/resourcegroups/[your resource group]
+    $clientId= az aks show -g <AKSResourceGroup> -n <AKSClusterName> --query servicePrincipalProfile.clientId -otsv
     ```
 
-5. Assign the Managed Identity Operator role to the AKS Service Principal
+    - Managed Identity, in this case the Resource Group is the one in which is deployed the AKS Service Cluster
 
     ```bash
-    $aks = az aks show  -g [your resource group]  -n [your AKS name] -o json | ConvertFrom-Json
-
-    az role assignment create  --role "Managed Identity Operator"  --assignee $aks.servicePrincipalProfile.clientId  --scope $identity.id
+    $clientId= az aks show -g <AKSResourceGroup> -n <AKSClusterName> --query identityProfile.kubeletidentity.clientId -otsv
     ```
-
-6. Add a policy to the Key Vault so the managed identity can read secrets
+   
+5. Assign the Reader role to the managed identity
+  
+    For AKS cluster, the cluster resource group refers to the resource group with a MC_ prefix, which contains all of the infrastructure resources associated with the cluster like VM/VMSS.
 
     ```bash
-    az keyvault set-policy --name [your keyvault] --spn $identity.clientId --secret-permissions get list
+    az role assignment create --role "Reader" --assignee $clientId --scope /subscriptions/[your subscription id]/resourcegroups/[your resource group]
     ```
 
-7. Enable AAD Pod Identity on AKS
+6. Assign the Managed Identity Operator role to the AKS Service Principal
+  Refer to previous step about the Resource Group to use and which identity to assign
+    ```bash
+    az role assignment create  --role "Managed Identity Operator"  --assignee $clientId  --scope /subscriptions/[your subscription id]/resourcegroups/[your resource group]
+
+    az role assignment create  --role "Virtual Machine Contributor"  --assignee $clientId  --scope /subscriptions/[your subscription id]/resourcegroups/[your resource group]
+    ```
+
+7. Add a policy to the Key Vault so the managed identity can read secrets
+
+    ```bash
+    az keyvault set-policy --name [your keyvault] --spn $clientId --secret-permissions get list
+    ```
+
+8. Enable AAD Pod Identity on AKS
 
     ```bash
     kubectl apply -f https://raw.githubusercontent.com/Azure/aad-pod-identity/master/deploy/infra/deployment-rbac.yaml
+    
+    # For AKS clusters, deploy the MIC and AKS add-on exception by running -
+    kubectl apply -f https://raw.githubusercontent.com/Azure/aad-pod-identity/master/deploy/infra/mic-exception.yaml
     ```
 
-8. Configure the Azure Identity and AzureIdentityBinding yaml
+9. Configure the Azure Identity and AzureIdentityBinding yaml
 
     Save the following yaml as azure-identity-config.yaml:
 
@@ -87,7 +118,7 @@ This document shows how to enable Azure Key Vault secret store using [Dapr Secre
       Selector: [you managed identity selector]
     ```
 
-9. Deploy the azure-identity-config.yaml:
+10. Deploy the azure-identity-config.yaml:
 
     ```yaml
     kubectl apply -f azure-identity-config.yaml