You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Use Azure RBAC for Kubernetes Authorization
3
3
titleSuffix: Azure Kubernetes Service
4
-
description: Learn how to use Azure RBAC for Kubernetes Authorization with Azure Kubernetes Service (AKS).
4
+
description: Learn how to use Azure role-based access control (Azure RBAC) for Kubernetes Authorization with Azure Kubernetes Service (AKS).
5
5
ms.topic: article
6
-
ms.date: 02/09/2021
6
+
ms.date: 03/02/2023
7
7
ms.author: jpalma
8
8
author: palma21
9
9
10
10
#Customer intent: As a cluster operator or developer, I want to learn how to leverage Azure RBAC permissions to authorize actions within the AKS cluster.
11
11
---
12
12
13
-
# Use Azure RBAC for Kubernetes Authorization
13
+
# Use Azure role-based access control for Kubernetes Authorization
14
14
15
-
Today you can already leverage [integrated authentication between Azure Active Directory (Azure AD) and AKS](managed-aad.md). When enabled, this integration allows customers to use Azure AD users, groups, or service principals as subjects in Kubernetes RBAC, see more [here](azure-ad-rbac.md).
16
-
This feature frees you from having to separately manage user identities and credentials for Kubernetes. However, you still have to set up and manage Azure RBAC and Kubernetes RBAC separately. For more details on authentication and authorization with RBAC on AKS, see [here](concepts-identity.md).
15
+
When you leverage [integrated authentication between Azure Active Directory (Azure AD) and AKS](managed-aad.md), you can use Azure AD users, groups, or service principals as subjects in [Kubernetes role-based access control (Kubernetes RBAC)][kubernetes-rbac]. This feature frees you from having to separately manage user identities and credentials for Kubernetes. However, you still have to set up and manage Azure RBAC and Kubernetes RBAC separately.
17
16
18
-
This document covers a new approach that allows for the unified management and access control across Azure Resources, AKS, and Kubernetes resources.
17
+
This article covers how to use Azure RBAC for Kubernetes Authorization, which allows for the unified management and access control across Azure resources, AKS, and Kubernetes resources. For more information, see [Azure RBAC for Kubernetes Authorization][azure-rbac-kubernetes-rbac].
19
18
20
19
## Before you begin
21
20
22
-
The ability to manage RBAC for Kubernetes resources from Azure gives you the choice to manage RBAC for the cluster resources either using Azure or native Kubernetes mechanisms. When enabled, Azure AD principals will be validated exclusively by Azure RBAC while regular Kubernetes users and service accounts are exclusively validated by Kubernetes RBAC. For more details on authentication and authorization with RBAC on AKS, see [here](concepts-identity.md#azure-rbac-for-kubernetes-authorization).
21
+
* You need the Azure CLI version 2.24.0 or later installed and configured. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].
22
+
* You need `kubectl`, with a minimum version of [1.18.3](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#v1183).
23
+
* You need managed Azure AD integration enabled on your cluster before you can add Azure RBAC for Kubernetes authorization. If you need to enable managed Azure AD integration, see [Use Azure AD in AKS](managed-aad.md).
24
+
* If you have CRDs and are making custom role definitions, the only way to cover CRDs today is to use `Microsoft.ContainerService/managedClusters/*/read`. For the remaining objects, you can use the specific API groups, such as `Microsoft.ContainerService/apps/deployments/read`.
25
+
* New role assignments can take up to five minutes to propagate and be updated by the authorization server.
26
+
* This article requires that the Azure AD tenant configured for authentication is same as the tenant for the subscription that holds your AKS cluster.
23
27
24
-
### Prerequisites
28
+
##Create a new AKS cluster with managed Azure AD integration and Azure RBAC for Kubernetes Authorization
25
29
26
-
- Ensure you have the Azure CLI version 2.24.0 or later
27
-
- Ensure you have installed [kubectl v1.18.3+][az-aks-install-cli].
28
-
29
-
### Limitations
30
-
31
-
- Requires [Managed Azure AD integration](managed-aad.md).
32
-
- Use [kubectl v1.18.3+][az-aks-install-cli].
33
-
- If you have CRDs and are making custom role definitions, the only way to cover CRDs today is to provide `Microsoft.ContainerService/managedClusters/*/read`. AKS is working on providing more granular permissions for CRDs. For the remaining objects you can use the specific API Groups, for example: `Microsoft.ContainerService/apps/deployments/read`.
34
-
- New role assignments can take up to 5min to propagate and be updated by the authorization server.
35
-
- Requires the Azure AD tenant configured for authentication to be the same as the tenant for the subscription that holds the AKS cluster.
36
-
37
-
## Create a new cluster using Azure RBAC and managed Azure AD integration
38
-
39
-
Create an AKS cluster by using the following CLI commands.
40
-
41
-
Create an Azure resource group:
30
+
Create an Azure resource group using the [`az group create`][az-group-create] command.
42
31
43
32
```azurecli-interactive
44
-
# Create an Azure resource group
45
33
az group create --name myResourceGroup --location westus2
46
34
```
47
35
48
-
Create the AKS cluster with managed Azure AD integration and Azure RBAC for Kubernetes Authorization.
36
+
Create an AKS cluster with managed Azure AD integration and Azure RBAC for Kubernetes Authorization using the [`az aks create`][az-aks-create] command.
49
37
50
38
```azurecli-interactive
51
-
# Create an AKS-managed Azure AD cluster
52
-
az aks create -g MyResourceGroup -n MyManagedCluster --enable-aad --enable-azure-rbac
39
+
az aks create -g myResourceGroup -n myManagedCluster --enable-aad --enable-azure-rbac
53
40
```
54
41
55
-
A successful creation of a cluster with Azure AD integration and Azure RBAC for Kubernetes Authorization has the following section in the response body:
42
+
The output will look similar to the following example output:
56
43
57
44
```json
58
45
"AADProfile": {
@@ -63,68 +50,62 @@ A successful creation of a cluster with Azure AD integration and Azure RBAC for
63
50
"serverAppId": null,
64
51
"serverAppSecret": null,
65
52
"tenantId": "****-****-****-****-****"
66
-
}
53
+
}
67
54
```
68
55
69
-
## Integrate Azure RBAC into an existing cluster
56
+
## Enable Azure RBAC on an existing AKS cluster
70
57
71
-
> [!NOTE]
72
-
> To use Azure RBAC for Kubernetes Authorization, Azure Active Directory integration must be enabled on your cluster. For more, see [Azure Active Directory integration][managed-aad].
73
-
74
-
To add Azure RBAC for Kubernetes Authorization into an existing AKS cluster, use the [az aks update][az-aks-update] command with the flag `enable-azure-rbac`.
58
+
Add Azure RBAC for Kubernetes Authorization into an existing AKS cluster using the [`az aks update`][az-aks-update] command with the `enable-azure-rbac` flag.
75
59
76
60
```azurecli-interactive
77
61
az aks update -g myResourceGroup -n myAKSCluster --enable-azure-rbac
78
62
```
79
-
To remove Azure RBAC for Kubernetes Authorization from an existing AKS cluster, use the [az aks update][az-aks-update] command with the flag `disable-azure-rbac`.
63
+
64
+
## Disable Azure RBAC for Kubernetes Authorization from an AKS cluster
65
+
66
+
Remove Azure RBAC for Kubernetes Authorization from an existing AKS cluster using the [`az aks update`][az-aks-update] command with the `disable-azure-rbac` flag.
80
67
81
68
```azurecli-interactive
82
69
az aks update -g myResourceGroup -n myAKSCluster --disable-azure-rbac
83
70
```
84
71
85
-
## Create role assignments for users to access cluster
86
-
87
-
AKS provides the following four built-in roles:
72
+
## Create role assignments for users to access the cluster
| Azure Kubernetes Service RBAC Reader | Allows read-only access to see most objects in a namespace. It doesn't allow viewing roles or role bindings. This role doesn't allow viewing `Secrets`, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation) |
93
-
| Azure Kubernetes Service RBAC Writer | Allows read/write access to most objects in a namespace. This role doesn't allow viewing or modifying roles or role bindings. However, this role allows accessing `Secrets` and running Pods as any ServiceAccount in the namespace, so it can be used to gain the API access levels of any ServiceAccount in the namespace. |
78
+
| Azure Kubernetes Service RBAC Reader | Allows read-only access to see most objects in a namespace. It doesn't allow viewing roles or role bindings. This role doesn't allow viewing `Secrets`, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation).|
79
+
| Azure Kubernetes Service RBAC Writer | Allows read/write access to most objects in a namespace. This role doesn't allow viewing or modifying roles or role bindings. However, this role allows accessing `Secrets` and running Pods as any ServiceAccount in the namespace, so it can be used to gain the API access levels of any ServiceAccount in the namespace. |
94
80
| Azure Kubernetes Service RBAC Admin | Allows admin access, intended to be granted within a namespace. Allows read/write access to most resources in a namespace (or cluster scope), including the ability to create roles and role bindings within the namespace. This role doesn't allow write access to resource quota or to the namespace itself. |
95
81
| Azure Kubernetes Service RBAC Cluster Admin | Allows super-user access to perform any action on any resource. It gives full control over every resource in the cluster and in all namespaces. |
96
82
83
+
Roles assignments scoped to the **entire AKS cluster** can be done either on the Access Control (IAM) blade of the cluster resource on Azure portal or by using the following Azure CLI commands:
97
84
98
-
Roles assignments scoped to the **entire AKS cluster** can be done either on the Access Control (IAM) blade of the cluster resource on Azure portal or by using Azure CLI commands as shown below:
85
+
Get your AKS resource ID using the [`az aks show`][az-aks-show] command.
99
86
100
87
```azurecli
101
-
# Get your AKS Resource ID
102
-
AKS_ID=$(az aks show -g MyResourceGroup -n MyManagedCluster --query id -o tsv)
88
+
AKS_ID=$(az aks show -g myResourceGroup -n myManagedCluster --query id -o tsv)
103
89
```
104
90
105
-
```azurecli-interactive
106
-
az role assignment create --role "Azure Kubernetes Service RBAC Admin" --assignee <AAD-ENTITY-ID> --scope $AKS_ID
107
-
```
108
-
109
-
where `<AAD-ENTITY-ID>` could be a username (for example, [email protected]) or even the ClientID of a service principal.
110
-
111
-
You can also create role assignments scoped to a specific **namespace** within the cluster:
91
+
Create a role assignment using the [`az role assignment create`][az-role-assignment-create] command. `<AAD-ENTITY-ID>` can be a username or the client ID of a service principal.
112
92
113
93
```azurecli-interactive
114
-
az role assignment create --role "Azure Kubernetes Service RBAC Reader" --assignee <AAD-ENTITY-ID> --scope $AKS_ID/namespaces/<namespace-name>
94
+
az role assignment create --role "Azure Kubernetes Service RBAC Admin" --assignee <AAD-ENTITY-ID> --scope $AKS_ID
115
95
```
116
96
117
-
Today, role assignments scoped to namespaces need to be configured via Azure CLI.
118
-
119
-
120
-
### Create custom roles definitions
121
-
122
-
Optionally you may choose to create your own role definition and then assign as above.
97
+
> [!NOTE]
98
+
> You can create the *Azure Kubernetes Service RBAC Reader* and *Azure Kubernetes Service RBAC Writer* role assignments scoped to a specific namespace within the cluster using the [`az role assignment create`][az-role-assignment-create] command and setting the scope to the desired namespace.
99
+
>
100
+
> ```azurecli-interactive
101
+
> az role assignment create --role "Azure Kubernetes Service RBAC Reader" --assignee <AAD-ENTITY-ID> --scope $AKS_ID/namespaces/<namespace-name>
102
+
> ```
123
103
124
-
Below is an example of a role definition that allows a user to only read deployments and nothing else. You can check the full list of possible actions [here](../role-based-access-control/resource-provider-operations.md#microsoftcontainerservice).
104
+
## Create custom roles definitions
125
105
106
+
The following example custom role definition allows a user to only read deployments and nothing else. For the full list of possible actions, see [Microsoft.ContainerService operations](../role-based-access-control/resource-provider-operations.md#microsoftcontainerservice).
126
107
127
-
Copy the below json into a file called`deploy-view.json`.
108
+
To create your own custom role definitions, copy the following file, replacing `<YOUR SUBSCRIPTION ID>` with your own subscription ID, and then save it as `deploy-view.json`.
128
109
129
110
```json
130
111
{
@@ -142,47 +123,27 @@ Copy the below json into a file called `deploy-view.json`.
142
123
}
143
124
```
144
125
145
-
Replace `<YOUR SUBSCRIPTION ID>` by the ID from your subscription, which you can get by running:
146
-
147
-
```azurecli-interactive
148
-
az account show --query id -o tsv
149
-
```
150
-
151
-
Now we can create the role definition by running the below command from the folder where you saved `deploy-view.json`:
126
+
Create the role definition using the [`az role definition create`][az-role-definition-create] command, setting the `--role-definition` to the `deploy-view.json` file you created in the previous step.
152
127
153
128
```azurecli-interactive
154
129
az role definition create --role-definition @deploy-view.json
155
130
```
156
131
157
-
Now that you have your role definition, you can assign it to a user or other identity by running:
132
+
Assign the role definitionto a user or other identity using the [`az role assignment create`][az-role-assignment-create] command.
158
133
159
134
```azurecli-interactive
160
135
az role assignment create --role "AKS Deployment Reader" --assignee <AAD-ENTITY-ID> --scope $AKS_ID
161
136
```
162
137
163
138
## Use Azure RBAC for Kubernetes Authorization with `kubectl`
164
139
165
-
> [!NOTE]
166
-
> Ensure you have the latest kubectl by running the below command:
167
-
>
168
-
> ```azurecli-interactive
169
-
> az aks install-cli
170
-
> ```
171
-
>
172
-
> You might need to run it with `sudo` privileges.
173
-
174
-
Now that you have assigned your desired role and permissions. You can start calling the Kubernetes API, for example, from `kubectl`.
175
-
176
-
For this purpose, let's first get the cluster's kubeconfig using the below command:
140
+
Make sure you have the [Azure Kubernetes Service Cluster User](../role-based-access-control/built-in-roles.md#azure-kubernetes-service-cluster-user-role) built-in role, and then get the kubeconfig of your AKS cluster using the [`az aks get-credentials`][az-aks-get-credentials] command.
177
141
178
142
```azurecli-interactive
179
-
az aks get-credentials -g MyResourceGroup -n MyManagedCluster
143
+
az aks get-credentials -g myResourceGroup -n myManagedCluster
180
144
```
181
145
182
-
> [!IMPORTANT]
183
-
> You'll need the [Azure Kubernetes Service Cluster User](../role-based-access-control/built-in-roles.md#azure-kubernetes-service-cluster-user-role) built-in role to perform the step above.
184
-
185
-
Now, you can use kubectl to, for example, list the nodes in the cluster. The first time you run it you'll need to sign in, and subsequent commands will use the respective access token.
146
+
Now, you can use `kubectl` manage your cluster. For example, you can list the nodes in your cluster using `kubectl get nodes`. The first time you run it, you'll need to sign in, as shown in the following example:
## Use Azure RBAC for Kubernetes Authorization with `kubelogin`
199
159
200
-
To unblock additional scenarios like non-interactive logins, older `kubectl` versions or leveraging SSO across multiple clusters without the need to sign in to new cluster, granted that your token is still valid, AKS created an exec plugin called [`kubelogin`](https://github.com/Azure/kubelogin).
160
+
AKS created the [`kubelogin`](https://github.com/Azure/kubelogin) plugin to help unblock additional scenarios, such as non-interactive logins, older `kubectl` versions, or leveraging SSO across multiple clusters without the need to sign in to a new cluster.
201
161
202
-
You can use it by running:
162
+
You can use the `kubelogin` plugin by running the following command:
203
163
204
164
```bash
205
165
export KUBECONFIG=/path/to/kubeconfig
206
166
kubelogin convert-kubeconfig
207
-
```
167
+
```
208
168
209
-
The first time, you'll have to sign in interactively like with regular kubectl, but afterwards you'll no longer need to, even for new Azure AD clusters (as long as your token is still valid).
169
+
Similar to `kubectl`, you need to log in the first time you run it, as shown in the following example:
az role assignment list --scope $AKS_ID --query [].id -o tsv
227
-
```
228
188
229
-
Copy the ID or IDs from all the assignments you did and then.
230
-
231
-
```azurecli-interactive
189
+
# Delete role assignments
232
190
az role assignment delete --ids <LIST OF ASSIGNMENT IDS>
233
191
```
234
192
235
-
### Clean up role definition
193
+
### Delete role definition
236
194
237
195
```azurecli-interactive
238
196
az role definition delete -n "AKS Deployment Reader"
239
197
```
240
198
241
-
### Delete cluster and resource group
199
+
### Delete resource group and AKS cluster
242
200
243
201
```azurecli-interactive
244
-
az group delete -n MyResourceGroup
202
+
az group delete -n myResourceGroup
245
203
```
246
204
247
205
## Next steps
248
206
249
-
- Read more about AKS Authentication, Authorization, Kubernetes RBAC, and Azure RBAC [here](concepts-identity.md).
250
-
- Read more about Azure RBAC [here](../role-based-access-control/overview.md).
251
-
- Read more about the all the actions you can use to granularly define custom Azure roles for Kubernetes authorization [here](../role-based-access-control/resource-provider-operations.md#microsoftcontainerservice).
207
+
To learn more about AKS authentication, authorization, Kubernetes RBAC, and Azure RBAC, see:
252
208
209
+
*[Access and identity options for AKS](/concepts-identity.md)
210
+
*[What is Azure RBAC?](../role-based-access-control/overview.md)
0 commit comments