Skip to content

Commit 2d03d37

Browse files
v-shilsv-shils
authored
Merge pull request #235294 from schaffererin/managedaadrearchitecture
Rearchitect AKS-enabled Azure AD integration doc
2 parents 29778c7 + 9a9ddeb commit 2d03d37

16 files changed

+492
-418
lines changed

‎.openpublishing.redirection.json

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -965,6 +965,11 @@
965965
"redirect_url": "/azure/aks/workload-identity-migrate-from-pod-identity",
966966
"redirect_document_id": false
967967
},
968+
{
969+
"source_path_from_root": "/articles/aks/managed-aad.md",
970+
"redirect_url": "/azure/aks/managed-azure-ad",
971+
"redirect_document_id": false
972+
},
968973
{
969974
"source_path": "articles/germany/germany-developer-guide.md",
970975
"redirect_url": "/previous-versions/azure/germany/germany-developer-guide",

‎articles/aks/TOC.yml

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -325,7 +325,13 @@
325325
- name: Enable Azure Active Directory integration
326326
items:
327327
- name: AKS-managed Azure AD
328-
href: managed-aad.md
328+
items:
329+
- name: Enable AKS-managed Azure AD integration
330+
href: managed-azure-ad.md
331+
- name: Manage local accounts
332+
href: manage-local-accounts-managed-azure-ad.md
333+
- name: Cluster access control
334+
href: access-control-managed-azure-ad.md
329335
- name: Azure AD integration (legacy)
330336
href: azure-ad-integration-cli.md
331337
- name: Enable GMSA integration

‎articles/aks/access-control-managed-azure-ad.md

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
---
2+
title: Cluster access control with AKS-managed Azure Active Directory integration
3+
description: Learn how to access clusters when integrating Azure AD in your Azure Kubernetes Service (AKS) clusters.
4+
ms.topic: article
5+
ms.date: 04/20/2023
6+
ms.custom: devx-track-azurecli
7+
---
8+
9+
# Cluster access control with AKS-managed Azure Active Directory integration
10+
11+
When you integrate Azure AD with your AKS cluster, you can use [Conditional Access][aad-conditional-access] or Privileged Identity Management (PIM) for just-in-time requests to control access to your cluster. This article shows you how to enable Conditional Access and PIM on your AKS clusters.
12+
13+
> [!NOTE]
14+
> Azure AD Conditional Access and Privileged Identity Management are Azure AD Premium capabilities requiring a Premium P2 SKU. For more on Azure AD SKUs, see the [pricing guide][aad-pricing].
15+
16+
## Before you begin
17+
18+
* See [AKS-managed Azure Active Directory integration](./managed-azure-ad.md) for an overview and setup instructions.
19+
20+
## Use Conditional Access with Azure AD and AKS
21+
22+
1. In the Azure portal, go to the **Azure Active Directory** page and select **Enterprise applications**.
23+
2. Select **Conditional Access** > **Policies** > **New policy**.
24+
25+
:::image type="content" source="./media/managed-aad/conditional-access-new-policy.png" alt-text="Screenshot of adding a Conditional Access policy." lightbox="./media/managed-aad/conditional-access-new-policy.png":::
26+
27+
3. Enter a name for the policy, such as *aks-policy*.
28+
29+
4. Under **Assignments**, select **Users and groups**. Choose the users and groups you want to apply the policy to. In this example, choose the same Azure AD group that has administrator access to your cluster.
30+
31+
:::image type="content" source="./media/managed-aad/conditional-access-users-groups.png" alt-text="Screenshot of selecting users or groups to apply the Conditional Access policy." lightbox="./media/managed-aad/conditional-access-users-groups.png":::
32+
33+
5. Under **Cloud apps or actions** > **Include**, select **Select apps**. Search for **Azure Kubernetes Service** and select **Azure Kubernetes Service AAD Server**.
34+
35+
:::image type="content" source="./media/managed-aad/conditional-access-apps.png" alt-text="Screenshot of selecting Azure Kubernetes Service AD Server for applying the Conditional Access policy." lightbox="./media/managed-aad/conditional-access-apps.png":::
36+
37+
6. Under **Access controls** > **Grant**, select **Grant access**, **Require device to be marked as compliant**, and **Require all the selected controls**.
38+
39+
:::image type="content" source="./media/managed-aad/conditional-access-grant-compliant.png" alt-text="Screenshot of selecting to only allow compliant devices for the Conditional Access policy." lightbox="./media/managed-aad/conditional-access-grant-compliant.png" :::
40+
41+
7. Confirm your settings, set **Enable policy** to **On**, and then select **Create**.
42+
43+
:::image type="content" source="./media/managed-aad/conditional-access-enable-policy.png" alt-text="Screenshot of enabling the Conditional Access policy." lightbox="./media/managed-aad/conditional-access-enable-policy.png":::
44+
45+
### Verify your Conditional Access policy has been successfully listed
46+
47+
1. Get the user credentials to access the cluster using the [`az aks get-credentials`][az-aks-get-credentials] command.
48+
49+
```azurecli-interactive
50+
az aks get-credentials --resource-group myResourceGroup --name myManagedCluster
51+
```
52+
53+
2. Follow the instructions to sign in.
54+
55+
3. View the nodes in the cluster using the `kubectl get nodes` command.
56+
57+
```azurecli-interactive
58+
kubectl get nodes
59+
```
60+
61+
4. In the Azure portal, navigate to **Azure Active Directory** and select **Enterprise applications** > **Activity** > **Sign-ins**.
62+
63+
5. Under the **Conditional Access** column you should see a status of *Success*. Select the event and then select the **Conditional Access** tab. Your Conditional Access policy will be listed.
64+
65+
:::image type="content" source="./media/managed-aad/conditional-access-sign-in-activity.png" alt-text="Screenshot that shows failed sign-in entry due to Conditional Access policy." lightbox="./media/managed-aad/conditional-access-sign-in-activity.png":::
66+
67+
## Configure just-in-time cluster access with Azure AD and AKS
68+
69+
1. In the Azure portal, go to **Azure Active Directory** and select **Properties**.
70+
71+
2. Note the value listed under **Tenant ID**. It will be referenced in a later step as `<tenant-id>`.
72+
73+
:::image type="content" source="./media/managed-aad/jit-get-tenant-id.png" alt-text="Screenshot of the Azure portal screen for Azure Active Directory with the tenant's ID highlighted." lightbox="./media/managed-aad/jit-get-tenant-id.png":::
74+
75+
3. Select **Groups** > **New group**.
76+
77+
:::image type="content" source="./media/managed-aad/jit-create-new-group.png" alt-text="Screenshot of the Azure portal Active Directory groups screen with the New Group option highlighted." lightbox="./media/managed-aad/jit-create-new-group.png":::
78+
79+
4. Verify the group type **Security** is selected and specify a group name, such as *myJITGroup*. Under the option **Azure AD roles can be assigned to this group (Preview)**, select **Yes** and then select **Create**.
80+
81+
:::image type="content" source="./media/managed-aad/jit-new-group-created.png" alt-text="Screenshot of the new group creation screen in the Azure portal." lightbox="./media/managed-aad/jit-new-group-created.png":::
82+
83+
5. On the **Groups** page, select the group you just created and note the Object ID. It will be referenced in a later step as `<object-id>`.
84+
85+
:::image type="content" source="./media/managed-aad/jit-get-object-id.png" alt-text="Screenshot of the Azure portal screen for the just-created group with the Object ID highlighted." lightbox="./media/managed-aad/jit-get-object-id.png":::
86+
87+
6. Create the AKS cluster with AKS-managed Azure AD integration using the [`az aks create`][az-aks-create] command with the `--aad-admin-group-objects-ids` and `--aad-tenant-id parameters` and include the values noted in the steps earlier.
88+
89+
```azurecli-interactive
90+
az aks create -g myResourceGroup -n myManagedCluster --enable-aad --aad-admin-group-object-ids <object-id> --aad-tenant-id <tenant-id>
91+
```
92+
93+
7. In the Azure portal, select **Activity** > **Privileged Access (Preview)** > **Enable Privileged Access**.
94+
95+
:::image type="content" source="./media/managed-aad/jit-enabling-priv-access.png" alt-text="Screenshot of the Privileged access (Preview) page in the Azure portal with Enable privileged access highlighted." lightbox="./media/managed-aad/jit-enabling-priv-access.png":::
96+
97+
8. To grant access, select **Add assignments**.
98+
99+
:::image type="content" source="./media/managed-aad/jit-add-active-assignment.png" alt-text="Screenshot of the Privileged access (Preview) screen in the Azure portal after enabling. The option to Add assignments is highlighted." lightbox="./media/managed-aad/jit-add-active-assignment.png":::
100+
101+
9. From the **Select role** drop-down list, select the users and groups you want to grant cluster access. These assignments can be modified at any time by a group administrator. Then select **Next**.
102+
103+
:::image type="content" source="./media/managed-aad/jit-adding-assignment.png" alt-text="Screenshot of the Add assignments Membership screen in the Azure portal with a sample user selected to be added as a member. The Next option is highlighted." lightbox="./media/managed-aad/jit-adding-assignment.png":::
104+
105+
10. Under **Assignment type**, select **Active** and then specify the desired duration. Provide a justification and then select **Assign**.
106+
107+
:::image type="content" source="./media/managed-aad/jit-set-active-assignment-details.png" alt-text="Screenshot of the Add assignments Setting screen in the Azure portal. An assignment type of Active is selected and a sample justification has been given. The Assign option is highlighted." lightbox="./media/managed-aad/jit-set-active-assignment-details.png":::
108+
109+
For more information about assignment types, see [Assign eligibility for a privileged access group (preview) in Privileged Identity Management][aad-assignments].
110+
111+
### Verify just-in-time access is working by accessing the cluster
112+
113+
1. Get the user credentials to access the cluster using the [`az aks get-credentials`][az-aks-get-credentials] command.
114+
115+
```azurecli-interactive
116+
az aks get-credentials --resource-group myResourceGroup --name myManagedCluster
117+
```
118+
119+
2. Follow the steps to sign in.
120+
121+
3. Use the `kubectl get nodes` command to view the nodes in the cluster.
122+
123+
```azurecli-interactive
124+
kubectl get nodes
125+
```
126+
127+
4. Note the authentication requirement and follow the steps to authenticate. If successful, you should see an output similar to the following example output:
128+
129+
```output
130+
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code AAAAAAAAA to authenticate.
131+
NAME STATUS ROLES AGE VERSION
132+
aks-nodepool1-61156405-vmss000000 Ready agent 6m36s v1.18.14
133+
aks-nodepool1-61156405-vmss000001 Ready agent 6m42s v1.18.14
134+
aks-nodepool1-61156405-vmss000002 Ready agent 6m33s v1.18.14
135+
```
136+
137+
### Apply just-in-time access at the namespace level
138+
139+
1. Integrate your AKS cluster with [Azure RBAC](manage-azure-rbac.md).
140+
141+
2. Associate the group you want to integrate with just-in-time access with a namespace in the cluster using the [`az role assignment create`][az-role-assignment-create] command.
142+
143+
```azurecli-interactive
144+
az role assignment create --role "Azure Kubernetes Service RBAC Reader" --assignee <AAD-ENTITY-ID> --scope $AKS_ID/namespaces/<namespace-name>
145+
```
146+
147+
3. Associate the group you configured at the namespace level with PIM to complete the configuration.
148+
149+
## Troubleshooting
150+
151+
If `kubectl get nodes` returns an error similar to the following:
152+
153+
```output
154+
Error from server (Forbidden): nodes is forbidden: User "aaaa11111-11aa-aa11-a1a1-111111aaaaa" cannot list resource "nodes" in API group "" at the cluster scope
155+
```
156+
157+
Make sure the admin of the security group has given your account an *Active* assignment.
158+
159+
## Next steps
160+
161+
* Use [kubelogin](https://github.com/Azure/kubelogin) to access features for Azure authentication that aren't available in kubectl.
162+
163+
<!-- LINKS - External -->
164+
[aad-pricing]: https://azure.microsoft.com/pricing/details/active-directory/
165+
166+
<!-- LINKS - Internal -->
167+
[aad-conditional-access]: ../active-directory/conditional-access/overview.md
168+
[az-aks-get-credentials]: /cli/azure/aks#az_aks_get_credentials
169+
[az-role-assignment-create]: /cli/azure/role/assignment#az_role_assignment_create
170+
[aad-assignments]: ../active-directory/privileged-identity-management/groups-assign-member-owner.md#assign-an-owner-or-member-of-a-group
171+
[az-aks-create]: /cli/azure/aks#az_aks_create

‎articles/aks/azure-ad-integration-cli.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ ms.author: miwithro
1313
> [!WARNING]
1414
> **The feature described in this document, Azure AD Integration (legacy), will be deprecated on June 1st, 2023.
1515
>
16-
> AKS has a new improved [AKS-managed Azure AD][managed-aad] experience that doesn't require you to manage server or client application. If you want to migrate follow the instructions [here][managed-aad-migrate].
16+
> AKS has a new improved [AKS-managed Azure AD][managed-aad] experience that doesn't require you to manage server or client applications. If you want to migrate follow the instructions [here][managed-aad-migrate].
1717
1818
Azure Kubernetes Service (AKS) can be configured to use Azure Active Directory (AD) for user authentication. In this configuration, you can log into an AKS cluster using an Azure AD authentication token. Cluster operators can also configure Kubernetes role-based access control (Kubernetes RBAC) based on a user's identity or directory group membership.
1919

@@ -282,5 +282,5 @@ For best practices on identity and resource control, see [Best practices for aut
282282
[rbac-authorization]: concepts-identity.md#kubernetes-rbac
283283
[operator-best-practices-identity]: operator-best-practices-identity.md
284284
[azure-ad-rbac]: azure-ad-rbac.md
285-
[managed-aad]: managed-aad.md
286-
[managed-aad-migrate]: managed-aad.md#upgrade-to-aks-managed-azure-ad-integration
285+
[managed-aad]: managed-azure-ad.md
286+
[managed-aad-migrate]: managed-azure-ad.md#upgrade-a-legacy-azure-ad-cluster-to-aks-managed-azure-ad-integration

‎articles/aks/azure-ad-rbac.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -461,7 +461,7 @@ az ad group delete --group opssre
461461
<!-- LINKS - internal -->
462462
[az-aks-get-credentials]: /cli/azure/aks#az_aks_get_credentials
463463
[install-azure-cli]: /cli/azure/install-azure-cli
464-
[azure-ad-aks-cli]: managed-aad.md
464+
[azure-ad-aks-cli]: managed-azure-ad.md
465465
[az-aks-show]: /cli/azure/aks#az_aks_show
466466
[az-ad-group-create]: /cli/azure/ad/group#az_ad_group_create
467467
[az-role-assignment-create]: /cli/azure/role/assignment#az_role_assignment_create
@@ -471,4 +471,4 @@ az ad group delete --group opssre
471471
[rbac-authorization]: concepts-identity.md#kubernetes-rbac
472472
[operator-best-practices-identity]: operator-best-practices-identity.md
473473
[terraform-on-azure]: /azure/developer/terraform/overview
474-
[enable-azure-ad-integration-existing-cluster]: managed-aad.md#enable-aks-managed-azure-ad-integration-on-your-existing-cluster
474+
[enable-azure-ad-integration-existing-cluster]: managed-azure-ad.md#use-an-existing-cluster

‎articles/aks/concepts-identity.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@ As shown in the graphic above, the API server calls the AKS webhook server and p
162162
10. Once authorized, the API server returns a response to `kubectl`.
163163
11. `kubectl` provides feedback to the user.
164164

165-
Learn how to integrate AKS with Azure AD with our [AKS-managed Azure AD integration how-to guide](managed-aad.md).
165+
Learn how to integrate AKS with Azure AD with our [AKS-managed Azure AD integration how-to guide](managed-azure-ad.md).
166166

167167
## AKS service permissions
168168

@@ -282,7 +282,7 @@ For more information on core Kubernetes and AKS concepts, see the following arti
282282
[openid-connect]: ../active-directory/develop/v2-protocols-oidc.md
283283
[az-aks-get-credentials]: /cli/azure/aks#az_aks_get_credentials
284284
[azure-rbac]: ../role-based-access-control/overview.md
285-
[aks-aad]: managed-aad.md
285+
[aks-aad]: managed-azure-ad.md
286286
[aks-concepts-clusters-workloads]: concepts-clusters-workloads.md
287287
[aks-concepts-security]: concepts-security.md
288288
[aks-concepts-scale]: concepts-scale.md

‎articles/aks/concepts-security.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -158,7 +158,7 @@ For more information on core Kubernetes and AKS concepts, see:
158158
[microsoft-defender-for-containers]: ../defender-for-cloud/defender-for-containers-introduction.md
159159
[aks-daemonsets]: concepts-clusters-workloads.md#daemonsets
160160
[aks-upgrade-cluster]: upgrade-cluster.md
161-
[aks-aad]: ./managed-aad.md
161+
[aks-aad]: ./managed-azure-ad.md
162162
[aks-add-np-containerd]: learn/quick-windows-container-deploy-cli.md#add-a-windows-server-node-pool-with-containerd
163163
[aks-concepts-clusters-workloads]: concepts-clusters-workloads.md
164164
[aks-concepts-identity]: concepts-identity.md

‎articles/aks/intro-kubernetes.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,7 @@ Learn more about deploying and managing AKS.
170170
[concepts-identity]: concepts-identity.md
171171
[concepts-storage]: concepts-storage.md
172172
[conf-com-node]: ../confidential-computing/confidential-nodes-aks-overview.md
173-
[aad]: managed-aad.md
173+
[aad]: managed-azure-ad.md
174174
[aks-monitor]: monitor-aks.md
175175
[azure-monitor]: /previous-versions/azure/azure-monitor/containers/containers
176176
[azure-logs]: ../azure-monitor/logs/log-analytics-overview.md

‎articles/aks/kubernetes-portal.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ This section addresses common problems and troubleshooting steps.
7575
To access the Kubernetes resources, you must have access to the AKS cluster, the Kubernetes API, and the Kubernetes objects. Ensure that you're either a cluster administrator or a user with the appropriate permissions to access the AKS cluster. For more information on cluster security, see [Access and identity options for AKS][concepts-identity].
7676

7777
>[!NOTE]
78-
> The Kubernetes resource view in the Azure portal is only supported by [managed-AAD enabled clusters](managed-aad.md) or non-AAD enabled clusters. If you're using a managed-AAD enabled cluster, your AAD user or identity needs to have the respective roles/role bindings to access the Kubernetes API and the permission to pull the [user `kubeconfig`](control-kubeconfig-access.md).
78+
> The Kubernetes resource view in the Azure portal is only supported by [managed-AAD enabled clusters](managed-azure-ad.md) or non-AAD enabled clusters. If you're using a managed-AAD enabled cluster, your AAD user or identity needs to have the respective roles/role bindings to access the Kubernetes API and the permission to pull the [user `kubeconfig`](control-kubeconfig-access.md).
7979
8080
### Enable resource view
8181

@@ -119,6 +119,6 @@ This article showed you how to access Kubernetes resources from the Azure portal
119119
[concepts-identity]: concepts-identity.md
120120
[aks-quickstart-portal]: ./learn/quick-kubernetes-deploy-portal.md
121121
[deployments]: concepts-clusters-workloads.md#deployments-and-yaml-manifests
122-
[aks-managed-aad]: managed-aad.md
123-
[cli-aad-upgrade]: managed-aad.md#upgrade-to-aks-managed-azure-ad-integration
122+
[aks-managed-aad]: managed-azure-ad.md
123+
[cli-aad-upgrade]: managed-azure-ad.md#upgrade-a-legacy-azure-ad-cluster-to-aks-managed-azure-ad-integration
124124
[enable-monitor]: ../azure-monitor/containers/container-insights-enable-existing-clusters.md

0 commit comments

Comments
 (0)