Skip to content

Commit 7733534

Browse files
authored
Update managed-aad.md
1 parent 31d1d08 commit 7733534

File tree

1 file changed

+3
-27
lines changed

1 file changed

+3
-27
lines changed

articles/aks/managed-aad.md

Lines changed: 3 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Use Azure AD in Azure Kubernetes Service
33
description: Learn how to use Azure AD in Azure Kubernetes Service (AKS)
44
services: container-service
55
ms.topic: article
6-
ms.date: 02/1/2021
6+
ms.date: 10/20/2021
77
ms.author: miwithro
88
---
99

@@ -26,7 +26,7 @@ Learn more about the Azure AD integration flow on the [Azure Active Directory in
2626

2727
## Prerequisites
2828

29-
* The Azure CLI version 2.11.0 or later
29+
* The Azure CLI version 2.29.0 or later
3030
* Kubectl with a minimum version of [1.18.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#v1181) or [kubelogin](https://github.com/Azure/kubelogin)
3131
* If you are using [helm](https://github.com/helm/helm), minimum version of helm 3.3.
3232

@@ -183,37 +183,13 @@ Update kubeconfig in order to access the cluster, follow the steps [here][access
183183

184184
There are some non-interactive scenarios, such as continuous integration pipelines, that aren't currently available with kubectl. You can use [`kubelogin`](https://github.com/Azure/kubelogin) to access the cluster with non-interactive service principal sign-in.
185185

186-
## Disable local accounts (preview)
186+
## Disable local accounts
187187

188188
When deploying an AKS Cluster, local accounts are enabled by default. Even when enabling RBAC or Azure Active Directory integration, `--admin` access still exists, essentially as a non-auditable backdoor option. With this in mind, AKS offers users the ability to disable local accounts via a flag, `disable-local-accounts`. A field, `properties.disableLocalAccounts`, has also been added to the managed cluster API to indicate whether the feature has been enabled on the cluster.
189189

190190
> [!NOTE]
191191
> On clusters with Azure AD integration enabled, users belonging to a group specified by `aad-admin-group-object-ids` will still be able to gain access via non-admin credentials. On clusters without Azure AD integration enabled and `properties.disableLocalAccounts` set to true, obtaining both user and admin credentials will fail.
192192
193-
### Register the `DisableLocalAccountsPreview` preview feature
194-
195-
[!INCLUDE [preview features callout](./includes/preview/preview-callout.md)]
196-
197-
To use an AKS cluster without local accounts, you must enable the `DisableLocalAccountsPreview` feature flag on your subscription. Ensure you are using the latest version of the Azure CLI and the `aks-preview` extension.
198-
199-
Register the `DisableLocalAccountsPreview` feature flag using the [az feature register][az-feature-register] command as shown in the following example:
200-
201-
```azurecli-interactive
202-
az feature register --namespace "Microsoft.ContainerService" --name "DisableLocalAccountsPreview"
203-
```
204-
205-
It takes a few minutes for the status to show *Registered*. You can check on the registration status using the [az feature list][az-feature-list] command:
206-
207-
```azurecli-interactive
208-
az feature list -o table --query "[?contains(name, 'Microsoft.ContainerService/DisableLocalAccountsPreview')].{Name:name,State:properties.state}"
209-
```
210-
211-
When ready, refresh the registration of the *Microsoft.ContainerService* resource provider using the [az provider register][az-provider-register] command:
212-
213-
```azurecli-interactive
214-
az provider register --namespace Microsoft.ContainerService
215-
```
216-
217193
### Create a new cluster without local accounts
218194

219195
To create a new AKS cluster without any local accounts, use the [az aks create][az-aks-create] command with the `disable-local-accounts` flag:

0 commit comments

Comments
 (0)