You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/aks/managed-aad.md
+3-27Lines changed: 3 additions & 27 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@ title: Use Azure AD in Azure Kubernetes Service
3
3
description: Learn how to use Azure AD in Azure Kubernetes Service (AKS)
4
4
services: container-service
5
5
ms.topic: article
6
-
ms.date: 02/1/2021
6
+
ms.date: 10/20/2021
7
7
ms.author: miwithro
8
8
---
9
9
@@ -26,7 +26,7 @@ Learn more about the Azure AD integration flow on the [Azure Active Directory in
26
26
27
27
## Prerequisites
28
28
29
-
* The Azure CLI version 2.11.0 or later
29
+
* The Azure CLI version 2.29.0 or later
30
30
* Kubectl with a minimum version of [1.18.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#v1181) or [kubelogin](https://github.com/Azure/kubelogin)
31
31
* If you are using [helm](https://github.com/helm/helm), minimum version of helm 3.3.
32
32
@@ -183,37 +183,13 @@ Update kubeconfig in order to access the cluster, follow the steps [here][access
183
183
184
184
There are some non-interactive scenarios, such as continuous integration pipelines, that aren't currently available with kubectl. You can use [`kubelogin`](https://github.com/Azure/kubelogin) to access the cluster with non-interactive service principal sign-in.
185
185
186
-
## Disable local accounts (preview)
186
+
## Disable local accounts
187
187
188
188
When deploying an AKS Cluster, local accounts are enabled by default. Even when enabling RBAC or Azure Active Directory integration, `--admin` access still exists, essentially as a non-auditable backdoor option. With this in mind, AKS offers users the ability to disable local accounts via a flag, `disable-local-accounts`. A field, `properties.disableLocalAccounts`, has also been added to the managed cluster API to indicate whether the feature has been enabled on the cluster.
189
189
190
190
> [!NOTE]
191
191
> On clusters with Azure AD integration enabled, users belonging to a group specified by `aad-admin-group-object-ids` will still be able to gain access via non-admin credentials. On clusters without Azure AD integration enabled and `properties.disableLocalAccounts` set to true, obtaining both user and admin credentials will fail.
192
192
193
-
### Register the `DisableLocalAccountsPreview` preview feature
194
-
195
-
[!INCLUDE [preview features callout](./includes/preview/preview-callout.md)]
196
-
197
-
To use an AKS cluster without local accounts, you must enable the `DisableLocalAccountsPreview` feature flag on your subscription. Ensure you are using the latest version of the Azure CLI and the `aks-preview` extension.
198
-
199
-
Register the `DisableLocalAccountsPreview` feature flag using the [az feature register][az-feature-register] command as shown in the following example:
200
-
201
-
```azurecli-interactive
202
-
az feature register --namespace "Microsoft.ContainerService" --name "DisableLocalAccountsPreview"
203
-
```
204
-
205
-
It takes a few minutes for the status to show *Registered*. You can check on the registration status using the [az feature list][az-feature-list] command:
206
-
207
-
```azurecli-interactive
208
-
az feature list -o table --query "[?contains(name, 'Microsoft.ContainerService/DisableLocalAccountsPreview')].{Name:name,State:properties.state}"
209
-
```
210
-
211
-
When ready, refresh the registration of the *Microsoft.ContainerService* resource provider using the [az provider register][az-provider-register] command:
212
-
213
-
```azurecli-interactive
214
-
az provider register --namespace Microsoft.ContainerService
215
-
```
216
-
217
193
### Create a new cluster without local accounts
218
194
219
195
To create a new AKS cluster without any local accounts, use the [az aks create][az-aks-create] command with the `disable-local-accounts` flag:
0 commit comments