You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-arc/kubernetes/cluster-connect.md
+12-12Lines changed: 12 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -91,34 +91,34 @@ On the existing Arc-enabled cluster, create the ClusterRoleBinding with either M
91
91
- For a Microsoft Entra group account:
92
92
93
93
```azurecli
94
-
AAD_ENTITY_OBJECT_ID=$(az ad signed-in-user show --query id -o tsv)
94
+
AAD_ENTITY_ID=$(az ad signed-in-user show --query id -o tsv)
95
95
```
96
96
97
97
- For a Microsoft Entra single user account:
98
98
99
99
```azurecli
100
-
AAD_ENTITY_OBJECT_ID=$(az ad signed-in-user show --query userPrincipalName -o tsv)
100
+
AAD_ENTITY_ID=$(az ad signed-in-user show --query userPrincipalName -o tsv)
101
101
```
102
102
103
103
- For a Microsoft Entra application:
104
104
105
105
```azurecli
106
-
AAD_ENTITY_OBJECT_ID=$(az ad sp show --id <id> --query id -o tsv)
106
+
AAD_ENTITY_ID=$(az ad sp show --id <id> --query id -o tsv)
107
107
```
108
108
109
109
1. Authorize the entity with appropriate permissions.
110
110
111
111
- If you're using Kubernetes native ClusterRoleBinding or RoleBinding for authorization checks on the cluster, with the `kubeconfig` file pointing to the `apiserver` of your cluster for direct access, you can create one mapped to the Microsoft Entra entity (service principal or user) that needs to access this cluster. For example:
- If you're using Azure RBAC for authorization checks on the cluster, you can create an applicable [Azure role assignment](azure-rbac.md#built-in-roles) mapped to the Microsoft Entra entity. For example:
118
118
119
119
```azurecli
120
-
az role assignment create --role "Azure Arc Kubernetes Viewer" --assignee $AAD_ENTITY_OBJECT_ID --scope $ARM_ID_CLUSTER
121
-
az role assignment create --role "Azure Arc Enabled Kubernetes Cluster User Role" --assignee $AAD_ENTITY_OBJECT_ID --scope $ARM_ID_CLUSTER
120
+
az role assignment create --role "Azure Arc Kubernetes Viewer" --assignee $AAD_ENTITY_ID --scope $ARM_ID_CLUSTER
121
+
az role assignment create --role "Azure Arc Enabled Kubernetes Cluster User Role" --assignee $AAD_ENTITY_ID --scope $ARM_ID_CLUSTER
122
122
```
123
123
124
124
#### [Azure PowerShell](#tab/azure-powershell)
@@ -128,35 +128,35 @@ On the existing Arc-enabled cluster, create the ClusterRoleBinding with either M
128
128
- For a Microsoft Entra group account:
129
129
130
130
```azurepowershell
131
-
$AAD_ENTITY_OBJECT_ID = (az ad signed-in-user show --query id -o tsv)
131
+
$AAD_ENTITY_ID = (az ad signed-in-user show --query id -o tsv)
132
132
```
133
133
134
134
- For a Microsoft Entra single user account:
135
135
136
136
```azurepowershell
137
-
$AAD_ENTITY_OBJECT_ID = (az ad signed-in-user show --query userPrincipalName -o tsv)
137
+
$AAD_ENTITY_ID = (az ad signed-in-user show --query userPrincipalName -o tsv)
138
138
```
139
139
140
140
- For a Microsoft Entra application:
141
141
142
142
```azurepowershell
143
-
$AAD_ENTITY_OBJECT_ID = (az ad sp show --id <id> --query objectId -o tsv)
143
+
$AAD_ENTITY_ID = (az ad sp show --id <id> --query objectId -o tsv)
144
144
```
145
145
146
146
1. Authorize the entity with appropriate permissions.
147
147
148
148
- If you're using native Kubernetes ClusterRoleBinding or RoleBinding for authorization checks on the cluster, with the `kubeconfig` file pointing to the `apiserver` of your cluster for direct access, you can create one mapped to the Microsoft Entra entity (service principal or user) that needs to access this cluster. For example:
- If you're using [Azure RBAC for authorization checks](azure-rbac.md) on the cluster, you can create an applicable [Azure role assignment](azure-rbac.md#built-in-roles) mapped to the Microsoft Entra entity. For example:
155
155
156
156
```azurepowershell
157
157
158
-
az role assignment create --role "Azure Arc Kubernetes Viewer" --assignee $AAD_ENTITY_OBJECT_ID --scope $ARM_ID_CLUSTER
159
-
az role assignment create --role "Azure Arc Enabled Kubernetes Cluster User Role" --assignee $AAD_ENTITY_OBJECT_ID --scope $ARM_ID_CLUSTER
158
+
az role assignment create --role "Azure Arc Kubernetes Viewer" --assignee $AAD_ENTITY_ID --scope $ARM_ID_CLUSTER
159
+
az role assignment create --role "Azure Arc Enabled Kubernetes Cluster User Role" --assignee $AAD_ENTITY_ID --scope $ARM_ID_CLUSTER
0 commit comments