Skip to content

Commit db7097f

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #218913 from anraghun/aks-hci-changes
Azure RBAC support for AKS-HCI
2 parents 57bd774 + 491c63e commit db7097f

File tree

2 files changed

+38
-37
lines changed

2 files changed

+38
-37
lines changed

‎articles/azure-arc/kubernetes/azure-rbac.md

Lines changed: 37 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ A conceptual overview of this feature is available in the [Azure RBAC on Azure A
3434
- [Upgrade your agents](agent-upgrade.md#manually-upgrade-agents) to the latest version.
3535
3636
> [!NOTE]
37-
> You can't set up this feature for managed Kubernetes offerings of cloud providers like Elastic Kubernetes Service or Google Kubernetes Engine where the user doesn't have access to the API server of the cluster. For Azure Kubernetes Service (AKS) clusters, this [feature is available natively](../../aks/manage-azure-rbac.md) and doesn't require the AKS cluster to be connected to Azure Arc. This feature isn't supported on AKS on Azure Stack HCI.
37+
> You can't set up this feature for managed Kubernetes offerings of cloud providers like Elastic Kubernetes Service or Google Kubernetes Engine where the user doesn't have access to the API server of the cluster. For Azure Kubernetes Service (AKS) clusters, this [feature is available natively](../../aks/manage-azure-rbac.md) and doesn't require the AKS cluster to be connected to Azure Arc. For AKS on Azure Stack HCI, see [Use Azure RBAC for AKS hybrid clusters (preview)](/azure/aks/hybrid/azure-rbac-aks-hybrid).
3838
3939
## Set up Azure AD applications
4040
@@ -44,32 +44,32 @@ A conceptual overview of this feature is available in the [Azure RBAC on Azure A
4444
4545
1. Create a new Azure AD application and get its `appId` value. This value is used in later steps as `serverApplicationId`.
4646
47-
```azurecli
48-
CLUSTER_NAME="<clusterName>"
49-
TENANT_ID="<tenant>"
50-
SERVER_UNIQUE_SUFFIX="<identifier_suffix>"
51-
SERVER_APP_ID=$(az ad app create --display-name "${CLUSTER_NAME}Server" --identifier-uris "api://${TENANT_ID}/${SERVER_UNIQUE_SUFFIX}" --query appId -o tsv)
52-
echo $SERVER_APP_ID
53-
```
47+
```azurecli
48+
CLUSTER_NAME="<name-of-arc-connected-cluster>"
49+
TENANT_ID="<tenant>"
50+
SERVER_UNIQUE_SUFFIX="<identifier_suffix>"
51+
SERVER_APP_ID=$(az ad app create --display-name "${CLUSTER_NAME}Server" --identifier-uris "api://${TENANT_ID}/${SERVER_UNIQUE_SUFFIX}" --query appId -o tsv)
52+
echo $SERVER_APP_ID
53+
```
5454
5555
1. To grant "Sign in and read user profile" API permissions to the server application. Copy this JSON and save it in a file called oauth2-permissions.json:
5656
57-
```json
58-
{
59-
"oauth2PermissionScopes": [
60-
{
61-
"adminConsentDescription": "Sign in and read user profile",
62-
"adminConsentDisplayName": "Sign in and read user profile",
63-
"id": "<unique_guid>",
64-
"isEnabled": true,
65-
"type": "User",
66-
"userConsentDescription": "Sign in and read user profile",
67-
"userConsentDisplayName": "Sign in and read user profile",
68-
"value": "User.Read"
69-
}
70-
]
71-
}
72-
```
57+
```json
58+
{
59+
"oauth2PermissionScopes": [
60+
{
61+
"adminConsentDescription": "Sign in and read user profile",
62+
"adminConsentDisplayName": "Sign in and read user profile",
63+
"id": "<paste_the_SERVER_APP_ID>",
64+
"isEnabled": true,
65+
"type": "User",
66+
"userConsentDescription": "Sign in and read user profile",
67+
"userConsentDisplayName": "Sign in and read user profile",
68+
"value": "User.Read"
69+
}
70+
]
71+
}
72+
```
7373
7474
1. Update the application's group membership claims. Run the commands in the same directory as `oauth2-permissions.json` file. RBAC for Azure Arc-enabled Kubernetes requires [`signInAudience` to be set to **AzureADMyOrg**](../../active-directory/develop/supported-accounts-validation.md):
7575
@@ -95,10 +95,10 @@ A conceptual overview of this feature is available in the [Azure RBAC on Azure A
9595
az ad app permission grant --id "${SERVER_APP_ID}" --api 00000003-0000-0000-c000-000000000000 --scope User.Read
9696
```
9797

98-
> [!NOTE]
99-
> An Azure tenant administrator has to run this step.
100-
>
101-
> For usage of this feature in production, we recommend that you create a different server application for every cluster.
98+
> [!NOTE]
99+
> An Azure [application administrator](../../active-directory/roles/permissions-reference.md#application-administrator) has to run this step.
100+
>
101+
> For usage of this feature in production, we recommend that you create a different server application for every cluster.
102102
103103
#### Create a client application
104104

@@ -139,13 +139,13 @@ A conceptual overview of this feature is available in the [Azure RBAC on Azure A
139139
140140
1. Create a new Azure AD application and get its `appId` value. This value is used in later steps as `serverApplicationId`.
141141
142-
```azurecli
143-
CLUSTER_NAME="<clusterName>"
144-
TENANT_ID="<tenant>"
145-
SERVER_UNIQUE_SUFFIX="<identifier_suffix>"
146-
SERVER_APP_ID=$(az ad app create --display-name "${CLUSTER_NAME}Server" --identifier-uris "api://${TENANT_ID}/${SERVER_UNIQUE_SUFFIX}" --query appId -o tsv)
147-
echo $SERVER_APP_ID
148-
```
142+
```azurecli
143+
CLUSTER_NAME="<name-of-arc-connected-cluster>"
144+
TENANT_ID="<tenant>"
145+
SERVER_UNIQUE_SUFFIX="<identifier_suffix>"
146+
SERVER_APP_ID=$(az ad app create --display-name "${CLUSTER_NAME}Server" --identifier-uris "api://${TENANT_ID}/${SERVER_UNIQUE_SUFFIX}" --query appId -o tsv)
147+
echo $SERVER_APP_ID
148+
```
149149
150150
1. Update the application's group membership claims:
151151
@@ -168,8 +168,8 @@ A conceptual overview of this feature is available in the [Azure RBAC on Azure A
168168
```
169169
170170
> [!NOTE]
171-
> An Azure tenant administrator has to run this step.
172-
>
171+
> An Azure [application administrator](../../active-directory/roles/permissions-reference.md#application-administrator) has to run this step.
172+
>
173173
> For usage of this feature in production, we recommend that you create a different server application for every cluster.
174174
175175
#### Create a client application

‎articles/azure-arc/kubernetes/quickstart-connect-cluster.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,7 @@ For a conceptual look at connecting clusters to Azure Arc, see [Azure Arc-enable
146146
|`https://k8connecthelm.azureedge.net` | `az connectedk8s connect` uses Helm 3 to deploy Azure Arc agents on the Kubernetes cluster. This endpoint is needed for Helm client download to facilitate deployment of the agent helm chart. |
147147
|`guestnotificationservice.azure.com`, `*.guestnotificationservice.azure.com`, `sts.windows.net`, `https://k8sconnectcsp.azureedge.net` | For [Cluster Connect](cluster-connect.md) and for [Custom Location](custom-locations.md) based scenarios. |
148148
|`*.servicebus.windows.net` | For [Cluster Connect](cluster-connect.md) and for [Custom Location](custom-locations.md) based scenarios. |
149+
|`https://graph.microsoft.com/` | Required when [Azure RBAC](azure-rbac.md) is configured |
149150
150151
> [!NOTE]
151152
> To translate the `*.servicebus.windows.net` wildcard into specific endpoints, use the command `\GET https://guestnotificationservice.azure.com/urls/allowlist?api-version=2020-01-01&location=<location>`. Within this command, the region must be specified for the `<location>` placeholder.

0 commit comments

Comments
 (0)