You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This article covers how to use Azure RBAC for Kubernetes Authorization, which allows for the unified management and access control across Azure resources, AKS, and Kubernetes resources. For more information, see [Azure RBAC for Kubernetes Authorization][kubernetes-rbac].
17
17
18
18
> [!NOTE]
19
-
> When you leverage [integrated authentication between Microsoft Entra ID and AKS](managed-azure-ad.md), you can use Microsoft Entra users, groups, or service principals as subjects in [Kubernetes role-based access control (Kubernetes RBAC)][kubernetes-rbac]. This feature frees you from having to separately manage user identities and credentials for Kubernetes. However, you still have to set up and manage Azure RBAC and Kubernetes RBAC separately.
19
+
> When using [integrated authentication between Microsoft Entra ID and AKS](managed-azure-ad.md), you can use Microsoft Entra users, groups, or service principals as subjects in [Kubernetes role-based access control (Kubernetes RBAC)][kubernetes-rbac]. With this feature, you don't need to separately manage user identities and credentials for Kubernetes. However, you still need to set up and manage Azure RBAC and Kubernetes RBAC separately.
20
20
21
21
## Before you begin
22
22
23
23
* You need the Azure CLI version 2.24.0 or later installed and configured. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].
24
24
* You need `kubectl`, with a minimum version of [1.18.3](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.18.md#v1183).
25
25
* You need managed Microsoft Entra integration enabled on your cluster before you can add Azure RBAC for Kubernetes authorization. If you need to enable managed Microsoft Entra integration, see [Use Microsoft Entra ID in AKS](managed-azure-ad.md).
26
26
* If you have CRDs and are making custom role definitions, the only way to cover CRDs today is to use `Microsoft.ContainerService/managedClusters/*/read`. For the remaining objects, you can use the specific API groups, such as `Microsoft.ContainerService/apps/deployments/read`.
27
-
* New role assignments can take up to five minutes to propagate and be updated by the authorization server.
27
+
* New role assignments can take *up to five minutes* to propagate and be updated by the authorization server.
28
28
* Azure RBAC for Kubernetes Authorization requires that the Microsoft Entra tenant configured for authentication is same as the tenant for the subscription that holds your AKS cluster.
## Create a new AKS cluster with managed Microsoft Entra integration and Azure RBAC for Kubernetes Authorization
33
33
34
-
Create an Azure resource group using the [`az group create`][az-group-create] command.
35
-
36
-
```azurecli-interactive
37
-
az group create --name myResourceGroup --location westus2
38
-
```
39
-
40
-
Create an AKS cluster with managed Microsoft Entra integration and Azure RBAC for Kubernetes Authorization using the [`az aks create`][az-aks-create] command.
41
-
42
-
```azurecli-interactive
43
-
az aks create \
44
-
--resource-group myResourceGroup \
45
-
--name myManagedCluster \
46
-
--enable-aad \
47
-
--enable-azure-rbac \
48
-
--generate-ssh-keys
49
-
```
50
-
51
-
The output will look similar to the following example output:
52
-
53
-
```json
54
-
"AADProfile": {
55
-
"adminGroupObjectIds": null,
56
-
"clientAppId": null,
57
-
"enableAzureRbac": true,
58
-
"managed": true,
59
-
"serverAppId": null,
60
-
"serverAppSecret": null,
61
-
"tenantId": "****-****-****-****-****"
62
-
}
63
-
```
34
+
1. Create an Azure resource group using the [`az group create`][az-group-create] command.
35
+
36
+
```azurecli-interactive
37
+
export RESOURCE_GROUP=<resource-group-name>
38
+
export LOCATION=<azure-region>
39
+
40
+
az group create --name $RESOURCE_GROUP --location $LOCATION
41
+
```
42
+
43
+
2. Create an AKS cluster with managed Microsoft Entra integration and Azure RBAC for Kubernetes Authorization using the [`az aks create`][az-aks-create] command.
44
+
45
+
```azurecli-interactive
46
+
export CLUSTER_NAME=<cluster-name>
47
+
48
+
az aks create \
49
+
--resource-group $RESOURCE_GROUP \
50
+
--name $CLUSTER_NAME \
51
+
--enable-aad \
52
+
--enable-azure-rbac \
53
+
--generate-ssh-keys
54
+
```
55
+
56
+
Your output should look similar to the following example output:
57
+
58
+
```output
59
+
"AADProfile": {
60
+
"adminGroupObjectIds": null,
61
+
"clientAppId": null,
62
+
"enableAzureRbac": true,
63
+
"managed": true,
64
+
"serverAppId": null,
65
+
"serverAppSecret": null,
66
+
"tenantId": "****-****-****-****-****"
67
+
}
68
+
```
64
69
65
70
## Enable Azure RBAC on an existing AKS cluster
66
71
67
-
Add Azure RBAC for Kubernetes Authorization into an existing AKS cluster using the [`az aks update`][az-aks-update] command with the `enable-azure-rbac` flag.
72
+
* Enable Azure RBAC for Kubernetes Authorization on an existing AKS cluster using the [`az aks update`][az-aks-update] command with the `--enable-azure-rbac` flag.
68
73
69
-
```azurecli-interactive
70
-
az aks update --resource-group myResourceGroup --name myAKSCluster --enable-azure-rbac
71
-
```
74
+
```azurecli-interactive
75
+
az aks update --resource-group $RESOURCE_GROUP --name $CLUSTER_NAME --enable-azure-rbac
76
+
```
72
77
73
78
## Disable Azure RBAC for Kubernetes Authorization from an AKS cluster
74
79
75
-
Remove Azure RBAC for Kubernetes Authorization from an existing AKS cluster using the [`az aks update`][az-aks-update] command with the `disable-azure-rbac` flag.
80
+
* Remove Azure RBAC for Kubernetes Authorization from an existing AKS cluster using the [`az aks update`][az-aks-update] command with the `--disable-azure-rbac` flag.
76
81
77
-
```azurecli-interactive
78
-
az aks update --resource-group myResourceGroup --name myAKSCluster --disable-azure-rbac
79
-
```
82
+
```azurecli-interactive
83
+
az aks update --resource-group $RESOURCE_GROUP --name $CLUSTER_NAME --disable-azure-rbac
84
+
```
80
85
81
-
## Create role assignments for users to access the cluster
86
+
## AKS built-in roles
82
87
83
88
AKS provides the following built-in roles:
84
89
@@ -89,134 +94,181 @@ AKS provides the following built-in roles:
89
94
| Azure Kubernetes Service RBAC Admin | Allows admin access, intended to be granted within a namespace. Allows read/write access to most resources in a namespace (or cluster scope), including the ability to create roles and role bindings within the namespace. This role doesn't allow write access to resource quota or to the namespace itself. |
90
95
| Azure Kubernetes Service RBAC Cluster Admin | Allows super-user access to perform any action on any resource. It gives full control over every resource in the cluster and in all namespaces. |
91
96
92
-
Roles assignments scoped to the **entire AKS cluster** can be done either on the Access Control (IAM) blade of the cluster resource on Azure portal or by using the following Azure CLI commands:
97
+
## Create role assignments for cluster access
93
98
94
-
Get your AKS resource ID using the [`az aks show`][az-aks-show] command.
99
+
### [Azure CLI](#tab/azure-cli)
95
100
96
-
```azurecli
97
-
AKS_ID=$(az aks show --resource-group myResourceGroup --name myManagedCluster --query id -o tsv)
98
-
```
101
+
1. Get your AKS resource ID using the [`az aks show`][az-aks-show] command.
99
102
100
-
Create a role assignment using the [`az role assignment create`][az-role-assignment-create] command. `<AAD-ENTITY-ID>` can be a username or the client ID of a service principal.
103
+
```azurecli
104
+
AKS_ID=$(az aks show --resource-group $RESOURCE_GROUP --name $CLUSTER_NAME --query id --output tsv)
105
+
```
101
106
102
-
```azurecli-interactive
103
-
az role assignment create --role "Azure Kubernetes Service RBAC Admin" --assignee <AAD-ENTITY-ID> --scope $AKS_ID
104
-
```
107
+
2. Create a role assignment using the [`az role assignment create`][az-role-assignment-create] command. `<AAD-ENTITY-ID>` can be a username or the client ID of a service principal. The following example creates a role assignment for the *Azure Kubernetes Service RBAC Admin* role.
105
108
106
-
> [!NOTE]
107
-
> You can create the *Azure Kubernetes Service RBAC Reader* and *Azure Kubernetes Service RBAC Writer* role assignments scoped to a specific namespace within the cluster using the [`az role assignment create`][az-role-assignment-create] command and setting the scope to the desired namespace.
108
-
>
109
-
> ```azurecli-interactive
110
-
> az role assignment create --role "Azure Kubernetes Service RBAC Reader" --assignee <AAD-ENTITY-ID> --scope $AKS_ID/namespaces/<namespace-name>
111
-
> ```
109
+
```azurecli-interactive
110
+
az role assignment create --role "Azure Kubernetes Service RBAC Admin" --assignee <AAD-ENTITY-ID> --scope $AKS_ID
111
+
```
112
112
113
-
> [!NOTE]
114
-
> In Azure portal, after creating role assignments scoped to a desired namespace, you won't be able to see "role assignments" for namespace [at a scope][list-role-assignments-at-a-scope-at-portal]. You can find it by using the [`az role assignment list`][az-role-assignment-list] command, or [list role assignments for a user or group][list-role-assignments-for-a-user-or-group-at-portal], which you assigned the role to.
115
-
>
116
-
> ```azurecli-interactive
117
-
> az role assignment list --scope $AKS_ID/namespaces/<namespace-name>
118
-
> ```
113
+
> [!NOTE]
114
+
> You can create the *Azure Kubernetes Service RBAC Reader* and *Azure Kubernetes Service RBAC Writer* role assignments scoped to a specific namespace within the cluster using the [`az role assignment create`][az-role-assignment-create] command and setting the scope to the desired namespace.
115
+
>
116
+
> ```azurecli-interactive
117
+
> az role assignment create --role "Azure Kubernetes Service RBAC Reader" --assignee <AAD-ENTITY-ID> --scope $AKS_ID/namespaces/<namespace-name>
118
+
> ```
119
+
120
+
### [Azure portal](#tab/azure-portal)
121
+
122
+
1. Navigate to your AKS cluster resource and select **Access control (IAM)** > **Add role assignment**.
123
+
2. On the **Role** tab, select the desired role, such as *Azure Kubernetes Service RBAC Admin*, and then select **Next**.
124
+
3. On the **Members** tab, configure the following settings:
125
+
126
+
* **Assign access to**: Select **User, group, or service principal**.
127
+
* **Members**: Select **+ Select members**, search for and select the desired members, and then select **Select**.
128
+
129
+
4. Select **Review + assign** > **Assign**.
130
+
131
+
> [!NOTE]
132
+
> In Azure portal, after creating role assignments scoped to a desired namespace, you won't be able to see "role assignments" for namespace [at a scope][list-role-assignments-at-a-scope-at-portal]. You can find it by using the [`az role assignment list`][az-role-assignment-list] command, or [list role assignments for a user or group][list-role-assignments-for-a-user-or-group-at-portal], which you assigned the role to.
133
+
>
134
+
> ```azurecli-interactive
135
+
> az role assignment list --scope $AKS_ID/namespaces/<namespace-name>
136
+
> ```
137
+
138
+
---
119
139
120
140
## Create custom roles definitions
121
141
122
142
The following example custom role definition allows a user to only read deployments and nothing else. For the full list of possible actions, see [Microsoft.ContainerService operations](../role-based-access-control/resource-provider-operations.md#microsoftcontainerservice).
123
143
124
-
To create your own custom role definitions, copy the following file, replacing `<YOUR SUBSCRIPTION ID>` with your own subscription ID, and then save it as `deploy-view.json`.
144
+
1. To create your own custom role definitions, copy the following file, replacing `<YOUR SUBSCRIPTION ID>` with your own subscription ID, and then save it as `deploy-view.json`.
125
145
126
-
```json
127
-
{
128
-
"Name": "AKS Deployment Reader",
129
-
"Description": "Lets you view all deployments in cluster/namespace.",
Create the role definition using the [`az role definition create`][az-role-definition-create] command, setting the `--role-definition` to the `deploy-view.json` file you created in the previous step.
162
+
2. Create the role definition using the [`az role definition create`][az-role-definition-create] command, setting the `--role-definition` to the `deploy-view.json` file you created in the previous step.
143
163
144
-
```azurecli-interactive
145
-
az role definition create --role-definition @deploy-view.json
146
-
```
164
+
```azurecli-interactive
165
+
az role definition create --role-definition @deploy-view.json
166
+
```
147
167
148
-
Assign the role definition to a user or other identity using the [`az role assignment create`][az-role-assignment-create] command.
168
+
3. Assign the role definition to a user or other identity using the [`az role assignment create`][az-role-assignment-create] command.
149
169
150
-
```azurecli-interactive
151
-
az role assignment create --role "AKS Deployment Reader" --assignee <AAD-ENTITY-ID> --scope $AKS_ID
152
-
```
170
+
```azurecli-interactive
171
+
az role assignment create --role "AKS Deployment Reader" --assignee <AAD-ENTITY-ID> --scope $AKS_ID
172
+
```
153
173
154
174
## Use Azure RBAC for Kubernetes Authorization with `kubectl`
155
175
156
-
Make sure you have the [Azure Kubernetes Service Cluster User](../role-based-access-control/built-in-roles.md#azure-kubernetes-service-cluster-user-role) built-in role, and then get the kubeconfig of your AKS cluster using the [`az aks get-credentials`][az-aks-get-credentials] command.
176
+
1. Make sure you have the [Azure Kubernetes Service Cluster User](../role-based-access-control/built-in-roles.md#azure-kubernetes-service-cluster-user-role) built-in role, and then get the kubeconfig of your AKS cluster using the [`az aks get-credentials`][az-aks-get-credentials] command.
177
+
178
+
```azurecli-interactive
179
+
az aks get-credentials --resource-group $RESOURCE_GROUP --name $CLUSTER_NAME
180
+
```
157
181
158
-
```azurecli-interactive
159
-
az aks get-credentials --resource-group myResourceGroup --name myManagedCluster
160
-
```
182
+
2. You can now use `kubectl` to manage your cluster. For example, you can list the nodes in your cluster using `kubectl get nodes`.
161
183
162
-
Now, you can use `kubectl` manage your cluster. For example, you can list the nodes in your cluster using `kubectl get nodes`. The first time you run it, you'll need to sign in, as shown in the following example:
184
+
```azurecli-interactive
185
+
kubectl get nodes
186
+
```
163
187
164
-
```azurecli-interactive
165
-
kubectl get nodes
166
-
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code AAAAAAAAA to authenticate.
## Use Azure RBAC for Kubernetes Authorization with `kubelogin`
175
198
176
-
AKS created the [`kubelogin`](https://github.com/Azure/kubelogin) plugin to help unblock additional scenarios, such as non-interactive logins, older `kubectl` versions, or leveraging SSO across multiple clusters without the need to sign in to a new cluster.
199
+
AKS created the [`kubelogin`](https://github.com/Azure/kubelogin) plugin to help unblock scenarios such as non-interactive logins, older `kubectl` versions, or leveraging SSO across multiple clusters without the need to sign in to a new cluster.
177
200
178
-
You can use the `kubelogin` plugin by running the following command:
201
+
1. Use the `kubelogin` plugin by running the following command:
179
202
180
-
```bash
181
-
export KUBECONFIG=/path/to/kubeconfig
182
-
kubelogin convert-kubeconfig
183
-
```
203
+
```azurecli-interactive
204
+
export KUBECONFIG=/path/to/kubeconfig
205
+
kubelogin convert-kubeconfig
206
+
```
184
207
185
-
Similar to `kubectl`, you need to log in the first time you run it, as shown in the following example:
208
+
2. You can now use `kubectl`to manage your cluster. For example, you can list the nodes in your cluster using `kubectl get nodes`.
186
209
187
-
```bash
188
-
kubectl get nodes
189
-
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code AAAAAAAAA to authenticate.
0 commit comments