Skip to content

Commit fdc13bd

Browse files
v-regandownerv-regandowner
authored
Merge pull request #228221 from schaffererin/aks-trusted-access-1
AKS Trusted Access feature public preview article (new PR)
2 parents 59baae8 + e85da00 commit fdc13bd

File tree

3 files changed

+173
-2
lines changed

3 files changed

+173
-2
lines changed

‎articles/aks/TOC.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,14 @@
225225
href: node-upgrade-github-actions.md
226226
- name: Process node OS updates
227227
href: node-updates-kured.md
228+
- name: Configure an AKS cluster
229+
href: cluster-configuration.md
230+
- name: Custom node configuration
231+
href: custom-node-configuration.md
232+
- name: Integrate ACR with an AKS cluster
233+
href: cluster-container-registry-integration.md
234+
- name: Enable Azure resources to access AKS clusters using Trusted Access (preview)
235+
href: trusted-access-feature.md
228236
- name: Connect to cluster nodes
229237
href: node-access.md
230238
- name: Create virtual nodes

‎articles/aks/index.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,8 @@ landingContent:
3838
url: use-cvm.md
3939
- text: AKS GitHub Actions
4040
url: kubernetes-action.md
41-
- text: FIPS support for Windows Server node pools
42-
url: enable-fips-nodes.md#create-a-fips-enabled-windows-node-pool
41+
- text: Enable Azure resources to access AKS clusters using Trusted Access (preview)
42+
url: trusted-access-feature.md
4343
- text: Automatically upgrade an AKS cluster
4444
url: auto-upgrade-cluster.md
4545
- text: Start/stop node pools

‎articles/aks/trusted-access-feature.md

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
---
2+
title: Enable Azure resources to access Azure Kubernetes Service (AKS) clusters using Trusted Access
3+
description: Learn how to use the Trusted Access feature to enable Azure resources to access Azure Kubernetes Service (AKS) clusters.
4+
author: schaffererin
5+
services: container-service
6+
ms.topic: article
7+
ms.date: 02/23/2023
8+
ms.author: schaffererin
9+
---
10+
11+
# Enable Azure resources to access Azure Kubernetes Service (AKS) clusters using Trusted Access (Preview)
12+
13+
Many Azure services that integrate with Azure Kubernetes Service (AKS) need access to the Kubernetes API server. In order to avoid granting these services admin access or having to keep your AKS clusters public for network access, you can use the AKS Trusted Access feature.
14+
15+
This feature allows services to securely connect to AKS and Kubernetes via the Azure backend without requiring private endpoint. Instead of relying on identities with [Microsoft Azure Active Directory (Azure AD)](../active-directory/fundamentals/active-directory-whatis.md) permissions, this feature can use your system-assigned managed identity to authenticate with the managed services and applications you want to use on top of AKS.
16+
17+
Trusted Access addresses the following scenarios:
18+
19+
* Azure services may be unable to access the Kubernetes API server when the authorized IP range is enabled, or in private clusters unless you implement a private endpoint access model.
20+
21+
* Providing admin access to the Kubernetes API to an Azure service doesn't follow the least privileged access best practices and could lead to privilege escalations or risks of credential leakage.
22+
23+
* For example, you may have to implement high-privileged service-to-service permissions, which aren't ideal during audit reviews.
24+
25+
This article shows you how to enable secure access from your Azure services to your Kubernetes API server in AKS using Trusted Access.
26+
27+
[!INCLUDE [preview features callout](./includes/preview/preview-callout.md)]
28+
29+
## Trusted Access feature overview
30+
31+
Trusted Access enables you to give explicit consent to your system-assigned MSI of allowed resources to access your AKS clusters using an Azure resource *RoleBinding*. Your Azure resources access AKS clusters through the AKS regional gateway via system-assigned managed identity authentication with the appropriate Kubernetes permissions via an Azure resource *Role*. The Trusted Access feature allows you to access AKS clusters with different configurations, including but not limited to [private clusters](private-clusters.md), [clusters with local accounts disabled](managed-aad.md#disable-local-accounts), [Azure AD clusters](azure-ad-integration-cli.md), and [authorized IP range clusters](api-server-authorized-ip-ranges.md).
32+
33+
## Prerequisites
34+
35+
* An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
36+
* Resource types that support [system-assigned managed identity](../active-directory/managed-identities-azure-resources/overview.md).
37+
* Pre-defined Roles with appropriate [AKS permissions](concepts-identity.md).
38+
* To learn about what Roles to use in various scenarios, see [AzureML access to AKS clusters with special configurations](https://github.com/Azure/AML-Kubernetes/blob/master/docs/azureml-aks-ta-support.md).
39+
* If you're using Azure CLI, the **aks-preview** extension version **0.5.74 or later** is required.
40+
41+
First, install the aks-preview extension by running the following command:
42+
43+
```azurecli
44+
az extension add --name aks-preview
45+
```
46+
47+
Run the following command to update to the latest version of the extension released:
48+
49+
```azurecli
50+
az extension update --name aks-preview
51+
```
52+
53+
Then register the `TrustedAccessPreview` feature flag by using the [`az feature register`][az-feature-register] command, as shown in the following example:
54+
55+
```azurecli-interactive
56+
az feature register --namespace "Microsoft.ContainerService" --name "TrustedAccessPreview"
57+
```
58+
59+
It takes a few minutes for the status to show *Registered*. Verify the registration status by using the [`az feature show`][az-feature-show] command:
60+
61+
```azurecli-interactive
62+
az feature show --namespace "Microsoft.ContainerService" --name "TrustedAccessPreview"
63+
```
64+
65+
When the status reflects *Registered*, refresh the registration of the *Microsoft.ContainerService* resource provider by using the [`az provider register`][az-provider-register] command:
66+
67+
```azurecli-interactive
68+
az provider register --namespace Microsoft.ContainerService
69+
```
70+
71+
## Create an AKS cluster
72+
73+
[Create an AKS cluster](tutorial-kubernetes-deploy-cluster.md) in the same subscription as the Azure resource you want to access the cluster.
74+
75+
## Select the required Trusted Access Roles
76+
77+
The Roles you select depend on the different Azure services. These services help create Roles and RoleBindings, which build the connection from the Azure service to AKS.
78+
79+
## Create a Trusted Access RoleBinding
80+
81+
After confirming which Role to use, use the Azure CLI to create a Trusted Access RoleBinding in an AKS cluster. The RoleBinding associates your selected Role with the Azure service.
82+
83+
```azurecli
84+
# Create a Trusted Access RoleBinding in an AKS cluster
85+
86+
az aks trustedaccess rolebinding create --resource-group <AKS resource group> --cluster-name <AKS cluster name> -n <rolebinding name> -s <connected service resource ID> --roles <roleName1, roleName2>
87+
88+
# Sample command
89+
90+
az aks trustedaccess rolebinding create \
91+
-g myResourceGroup \
92+
--cluster-name myAKSCluster -n test-binding \
93+
-s /subscriptions/000-000-000-000-000/resourceGroups/myResourceGroup/providers/Microsoft.MachineLearningServices/workspaces/MyMachineLearning \
94+
--roles Microsoft.Compute/virtualMachineScaleSets/test-node-reader,Microsoft.Compute/virtualMachineScaleSets/test-admin
95+
```
96+
97+
---
98+
99+
## Update an existing Trusted Access RoleBinding with new roles
100+
101+
For an existing RoleBinding with associated source service, you can update the RoleBinding with new Roles.
102+
103+
> [!NOTE]
104+
> The new RoleBinding may take up to 5 minutes to take effect as addon manager updates clusters every 5 minutes. Before the new RoleBinding takes effect, the old RoleBinding still works.
105+
>
106+
> You can use `az aks trusted access rolebinding list --name <rolebinding name> --resource-group <resource group>` to check the current RoleBinding.
107+
108+
```azurecli
109+
# Update RoleBinding command
110+
111+
az aks trustedaccess rolebinding update --resource-group <AKS resource group> --cluster-name <AKS cluster name> -n <existing rolebinding name> --roles <newRoleName1, newRoleName2>
112+
113+
# Update RoleBinding command with sample resource group, cluster, and Roles
114+
115+
az aks trustedaccess rolebinding update \
116+
--resource-group myResourceGroup \
117+
--cluster-name myAKSCluster -n test-binding \
118+
--roles Microsoft.Compute/virtualMachineScaleSets/test-node-reader,Microsoft.Compute/virtualMachineScaleSets/test-admin
119+
```
120+
121+
---
122+
123+
## Show the Trusted Access RoleBinding
124+
125+
Use the Azure CLI to show a specific Trusted Access RoleBinding.
126+
127+
```azurecli
128+
az aks trustedaccess rolebinding show --name <rolebinding name> --resource-group <AKS resource group> --cluster-name <AKS cluster name>
129+
```
130+
131+
---
132+
133+
## List all the Trusted Access RoleBindings for a cluster
134+
135+
Use the Azure CLI to list all the Trusted Access RoleBindings for a cluster.
136+
137+
```azurecli
138+
az aks trustedaccess rolebinding list --resource-group <AKS resource group> --cluster-name <AKS cluster name>
139+
```
140+
141+
## Delete the Trusted Access RoleBinding for a cluster
142+
143+
> [!WARNING]
144+
> Deleting the existing Trusted Access RoleBinding will cause disconnection from AKS cluster to the Azure service.
145+
146+
Use the Azure CLI to delete an existing Trusted Access RoleBinding.
147+
148+
```azurecli
149+
az aks trustedaccess rolebinding delete --name <rolebinding name> --resource-group <AKS resource group> --cluster-name <AKS cluster name>
150+
```
151+
152+
## Next steps
153+
154+
For more information on AKS, see:
155+
156+
* [Deploy and manage cluster extensions for AKS](/cluster-extensions.md)
157+
* [Deploy AzureML extension on AKS or Arc Kubernetes cluster](../machine-learning/how-to-deploy-kubernetes-extension.md)
158+
159+
<!-- LINKS -->
160+
161+
[az-feature-register]: /cli/azure/feature#az-feature-register
162+
[az-feature-show]: /cli/azure/feature#az-feature-show
163+
[az-provider-register]: /cli/azure/provider#az-provider-register

0 commit comments

Comments
 (0)