-
Notifications
You must be signed in to change notification settings - Fork 460
Description
/kind feature
If you set up an AKS cluster that is AAD managed, the RBAC setting is currently automatically set to Azure RBAC.
Normally, if you use the Azure CLI, for example, if you only set AAD Managed to true, an AAD cluster with Kubernetes Managed RBAC is created.
In order to utilise the full functionality, it would be useful to define "EnableAzureRBAC" as a separate value field which can be set to true or false.
It would make sense to set the default value of EnbaleAzureRBAC to false so that you have the same functionality as with the other providers.
e.g.
aadProfile:
managed: true
enableAzureRBAC: false
adminGroupObjectIDs: ["someID"]creates an AAD Managed Cluster with Kubernetes RBAC.
aadProfile:
managed: true
enableAzureRBAC: true
adminGroupObjectIDs: ["someID"]creates an AAD Managed Cluster with Azure RBAC
See official MS documentation:
https://learn.microsoft.com/en-us/azure/aks/managed-azure-ad
https://learn.microsoft.com/en-us/azure/aks/azure-ad-rbac?tabs=portal
https://learn.microsoft.com/en-us/azure/aks/manage-azure-rbac
See implementation from other providers:
Metadata
Metadata
Assignees
Labels
Type
Projects
Status