Skip to content

Support AKS Managed Cluster with AAD integration and kubernetes RBAC #4281

@aleexx17

Description

@aleexx17

/kind feature

If you set up an AKS cluster that is AAD managed, the RBAC setting is currently automatically set to Azure RBAC.
Normally, if you use the Azure CLI, for example, if you only set AAD Managed to true, an AAD cluster with Kubernetes Managed RBAC is created.

In order to utilise the full functionality, it would be useful to define "EnableAzureRBAC" as a separate value field which can be set to true or false.
It would make sense to set the default value of EnbaleAzureRBAC to false so that you have the same functionality as with the other providers.

e.g.

  aadProfile:
    managed: true
    enableAzureRBAC: false
    adminGroupObjectIDs: ["someID"]

creates an AAD Managed Cluster with Kubernetes RBAC.

  aadProfile:
    managed: true
    enableAzureRBAC: true
    adminGroupObjectIDs: ["someID"]

creates an AAD Managed Cluster with Azure RBAC

See official MS documentation:

https://learn.microsoft.com/en-us/azure/aks/managed-azure-ad
https://learn.microsoft.com/en-us/azure/aks/azure-ad-rbac?tabs=portal
https://learn.microsoft.com/en-us/azure/aks/manage-azure-rbac

See implementation from other providers:

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster#azure_rbac_enabled

Metadata

Metadata

Assignees

Labels

area/managedclustersIssues related to managed AKS clusters created through the CAPZ ManagedCluster Typekind/featureCategorizes issue or PR as related to a new feature.

Type

No type

Projects

Status

Done

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions