Blog Post

FastTrack for Azure
9 MIN READ

Azure Kubernetes Service: RBAC options in practice

AndreDewes_MSFT's avatar
AndreDewes_MSFT
Icon for Microsoft rankMicrosoft
Nov 30, 2022
Introduction When you are building an AKS cluster for your team, one of the first questions you need to ask is: how are you going to manage access to the different groups or people? How to have ...
Updated Nov 30, 2022
Version 7.0
Cloud Native Apps
Larry Wall (AZURE DEV)'s avatar
Larry Wall (AZURE DEV)
Icon for Microsoft rankMicrosoft
Apr 04, 2023

Hi Andre,

 

Here is what I have found when setting up for the Azure AD authentication with Azure RBAC.

 

I did this:

  1. Created the cluster with this authentication option above
  2. Created a new AAD group name aks-admins. 
  3. Added the aks-admins group to the role Azure Kubernetes Service RBAC Cluster Admin role.
  4. Added two other groups, on for namespace admins (aks-blog-admins) and aks-blog-users. Assigned these to the Azure Kubernetes Service Cluster User Role.
  5. I then decided to log in using my Azure admin subscription id. Just as a test, I decided to try to create a namespace. This is what I saw.

 

PS C:\Users\larrywa> kubectl create namespace blog

Unable to connect to the server: getting credentials: exec: executable kubelogin not found

 

It looks like you are trying to use a client-go credential plugin that is not installed.

 

To learn more about this feature, consult the documentation available at:

      https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins

 

  1. Did some reading, decided to go install kubelogin from https://github.com/Azure/kubelogin#setup.
  2. Added my external Hotmail account to the aks-blog-user group which should only have access to the blog namespace.
  3. When logging in to Azure in PowerShell, it told me that it could not authenticate and gave me other options like az login –tenant <mytenantId>. I tried this and logged in.
  4. It is interesting that now I find that my login can do anything in any namespace, not just the blog namespace.

Shouldn't my login only be able to do things in the blog namespace?

 

Thanks!