Search code examples
azurekubernetesconfigadmin

How can block azure aks get-credentials --admin and allow azure aks get-credentials only on azure?

Use azure aks get-credentials --admin can get kubernetes admin config file and azure aks get-credentials can get only user config file on azure.

How to set something to deny user run azure aks get-credentials --admin?

Solution

  • well, be default they cant run it, unless they have specific azure permissions. so by default you dont have to do anything. they shouldnt have this specific permission:

    Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action

    which they would get if they are contributor for the AKS resource or resource group. They need this permission to get user credentials:

    Microsoft.ContainerService/managedClusters/listClusterUserCredential/action