Search code examples
azure-aksazure-rbac

Azure RBAC and AKS not working as expected

I have create an AKS Cluster with AKS-managed Azure Active Directory and Role-based access control (RBAC) Enabled. If I try to connect with the Cluster by using one of the accounts which are included in the Admin Azure AD groups everything works as it should. I am having some difficulties when i try to do this with a user which is not a member of Admin Azure AD groups. What I did is the following:

  • created a new user
  • assigned the roles Azure Kubernetes Service Cluster User Role and Azure Kubernetes Service RBAC Reader to this user.
  • Execute the following command: az aks get-credentials --resource-group RG1 --name aksttest

When I then execute the following command: kubectl get pods -n test I get the following error: Error from server (Forbidden): pods is forbidden: User "[email protected]" cannot list resource "pods" in API group "" in the namespace "test"

In the Cluster I haven't done any RoleBinding. According to the docu from Microsoft, there is no additional task that should be done in the Cluster ( like for ex. Role definition and RoleBinding).

My expectation is that when a user has the above two roles assigned he should be able to have read rights in the Cluster. Am I doing something wrong?

Please let me know what you think, Thanks in advance, Mike

Solution

  • When you use AKS-managed Azure Active Directory, it enables authentication as AD user but authorization happens in Kubernetes RBAC only, so, you have to separately configure Azure IAM and Kubernetes RBAC. For example, it adds the aks-cluster-admin-binding-aad ClusterRoleBinding which provides access to accounts which are included in the Admin Azure AD groups.

    The Azure Kubernetes Service RBAC Reader role is applicable for Azure RBAC for Kubernetes Authorization which is feature on top of AKS-managed Azure Active Directory, where both authentication and authorization happen with AD and Azure RBAC. It uses Webhook Token Authentication technique at API server to verify tokens.

    You can enable Azure RBAC for Kubernetes Authorization on existing cluster which already has AAD integration:

    az aks update -g <myResourceGroup> -n <myAKSCluster> --enable-azure-rbac