Azure RBAC and AKS not working as expected

Question

I have create an AKS Cluster with AKS-managed Azure Active Directory and Role-based access control (RBAC) Enabled. If I try to connect with the Cluster by using one of the accounts which are included in the Admin Azure AD groups everything works as it should. I am having some difficulties when i try to do this with a user which is not a member of Admin Azure AD groups. What I did is the following:

created a new user
assigned the roles Azure Kubernetes Service Cluster User Role and Azure Kubernetes Service RBAC Reader to this user.
Execute the following command: az aks get-credentials --resource-group RG1 --name aksttest

When I then execute the following command: kubectl get pods -n test I get the following error: Error from server (Forbidden): pods is forbidden: User "aksthree@tenantname.onmicrosoft.com" cannot list resource "pods" in API group "" in the namespace "test"

In the Cluster I haven't done any RoleBinding. According to the docu from Microsoft, there is no additional task that should be done in the Cluster ( like for ex. Role definition and RoleBinding).

My expectation is that when a user has the above two roles assigned he should be able to have read rights in the Cluster. Am I doing something wrong?

Please let me know what you think, Thanks in advance, Mike

YK1 · Accepted Answer · 2021-10-21T20:41:40.723

5

When you use AKS-managed Azure Active Directory, it enables authentication as AD user but authorization happens in Kubernetes RBAC only, so, you have to separately configure Azure IAM and Kubernetes RBAC. For example, it adds the aks-cluster-admin-binding-aad ClusterRoleBinding which provides access to accounts which are included in the Admin Azure AD groups.

The Azure Kubernetes Service RBAC Reader role is applicable for Azure RBAC for Kubernetes Authorization which is feature on top of AKS-managed Azure Active Directory, where both authentication and authorization happen with AD and Azure RBAC. It uses Webhook Token Authentication technique at API server to verify tokens.

You can enable Azure RBAC for Kubernetes Authorization on existing cluster which already has AAD integration:

az aks update -g <myResourceGroup> -n <myAKSCluster> --enable-azure-rbac

edited Oct 21 '21 at 20:41

answered Oct 20 '21 at 05:42

YK1

7,327
1
21
28

my bad, your answer was good but i miss clicked but cant change it until you edit something :( – Philip Welz Oct 21 '21 at 20:28
@PhilipWelz: oh! edited to add some more clarification, there is always room for improvement! – YK1 Oct 21 '21 at 20:42
thanks! i corrected it now :) – Philip Welz Oct 21 '21 at 20:49
thank you for help. It works as it should now. – Mike Oct 22 '21 at 12:42
could you please mark the answers then as correct to help other users? – Philip Welz Nov 05 '21 at 09:18

Azure RBAC and AKS not working as expected

1 Answers1

Linked