There are few limitations with this approach though before you get started
- You cannot disable the AKS-managed Azure AD integration once it is enabled
- Process is supported only for RBAC enabled clusters
- Azure AD tenant once integrated cannot be switched to a different one
Lets start with creating an Azure AD group. You can also use an existing one if you want to. Note that creating an Azure AD group would need Global administrator rights
I am executing these steps from Azure cloud shell, where all the required tools like Azure CLI and Kubectl are preinstalled
1. Create the Azure AD group for your cluster administrators. Note down the object id of the group as it is required during cluster provisioning
~$ az ad group create --display-name AKSdemoadminGroup --mail-nickname AKSdemoadmingroup
Note: Once the AD group is created, add the users who will have cluster admin rights to this group
2. Note down the tenant id of your Azure AD. You can get this from Azure portal-> Azure active directory->overview->Tenant information.
3. Create resource group for the AKS cluster
$ az group create --name demoaksgroup --location EastUS
4. Create AKS cluster , the object id of the AD group that we created in step 1 and the AD tenant id that was copied in step 2 will be used here
az aks create -g demoaksgroup -n demoaks1 --enable-aad --aad-admin-group-object-ids <AD group obejct ID> --aad-tenant-id <Azure AD tenant ID> --generate-ssh-keys
5. Login to cluster using an user account that is part of cluster admin AD group that was used for the integration. When prompted, login using the Azure AD credentials .
az aks get-credentials --resource-group demoaksgroup --name demoaks1
In the above example I am executing the "kubectl get nodes" and "kubectl get namespaces" commands after authenticating
Now you can go ahead and follow the steps in my earlier blog to setup RBAC for namespaces using Azure AD credentials
Thanks for sharing this useful info. In22labs (unwind learning labs) is one of the leading E-governance solutions providers in India. We have worked on 100+ portals for Egovernance using the latest technologies. Know more Government apps development providers
ReplyDeleteThank you for sharing wonderful information.
ReplyDeleteDevOps Training
DevOps Online Training
Great work….Nice information ….well explained. Keep sharing this type of valuable information. Looking for the best cloud computing services in Hyderabad contact Cyanous software solutions now.
ReplyDeleteBest cloud computing services in Hyderabad
Best software & web development company in Hyderabad
Thanks for sharing this was very helpful. Please check our product akku
ReplyDeleteIdentity & Access Management Solution
This information really helped me a lot. It was very informative.
ReplyDeleteCloud Managed Services
Nice post, Thanks for sharing!
ReplyDeleteDevOps Training
DevOps Online Training
This information really helped me a lot. It was very informative.
ReplyDeleteCloud Migration Services
Love to read it, Waiting For More new Update and I Already Read your Recent Post its Great Thanks.
ReplyDeleteVBSPU BA 1st Year Result 2022
VBSPU BA 2nd Year Result 2022
VPSPU BA 3rd Year Result 2022
Get one of the best import export data provider for Mexico Import and Export Data. For more information visit our website and complete details about our import export data services.
ReplyDeleteMexico Export Data