Skip to content

Latest commit

 

History

History
31 lines (28 loc) · 1.25 KB

aks.md

File metadata and controls

31 lines (28 loc) · 1.25 KB
Raw

Authentication With Azure Kubernetes Service

Azure Kubernetes Service (AKS) enables mapping Azure Active Directory (AAD) users and groups to RBAC users and groups. Although not enabled by default, this post shows how to enable AAD mapping to RBAC.

A Simple RBAC Definition for AKS

With AAD integration enabled, groups and users are mapped directly to RBAC. Users are mapped using their user name (generally email) while groups are mapped using the group object ID.

apiVersion: rbacmanager.reactiveops.io/v1beta1
kind: RBACDefinition
metadata:
  name: sample-config
rbacBindings:
  - name: web-developers
    subjects:
      - kind: User
        name: [email protected]
      - kind: User
        name: [email protected]
    roleBindings:
      - clusterRole: edit
        namespace: web
  - name: sample-group
    subjects:
      - kind: Group
        name: 894656e1-39f8-4bfe-b16a-510f61af6f41
    roleBindings:
      - clusterRole: edit
        namespace: api

Because group IDs are not easy to understand in a Kubernetes context, we generally recommend sticking with AAD users and using RBAC Definitions to group them. This ensures that all authorization config for Kubernetes stays within Kubernetes.