Page Comparison

If Active Directory integration is enabled for AKS cluster, Azure allows to get access to AKS cluster resources (pods, nodes, etc) automatically using authorization via AD.

Set up the cluster role binding in AKS cluster for the Azure Application that has been added into Cloudaware.

Access Setup

1. Locate the service principal ID of the Azure App added to Cloudaware. Log in to Azure Portal → Azure Active Directory → Enterprise applications → select the app. Copy and save the Object ID. This which is the unique ID of the service principal object associated with this application.

Image Removed

Image Added

2. In your AKS cluster create cloudaware-rbac.yaml using the section below:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cloudaware-reader
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["get", "watch", "list"]
---
kind: ClusterRoleBinding
metadata:
  name: <sp-role-binding>
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: <cluster-admin>
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: <service-principal-object-id>

WHERE

in ClusterRoleBinding:

<sp-role-binding> in metadata is a placeholder that needs to be replaced by your Cluster Role Binding name

<cluster-admin> in roleRef is a placeholder that needs to be replaced by your Cluster Role name

<service-principal-object-id> insubjects is a placeholder that needs to be replaced by your Azure Application Object ID

3. Run the following command:

kubectl create -f cloudaware-rbac.yaml

Further Configuration

List of AKS Objects

Cloudaware supports the following AKS cluster objects: