Azure-devops-docs: Azure DevOps created a service account with cluster-admin role for a RBAC-enabled cluster

Created on 12 Jun 2020 · 3Comments · Source: MicrosoftDocs/azure-devops-docs

1) Created a new AKS cluster in the Azure portal
2) Enabled RBAC
3) Selected the new AKS cluster and namespace in the Azure DevOps "Add Kubernetes Resource" inside an Environment
4) Used kubectl to examine what Azure DevOps did
5) Verified Azure DevOps created a service account with cluster-admin role for a RBAC-enabled cluster

New service account:

kubectl get serviceaccount --namespace test
NAME              SECRETS   AGE
azdev-sa-403636   1         37m

New RoleBinding:

kubectl get rolebinding --namespace test -o json
            "roleRef": {
                "apiGroup": "rbac.authorization.k8s.io",
                "kind": "ClusterRole",
                "name": "cluster-admin"
            },
            "subjects": [
                {
                    "kind": "ServiceAccount",
                    "name": "azdev-sa-403636",
                    "namespace": "test"
                }

According to the documentation, the service account should be least-privileged:

For an RBAC enabled cluster, RoleBinding is created as well to limit the scope of the created service account to the chosen namespace. For an RBAC disabled cluster, the ServiceAccount created has cluster-wide privileges (across namespaces).

Either the documentation needs to be updated to say _For an RBAC enabled cluster, the ServiceAccount created has a cluster-admin role_ or the DevOps bug needs to be corrected.