Azure-docs: Limiting who can assume Admin

[justinhauer]

What is the method that Microsoft is recommending, of limiting who can log into the cluster with the “—admin” flag? If my organization eventually rolls this out to more groups with access to Azure and AKS, we would like to limit who is able to log into the cluster as an admin. Currently, even with RBAC enabled, it seems that anyone is still able to just add a --admin flag to the get credentials command and assume admin (not good).

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: a47c6df7-5103-1336-eb0b-68f95155e6c8
• Version Independent ID: f4420b08-9b57-f581-fcb4-f069afdd5b0c
• Content: Integrate Azure Active Directory with Azure Kubernetes Service
• Content Source: articles/aks/aad-integration.md
• Service: container-service
• GitHub Login: @neilpeterson
• Microsoft Alias: nepeters

[neilpeterson]

@jdogg89 - good question, please stand-by.

[neilpeterson]

I am still working on the exact steps, however it seems a custom Azure RBAC role can be created to limit access to the --admin based kubeconfig file.

We will get these steps published once fleshed out.

[neilpeterson]

We are tracking in and internal system and will get the docs updated once resolved. I am closing this doc issue for the time being.

please-close

[SaurabhSharma-MSFT]

@jdogg89 We will now proceed to close this thread. If there are further questions regarding this matter, please reopen it and we will gladly continue the discussion.

[jrhoward]

I'm hanging on this one. How can I get updated when it is resolved ?

[neilpeterson]

@jrhoward after some discussion with @iainfoulds, we want to keep this open until the technical resolution comes through.

@SaurabhSharma-MSFT / @MicahMcKittrick-MSFT can we open this back up - thanks.

[neilpeterson]

in-progress

[femsulu]

@jdogg89 We will now close this issue. If there are further questions regarding this matter, please reopen it and we will gladly continue the discussion.

[DmitriyDranenkoDevPro]

@iainfoulds @neilpeterson @femsulu
Why was the issue closed?
What is the solution regarding this?

[praveendhac]

What is the fix? Closed #12409 and #10754 without stating exact fix, assuming the fix is updating below document.
https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations

I was working on same issue, blocking "--admin" using "/managedClusters/listClusterAdminCredential/action" which does not work as expected, created #13517

[marty2bell]

Is there a resolution to this issue......it seems a bit pointless going to the trouble of integrating AKS with Active Directory if we can't block users from issuing

az aks get-credentials --admin

[praveendhac]

Login to portal and browse to Subscriptions -> Accesscontrol(IAM) -> Roles. It was not properly communicated by Azure.

Azure Kubernetes Service Cluster User Role
Azure Kubernetes Service Cluster Admin Role

[marty2bell]

Thanks @praveendhac, that makes sense now!