Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PMFR4PLTFND-1316: add rbac_aad_azure_rbac_enabled var #409

Open
wants to merge 1 commit into
base: staging
Choose a base branch
from

Conversation

ajeffowens
Copy link
Contributor

Ran two tests. One with rbac_aad_azure_rbac_enabled set to true, which produced an aks cluster with:

Authentication and Authorization
Microsoft Entra ID authentication with Azure RBAC

and another with the variable omitted entirely, which produced an aks cluster with:

Authentication and Authorization
Microsoft Entra ID authentication with Kubernetes RBAC

which is consistent with current default behavior

@riragh
Copy link
Member

riragh commented Nov 19, 2024

Few comments about this PR:

  • Starting Kubernetes v1.26, the azure auth provider was removed from the kubectl binary, so user would need an alternative method to be able to authenticate to AKS. With Azure RBAC enabled, for non-interactive seamless authentication (which also helps DAC) we would need to use kubelogin. I don't see any code around that.
  • We would need some documentation on how to authenticate as using the kubeconfig generated by IAC will return error.
  • Additionally, if my memory serves me well, we need to disable local_accounts when using Azure RBAC.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants