AKS RBAC - Rolebinding has no effect

Question

I'm setting up RBAC in my AKS cluster which is integrated with Azure AD following the instructions here. I have created an AD group in my AAD tenant, added a user to it. Then the group is assigned "Cluster User role" in the AKS cluster as per the instructions. Created a Role and Rolebinding as shown below:

Role:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: development
  name: restricted-role
rules:
- apiGroups: [""] 
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

RoleBinding:

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: development
subjects:
- kind: Group
  name: 308f50cb-e05a-4340-99d4-xxxxxxxb 
  apiGroup: rbac.authorization.k8s.io
  namespace: development
roleRef:
  kind: Role 
  name: restricted-role 
  apiGroup: rbac.authorization.k8s.io

I then tried login using the new user credentials:

az login --username [email protected] --password xxxx

az aks get-credentials --name mycluster --resource-group myrg --overwrite-existing

As per the documentation, I should be only allowed to do kubectl get pods on the development namespace. However, using this new user credentials, I see that I can do kubectl get pods --all-namespaces, kubectl get svc --all-namespaces etc. and view the results, as if the Rolebinding does not have any impact at all. I also have verified by checking that my cluster has

"enableRBAC": true

Can someone please tell me what is wrong with this configuration?

what kind of kubeconfig file you get after the last command? Does it contain a section like: user: auth-provider: config: apiserver-id: <appserverid> client-id: <clientid> environment: AzurePublicCloud tenant-id: <tenant> name: azure — Alessandro Vozza
No. My kube config has api version, cluster, certificate-authority-data, server, name, contexts, namespace and users — Thomas
then it seems your cluster is not AAD-enabled. Can you run the command: az aks show -g <rg> -n <clusterName> --query aadProfile — Alessandro Vozza
thanks, for some reason my AAD integration wasn't correctly set. I did a reset and then it started working. Thank you — Thomas
Well, you can add an answer to display the solution for the communities who are looking for it. — Charles Xu

Alessandro Vozza Alessandro Vozza · Accepted Answer · 2020-02-19T22:45:08

Using the command:

az aks show -g <rg> -n <clusterName> --query aadProfile

you can confirm if the cluster is AAD enabled. If enabled, the kubeconfig file you get from:

az aks get-credentials -g <rg_name> -n <aks_name>

should look like:

user:
  auth-provider:
    config:
      apiserver-id: <appserverid>
      client-id: <clientid>
      environment: AzurePublicCloud
      tenant-id: <tenant>
    name: azure

AKS RBAC - Rolebinding has no effect

1 Answers