Azure Kubernetes Error when running “az aks get-credentials” command

0
votes

Azure Admins created a cluster for us. On VM I installed "az cli" and "kubectl". With my account from Azure Portal I can see that Kubernetes Service and Resource Group to which it belongs. From the level of that cluster in Azure Portal I can see that I have a role:

"AKS Cluster Admin Operator"

I am logged on VM with kubectl with my account. I need to config my kubectl to work with our cluster. When I try to execute:

az aks get-credentials --resource-group FRONT-AKS-NA2 --name front-aks

I am getting error:

ForbiddenError: The client 'my_name@my_comp.COM' with object id '4ea46ad637c6' does not have authorization to perform action 'Microsoft.ContainerService/managedClusters/listClusterUserCredential/action' over scope '/subscriptions/89e05d73-8862-4007-a700-0f895fc0f7ea/resourceGroups/FRONT-AKS-NA2/providers/Microsoft.ContainerService/managedClusters/front-aks' or the scope is invalid. If access was recently granted, please refresh your credentials.

2
azurekubernetesazure-aks
Try with az aks get-credentials --resource-group FRONT-AKS-NA2 --name front-aks --admin - Hackerman
@Hackerman hey it works! Thanks!!! can you let me know the difference if I should use kubectl command with Admin or regular ClusterUser role? what's the difference? - AndreyDonald
@Hackerman is it safe and enough to use this Admin instead of the default Cluster User role? Thank you for answer it really helped - AndreyDonald

2 Answers

2
votes

Well, I see the comment, and you already get the solution. So I just can explain the difference to you. Hope it will help you!

When you use the command az aks get-credentials without parameter --admin, it means the CLI command uses the default value: Cluster user. And when you use the cluster user, it just works if you integrate AKS with the AAD. But you said you just have the AKS Cluster Admin Operator role, so the appropriate parameter is --admin. You can get more details here.

And on my side, it's a little dangerous. If the AKS cluster is just for the test, there is no problem. But if it's for production, I recommend you integrate with the AAD, and then give the appropriate permissions to the user. Because the admin user means you have all the permissions, you know, it's not safe.

1
votes

In my case to refresh recently granted credentials helped this one:

az account set --subscription "your current subscription name"

It led to re-login and fix the issue.