As of now what i did is that, Created kubernetes cluster and enabled RBAC in web UI while creating the cluster.Inside the cluster i created a namespace named as development1.Now i wanted to give access to a user on some kubernetes resources which are belongs to development1 namespace.For that i created a role and add a user for a particular namespace.
Here is my configuration files:
deployment.yaml
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: hellonode
namespace: development1
spec:
replicas: 2
template:
metadata:
labels:
app: samplenodeapp
spec:
containers:
- name: hellonode
image: hellonode.azurecr.io/aks-deployments:latest
ports:
- containerPort: 3000
imagePullSecrets:
- name: webinar
service.yaml
apiVersion: v1
kind: Service
metadata:
name: hellonode
namespace: development1
labels:
app: samplenodeapp
spec:
type: LoadBalancer
ports:
- port: 3000
selector:
app: samplenodeapp
role.yaml
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
namespace: development1
name: developer-role
rules:
- apiGroups: ["", "extensions", "apps"]
resources: ["deployments", "replicasets"]
verbs: ["*"]
rules:
- apiGroups: [""]
resources: ["pods","pods/log","pods/exec"]
verbs: ["get", "list", "watch", "create", "update", "patch"]
rolebinding.yaml
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: developer-rb
namespace: development1
subjects:
- kind: User
name: < Azure_AD_user_object-id>
apiGroup: "rbac.authorization.k8s.io"
roleRef:
kind: Role
name: developer-role
apiGroup: "rbac.authorization.k8s.io"
Now i am trying to list the pods in deveploment1(namespace) using the command kubectl get pods -n development --user=<Azure _AD_username>
. Instead of list the pods, getting the error like
error: You must be logged in to the server (Unauthorized).
Here my doubts are, Is there any necessity to create context for that namespace? and shall i add role in deployment.yaml and service.yaml?
I don't know something which i missed. Could any anybody suggest me, how can i give the permissions for a user on kubernetes resources in Azure?
you need to login to Azure Cli as that Azure AD user and pull the k8s config as that user (az aks get-credentials -n xxx -g xxx) and run kubectl get po -n development
. I'm not sure what --user
parameter means, but I would expect it to try and use that user from your kubeconfig (which you dont have). I cant find any references to allowing user impersonalisation using kubectl.
Dont forget to purge your kubeconfig before hand.