CODEWITHSUNDEEP
azureazure-active-directoryrbacazure-aks
Ludo
Ludo

Reputation: 109

connect AAD to existing AKS that has

Working with Azure, we started with AKS last year. On creation of the AKS clusters we use, we checked what needed to be done up front to enable rbac at a later moment and we then thought that setting 'rbac' to 'enabled' was the only thing we needed. This results in the following:

enter image description here

Now we're trying to implement rbac integration of AKS with AAD, but I read some seemingly conflicting pre-requisites. Some say that in order to integrate AAD and AKS, you need rbac enabled at cluster creation. I believe we have set that correct, looking at the picture above. But then in the Azure docs, it is mentioned that you need to create a cluster and add some AAD-integration keys for the client and server applications.

My question is actually two-fold:

  1. when people say you need rbac enabled in your aks cluster during creation do they actually mean you should select the 'rbac:enabled' box AND make sure you create the AAD-related applications up front and also configure these during cluster creation?
  2. Is there a way to setup the AKS-AAD rbac connection on a cluster that has rbac:enabled but misses the aadProfile configuration?

I believe we indeed need to re-create all our clusters, but I want to know for sure by asking here as it's not 100% clear to me from what I've read online (also here at stack exchange) and it's going to be an awful lot of work.

Upvotes: 1

Views: 433

Answers (2)

Charles Xu
Charles Xu

Reputation: 31384

For all of your requirements, you only need to make sure the RBAC enabled for your AKS cluster and it only can enable in the creation time. Then you can update the credential of the existing AKS AAD profile like this:

Before update:

enter image description here

CLI update command:

az aks update-credentials -g yourResourceGroup -n yourAKSCluster --reset-aad --aad-server-app-id appId --aad-server-app-secret appSecret --aad-client-app-id clientId --aad-tenant-id tenantId

After update:

enter image description here

Upvotes: 2

4c74356b41
4c74356b41

Reputation: 72151

  1. yes, that is correct
  2. no, there is no way of doing that. you need to recreate.

Upvotes: 0

Related Questions