CODEWITHSUNDEEP
azurekubernetesazure-aksazure-rbac
Zander Fick
Zander Fick

Reputation: 116

Cannot Create Azure AKS Namespace with Azure Kubernetes Service RBAC Admin role

I've deployed an Azure Kubernetes Service with the Azure AD authentication with Azure RBAC Authentication mode configured.

I have given myself the

- roles.

And with this I can:

Across all namespaces.

However neither of these allow me to create a namespace, and from what I can tell no obvious other roles touch on this permission.

For example kubectl create namespace test-namespace Raises:

Error from server (Forbidden): namespaces is forbidden: User "USER AZURE AD" cannot create resource "namespaces" in API group "" at the cluster scope: User does not have access to the resource in Azure. Update role assignment to allow access.

I am aware that pulling credentials with az aks get-credentials -g {Resource Group} --name {CLUSTER NAME} --admin is a workaround, but this particular cluster cannot have Kubertnetes local accounts enabled so this is not an option.

What can I do?

Upvotes: 0

Views: 1381

Answers (1)

Imran
Imran

Reputation: 5570

To resolve this issue, create one custom RBAC role with Microsoft.ContainerService/managedClusters/namespaces/write permission under your subscription:

enter image description here

Clone a role with Azure Kubernetes service RBAC Admin:

enter image description here

In permission tab you can find NotDataActions remove the Microsoft.ContainerService/managedClusters/namespaces/write from NotDataActions and add the same permission:

enter image description here

enter image description here

Once the custom role is created, now assign the role assignment:

enter image description here

When I run the namespace command got desired output:

kubectl create namespace test-namespace

Output

Reference: Azure built-in roles - Azure RBAC | Microsoft Learn

Upvotes: 1

Related Questions