Use Kubernetes RBAC with Microsoft Entra ID in AKS

If you plan to use Terraform to configure Kubernetes RBAC for this article, you also need:

• Terraform version 1.6.0 or later installed.
• kubectl installed and configured to connect to your AKS cluster. kubectl is automatically installed when you run az aks install-cli or as part of the Azure Cloud Shell.
• Permission to create Azure role assignments at the scope of your AKS cluster, and permission to manage Kubernetes resources on the cluster.
• Two existing Microsoft Entra groups and, optionally, two existing Microsoft Entra test users to validate access with. If you don't have these resources yet, complete Create groups in Microsoft Entra ID and Create users in Microsoft Entra ID before continuing. However, skip the az role assignment create command in that section, since the Terraform configuration in this article creates the role assignments for you.

Review the Terraform code

The sample uses two Terraform configurations, each in its own directory with its own state:

• The prequisite configuration creates a resource group and an AKS cluster with Microsoft Entra integration and Kubernetes RBAC enabled, which the repository's own end-to-end tests use to validate the scenario configuration against a real cluster. If you already have an AKS cluster that meets this article's prerequisites, skip this configuration and use your own resource group name, cluster name, and Microsoft Entra group object IDs with the scenario configuration instead.
• The scenario configuration, in the root of the sample, assigns the Azure Kubernetes Service Cluster User Role to the appdev and opssre groups at the cluster scope. It also creates the dev and sre Kubernetes namespaces with namespace-scoped Roles and RoleBindings that grant each group access only to its own namespace.

Terraform authenticates by using your Azure CLI sign-in context. Before you continue, ensure you're signed in by using az login and have selected the correct subscription by using az account set --subscription .

Deploy the prerequisite AKS cluster with Terraform

1. Create a directory named prequisite and make it your current directory.

2. Create a file named versions.tf and insert the following code:

   terraform {
     required_version = ">= 1.6.0"
   
     required_providers {
       azurerm = {
         source  = "hashicorp/azurerm"
         version = "~> 4.0"
       }
       random = {
         source  = "hashicorp/random"
         version = "~> 3.6"
       }
     }
   }
   
   provider "azurerm" {
     features {
       resource_group {
         prevent_deletion_if_contains_resources = false
       }
     }
   }
   

3. Create a file named variables.tf and add the following code:

   variable "location" {
     type        = string
     default     = "eastus"
     description = "Location of the resources."
   }
   
   variable "node_count" {
     type        = number
     default     = 1
     description = "Number of nodes in the default node pool of the AKS cluster."
   }
   

4. Create a file named main.tf and add the following code:

   data "azurerm_client_config" "current" {}
   
   resource "random_string" "suffix" {
     length  = 6
     special = false
     upper   = false
   }
   
   resource "azurerm_resource_group" "rg" {
     location = var.location
     name     = "rg-101-aks-entra-k8s-rbac-${random_string.suffix.result}"
   }
   
   resource "azurerm_kubernetes_cluster" "aks" {
     location            = azurerm_resource_group.rg.location
     name                = "aks-101-entra-k8s-rbac-${random_string.suffix.result}"
     resource_group_name = azurerm_resource_group.rg.name
     dns_prefix          = "aks-${random_string.suffix.result}"
     # Kubernetes RBAC is required by the example, Azure RBAC for Kubernetes
     # Authorization must stay disabled.
     role_based_access_control_enabled = true
   
     default_node_pool {
       name       = "agentpool"
       node_count = var.node_count
       vm_size    = "Standard_D2s_v3"
     }
   
     identity {
       type = "SystemAssigned"
     }
   
     azure_active_directory_role_based_access_control {
       azure_rbac_enabled = false
       tenant_id          = data.azurerm_client_config.current.tenant_id
     }
   }
   

5. Create a file named outputs.tf and insert the following code:

   output "resource_group_name" {
     description = "Name of the resource group that contains the AKS cluster."
     value       = azurerm_resource_group.rg.name
   }
   
   output "aks_cluster_name" {
     description = "Name of the AKS cluster with Microsoft Entra integration and Kubernetes RBAC enabled."
     value       = azurerm_kubernetes_cluster.aks.name
   }
   
   output "appdev_group_object_id" {
     description = "Object ID of the existing test principal used for developer access."
     value       = data.azurerm_client_config.current.object_id
   }
   
   output "opssre_group_object_id" {
     description = "Object ID of the existing test principal used for SRE access."
     value       = azurerm_kubernetes_cluster.aks.identity[0].principal_id
   }
   

6. Initialize, format, and validate the configuration.

   terraform init
   terraform fmt
   terraform validate
   

7. Review and apply the configuration.

   terraform plan -out main.tfplan
   terraform apply main.tfplan
   

8. Get the outputs. You use these values as input for the scenario configuration in the next section.

   terraform output -raw resource_group_name
   terraform output -raw aks_cluster_name
   terraform output -raw appdev_group_object_id
   terraform output -raw opssre_group_object_id
   

Deploy Kubernetes RBAC with Terraform

1. Create a new directory, separate from prequisite, and make it your current directory. This configuration has its own Terraform state and doesn't manage or depend on the state of the prequisite configuration.

2. Create a file named main.tf and add the following code:

   terraform {
     required_version = ">= 1.6.0"
   
     required_providers {
       azurerm = {
         source  = "hashicorp/azurerm"
         version = "~> 4.0"
       }
       kubernetes = {
         source  = "hashicorp/kubernetes"
         version = "~> 2.30"
       }
     }
   }
   
   provider "azurerm" {
     features {}
   }
   
   variable "resource_group_name" {
     type        = string
     description = "Name of the resource group that contains the existing AKS cluster."
   }
   
   variable "aks_cluster_name" {
     type        = string
     description = "Name of the existing AKS cluster with Microsoft Entra integration and Kubernetes RBAC enabled."
   }
   
   variable "appdev_group_object_id" {
     type        = string
     description = "Object ID of an existing Microsoft Entra group used for developer access to the dev namespace."
   }
   
   variable "opssre_group_object_id" {
     type        = string
     description = "Object ID of an existing Microsoft Entra group used for SRE access to the sre namespace."
   }
   
   data "azurerm_kubernetes_cluster" "aks" {
     name                = var.aks_cluster_name
     resource_group_name = var.resource_group_name
   }
   
   provider "kubernetes" {
     host                   = data.azurerm_kubernetes_cluster.aks.kube_admin_config[0].host
     client_certificate     = base64decode(data.azurerm_kubernetes_cluster.aks.kube_admin_config[0].client_certificate)
     client_key             = base64decode(data.azurerm_kubernetes_cluster.aks.kube_admin_config[0].client_key)
     cluster_ca_certificate = base64decode(data.azurerm_kubernetes_cluster.aks.kube_admin_config[0].cluster_ca_certificate)
   }
   
   resource "azurerm_role_assignment" "appdev_cluster_user" {
     scope                = data.azurerm_kubernetes_cluster.aks.id
     role_definition_name = "Azure Kubernetes Service Cluster User Role"
     principal_id         = var.appdev_group_object_id
   }
   
   resource "azurerm_role_assignment" "opssre_cluster_user" {
     scope                = data.azurerm_kubernetes_cluster.aks.id
     role_definition_name = "Azure Kubernetes Service Cluster User Role"
     principal_id         = var.opssre_group_object_id
   }
   
   resource "kubernetes_namespace" "dev" {
     metadata {
       name = "dev"
     }
   }
   
   resource "kubernetes_namespace" "sre" {
     metadata {
       name = "sre"
     }
   }
   
   resource "kubernetes_role" "dev_full_access" {
     metadata {
       name      = "dev-user-full-access"
       namespace = kubernetes_namespace.dev.metadata[0].name
     }
   
     rule {
       api_groups = ["", "extensions", "apps"]
       resources  = ["*"]
       verbs      = ["*"]
     }
   
     rule {
       api_groups = ["batch"]
       resources  = ["jobs", "cronjobs"]
       verbs      = ["*"]
     }
   }
   
   resource "kubernetes_role" "sre_full_access" {
     metadata {
       name      = "sre-user-full-access"
       namespace = kubernetes_namespace.sre.metadata[0].name
     }
   
     rule {
       api_groups = ["", "extensions", "apps"]
       resources  = ["*"]
       verbs      = ["*"]
     }
   
     rule {
       api_groups = ["batch"]
       resources  = ["jobs", "cronjobs"]
       verbs      = ["*"]
     }
   }
   
   resource "kubernetes_role_binding" "dev_user_access" {
     metadata {
       name      = "dev-user-access"
       namespace = kubernetes_namespace.dev.metadata[0].name
     }
   
     role_ref {
       api_group = "rbac.authorization.k8s.io"
       kind      = "Role"
       name      = kubernetes_role.dev_full_access.metadata[0].name
     }
   
     subject {
       kind      = "Group"
       name      = var.appdev_group_object_id
       api_group = "rbac.authorization.k8s.io"
     }
   }
   
   resource "kubernetes_role_binding" "sre_user_access" {
     metadata {
       name      = "sre-user-access"
       namespace = kubernetes_namespace.sre.metadata[0].name
     }
   
     role_ref {
       api_group = "rbac.authorization.k8s.io"
       kind      = "Role"
       name      = kubernetes_role.sre_full_access.metadata[0].name
     }
   
     subject {
       kind      = "Group"
       name      = var.opssre_group_object_id
       api_group = "rbac.authorization.k8s.io"
     }
   }
   

3. Create a file named terraform.tfvars and provide the resource group name and cluster name for the AKS cluster you want to configure, and the object IDs of the appdev and opssre groups.

   resource_group_name    = ""
   aks_cluster_name       = ""
   appdev_group_object_id = ""
   opssre_group_object_id = ""
   

4. Initialize, format, and validate the configuration.

   terraform init
   terraform fmt
   terraform validate
   

5. Review and apply the configuration.

   terraform plan -out main.tfplan
   terraform apply main.tfplan
   

   The configuration creates the Azure role assignments for both groups, the dev and sre Kubernetes namespaces, and namespace-scoped Roles and RoleBindings that grant the appdev group access to dev and the opssre group access to sre.

Verify namespace access

1. Get the cluster admin credentials by using the az aks get-credentials command.

   az aks get-credentials --resource-group myResourceGroup --name myAKSCluster --admin
   

2. Verify that both namespaces exist by using the kubectl get namespaces command.

   kubectl get namespaces
   

   The output shows the dev and sre namespaces, along with the default namespaces created for the cluster.

To test that the appdev and opssre groups can access only their assigned namespace, continue to Access AKS cluster resources with Microsoft Entra identities.

Clean up Terraform resources

1. From the scenario configuration directory, remove the Azure role assignments, namespaces, Roles, and RoleBindings it created.

   terraform destroy
   

2. If you deployed the prequisite AKS cluster only to test this sample and no longer need it, remove it from the prequisite directory after the scenario configuration finishes destroying its resources.

   terraform destroy
   

Get the admin kubeconfig context and delete the dev and sre namespaces. This action also deletes the pods, Roles, and RoleBindings.

az aks get-credentials --resource-group myResourceGroup --name myAKSCluster --admin

kubectl delete namespace dev
kubectl delete namespace sre

If you used Terraform to create the dev and sre namespaces, Roles, and RoleBindings, see Clean up Terraform resources instead of running kubectl delete namespace.