With the federated control plane in place we are ready to start adding clusters to our federation.

When you get started with Kubernetes, the first thing you will probably do is create a Deployment using the kubectl command-line interface. When you create an object in Kubernetes, including a Deployment, you must provide the object spec that describes its desired state, as well as some basic information about the object (such as a name). Most often, you provide this information using a YAML. I've created a Kubernetes cluster on AWS with kops and can successfully administer it via kubectl from my local machine. I can view the current config with kubectl config view as well as directly.

Kubectl Generate Client-key-data Code

To add a cluster to the federation you will need to perform the following steps:

Kubectl Generate Client-key-data Video

• Create kubeconfig for each cluster and store it in a Kubernetes secret on the host cluster
• Create a cluster resource for each cluster in the federation cluster

Prerequisites

Generate kubeconfigs and cluster objects

In this section you will generate a kubeconfig and cluster resource object for each cluster in the federation.

Create the Cluster Secrets

In this section you will create a secret to hold the kubeconfig for each cluster.

Create the cluster resources

Verify

-->

You can interact with Kubernetes clusters using the kubectl tool. The Azure CLI provides an easy way to get the access credentials and configuration information to connect to your AKS clusters using kubectl. To limit who can get that Kubernetes configuration (kubeconfig) information and to limit the permissions they then have, you can use Azure role-based access controls (RBAC).

This article shows you how to assign RBAC roles that limit who can get the configuration information for an AKS cluster.

Before you begin

This article assumes that you have an existing AKS cluster. If you need an AKS cluster, see the AKS quickstart using the Azure CLI or using the Azure portal.

This article also requires that you are running the Azure CLI version 2.0.65 or later. Run az --version to find the version. If you need to install or upgrade, see Install Azure CLI.

Available cluster roles permissions

When you interact with an AKS cluster using the kubectl tool, a configuration file is used that defines cluster connection information. This configuration file is typically stored in ~/.kube/config. Multiple clusters can be defined in this kubeconfig file. You switch between clusters using the kubectl config use-context command.

The az aks get-credentials command lets you get the access credentials for an AKS cluster and merges them into the kubeconfig file. You can use Azure role-based access controls (RBAC) to control access to these credentials. These Azure RBAC roles let you define who can retrieve the kubeconfig file, and what permissions they then have within the cluster.

The two built-in roles are:

• Azure Kubernetes Service Cluster Admin Role
  • Allows access to Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action API call. This API call lists the cluster admin credentials.
  • Downloads kubeconfig for the clusterAdmin role.
• Azure Kubernetes Service Cluster User Role
  • Allows access to Microsoft.ContainerService/managedClusters/listClusterUserCredential/action API call. This API call lists the cluster user credentials.
  • Downloads kubeconfig for clusterUser role.

These RBAC roles can be applied to an Azure Active Directory (AD) user or group.

Kubectl Generate Client-key-data Online

![NOTE]On clusters that use Azure AD, users with the clusterUser role have an empty kubeconfig file that prompts a log in. Once logged in, users have access based on their Azure AD user or group settings. Users with the clusterAdmin role have admin access.

Clusters that do not use Azure AD only use the clusterAdmin role.

Assign role permissions to a user or group

To assign one of the available roles, you need to get the resource ID of the AKS cluster and the ID of the Azure AD user account or group. The following example commands:

• Get the cluster resource ID using the az aks show command for the cluster named myAKSCluster in the myResourceGroup resource group. Provide your own cluster and resource group name as needed.
• Use the az account show and az ad user show commands to get your user ID.
• Finally, assign a role using the az role assignment create command.

The following example assigns the Azure Kubernetes Service Cluster Admin Role to an individual user account:

Tip

If you want to assign permissions to an Azure AD group, update the --assignee parameter shown in the previous example with the object ID for the group rather than a user. To obtain the object ID for a group, use the az ad group show command. The following example gets the object ID for the Azure AD group named appdev: az ad group show --group appdev --query objectId -o tsv

You can change the previous assignment to the Cluster User Role as needed.

The following example output shows the role assignment has been successfully created:

Get and verify the configuration information

With RBAC roles assigned, use the az aks get-credentials command to get the kubeconfig definition for your AKS cluster. The following example gets the --admin credentials, which work correctly if the user has been granted the Cluster Admin Role:

You can then use the kubectl config view command to verify that the context for the cluster shows that the admin configuration information has been applied:

Kubectl Generate Client-key-data Download

Remove role permissions

Kubectl Generate Client-key-data Free

To remove role assignments, use the az role assignment delete command. Specify the account ID and cluster resource ID, as obtained in the previous commands. If you assigned the role to a group rather than a user, specify the appropriate group object ID rather than account object ID for the --assignee parameter:

Next steps

Kubectl Generate Client-key-data File

For enhanced security on access to AKS clusters, integrate Azure Active Directory authentication.