Repository navigation
Add AKS Kubernetes RBAC with Microsoft Entra groups quickstart - #496
Rebecca Calixte (Rebecca-Calixte) merged 9 commits into
Conversation
GitHub Actions
Failure
… succeeds Co-authored-by: Rebecca-Calixte <262454636+Rebecca-Calixte@users.noreply.github.com>
…tart Co-authored-by: Rebecca-Calixte <262454636+Rebecca-Calixte@users.noreply.github.com>
|
The E2E check is failing because this sample intentionally requires four user-provided values: an existing AKS resource group, cluster name, and two existing Entra group object IDs. The walkthrough documents these prerequisites, so there aren’t safe default values to provide. Should this prerequisite-based sample receive an E2E exception, or is there an approved method for supplying test prerequisites in this repository? |
…uickstart Co-authored-by: vranade-microsoft <269690592+vranade-microsoft@users.noreply.github.com>
|
Root cause and fix: Root cause: The e2e-check job runs terraform apply -input=false -auto-approve on each changed quickstart with no variables. quickstart/101-aks-entra-k8s-rbac intentionally requires four caller-supplied values (resource_group_name, aks_cluster_name, appdev_group_object_id, opssre_group_object_id), so apply failed with Error: No value for required variable. Fix (using the repo's sanctioned pattern for prerequisite-based samples, as in 202-machine-learning-moderately-secure-existing-VNet): Added quickstart/101-aks-entra-k8s-rbac/prequisite/ which creates a resource group, an AKS cluster with Microsoft Entra integration and Kubernetes RBAC (azure_rbac_enabled = false), and the two Entra security groups, exporting them as outputs. Note on the review comment about the folder name: prequisite is intentional — it matches the existing folder name and the prequistePath variable used by 202-machine-learning-moderately-secure-existing-VNet, so renaming it here would break consistency with the established convention. |
GitHub Actions
Failure
Co-authored-by: vranade-microsoft <269690592+vranade-microsoft@users.noreply.github.com>
Co-authored-by: vranade-microsoft <269690592+vranade-microsoft@users.noreply.github.com>
Co-authored-by: vranade-microsoft <269690592+vranade-microsoft@users.noreply.github.com>
Vishwajeet Ranade (vranade-microsoft)
left a comment
Vishwajeet Ranade (vranade-microsoft)
left a comment
There was a problem hiding this comment.
Approving copilot changes. No manual changes involved.
Co-authored-by: vranade-microsoft <269690592+vranade-microsoft@users.noreply.github.com>
Vishwajeet Ranade (vranade-microsoft)
left a comment
Vishwajeet Ranade (vranade-microsoft)
left a comment
There was a problem hiding this comment.
Approving changes made by Copilot. No manual edits involved.
* docs(aks): add Terraform deployment option for Kubernetes RBAC with Entra ID Add a Terraform pivot to kubernetes-rbac-entra-id.md using the azure-cli-or-terraform zone pivot group, sourced from the Azure/terraform quickstart/101-aks-entra-k8s-rbac sample (Azure/terraform#496, merged). - Add zone_pivot_groups: azure-cli-or-terraform and devx-track-terraform - Replace the outdated generic Terraform prerequisite bullet with a pivot="terraform" prerequisites block (Terraform >=1.6.0, kubectl, required RBAC/Kubernetes permissions, existing groups/users) - Pivot the az role assignment create steps in Create groups in Microsoft Entra ID so Terraform users skip them (Terraform creates the role assignments) - Pivot the existing kubectl-based Create AKS cluster resources tabs under pivot="azure-cli", and add a pivot="terraform" section documenting the sample's two-stage workflow: the optional prequisite/ configuration (test AKS cluster with Entra integration and Kubernetes RBAC, note that its group object ID outputs are test stand-ins, not real Entra groups) and the scenario main.tf configuration (role assignments, namespaces, Roles, RoleBindings), each with its own state, using whole-file [!code-terraform[master](...)] includes for prequisite/versions.tf, prequisite/variables.tf, prequisite/main.tf, prequisite/outputs.tf, and main.tf - Add init/fmt/validate/plan/apply steps for both stages, namespace verification, and guarded terraform destroy cleanup in dependency order (scenario before prequisite) - Split the Clean up cluster resources block so the namespace-delete commands are azure-cli-only, cross-reference the new Terraform cleanup steps, and keep the shared Entra user/group deletion commands common to both pivots - Add the kubectl-overview reference link Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Apply Learn Authoring Assistant style suggestions Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: asudbring <26909696+asudbring@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Summary
Adds a Terraform quickstart for using Microsoft Entra ID groups with Kubernetes role-based access control (Kubernetes RBAC) in Azure Kubernetes Service (AKS).
The sample demonstrates how to scope existing Microsoft Entra groups to separate Kubernetes namespaces by using AKS Cluster User role assignments, Kubernetes Roles, and RoleBindings.
Includes
devandsreKubernetes namespacesValidation
terraform fmtcompleted successfullyterraform init -backend=falsecompleted successfullyterraform validatecompleted successfully