Configuring Azure Active Directory integration with Azure Kubernetes Service

Question

Pulumi · Accepted Answer

To configure Azure Active Directory (AAD) integration with Azure Kubernetes Service (AKS), you'll need to set up an AKS cluster with Azure AD authentication enabled. This integration allows you to control access to the Kubernetes cluster by using Azure's identity management.

For this purpose, we'll be using the azure-native.containerservice.ManagedCluster resource from the azure-native provider. This resource allows us to create and configure an AKS cluster.

Below is a Pulumi TypeScript program that demonstrates how to set up an AKS cluster with Azure AD integration:

import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const config = new pulumi.Config();

// Replace these with your Azure AD application and tenant details
const aadClientAppId = config.require("aadClientAppId");
const aadServerAppId = config.require("aadServerAppId");
const aadServerAppSecret = config.requireSecret("aadServerAppSecret");
const aadTenantId = config.require("aadTenantId");

// Create a new AKS cluster with AAD integration
const aksCluster = new azure_native.containerservice.ManagedCluster("aksCluster", {
    resourceName: "myAksCluster",
    resourceGroupName: config.require("resourceGroupName"),
    location: config.require("location"),
    identity: {
        type: "SystemAssigned",
    },
    // Here we setup the integration with Azure AD
    aadProfile: {
        clientAppID: aadClientAppId,
        serverAppID: aadServerAppId,
        serverAppSecret: aadServerAppSecret,
        tenantID: aadTenantId,
        // When managed is true, Azure AD integration uses the fully managed Azure AD experience
        managed: true,
        enableAzureRBAC: true, // Enable Azure RBAC for Kubernetes authorization
    },
    defaultNodePool: {
        name: "agentpool",
        nodeCount: 2,
        vmSize: "Standard_DS2_v2",
    },
    dnsPrefix: "azurek8s",
    enableRBAC: true, // Enable Kubernetes role-based access control
});

// Export the kubeconfig for the AKS cluster
export const kubeConfig = aksCluster.kubeConfig;

Before running this example, please replace the placeholder values with actual information from your Azure AD applications. This includes:

aadClientAppId: The Application (client) ID of the Azure AD application used for the Kubernetes client.
aadServerAppId: The Application (client) ID of the Azure AD application used for the Kubernetes server.
aadServerAppSecret: The secret for the Azure AD application used for the Kubernetes server.
aadTenantId: Your Azure AD tenant ID.
location: The location where you want your resources to be created.
resourceGroupName: The name of the resource group where you want to create your resources.

You also need to provide the required configuration values by setting them up using Pulumi commands like:

pulumi config set aadClientAppId <CLIENT_APP_ID>
pulumi config set aadServerAppId <SERVER_APP_ID>
pulumi config set aadServerAppSecret <SERVER_APP_SECRET> --secret
pulumi config set aadTenantId <TENANT_ID>
pulumi config set resourceGroupName <RESOURCE_GROUP_NAME>
pulumi config set location <LOCATION>

This program will result in an AKS cluster that uses Azure AD for authentication and has role-based access control (RBAC) enabled. This means you can assign Kubernetes roles and role-bindings to Azure AD users and groups, and those assignments govern access to Kubernetes resources in the AKS cluster.

Finally, when you run pulumi up, Pulumi will compute the desired state and provision the resources in Azure. Once the AKS cluster is provisioned, you'll get a kubeconfig file as an output. You can use this kubeconfig file with kubectl to interact with your AKS cluster.

For more information on using azure-native.containerservice.ManagedCluster you can refer to the official Pulumi documentation.