Skip to content

Latest commit

 

History

History
81 lines (54 loc) · 5.16 KB

02-eid.md

File metadata and controls

81 lines (54 loc) · 5.16 KB

Prerequisites and Microsoft Entra ID

This is the starting point for the instructions on deploying the AKS Baseline private cluster reference implementation. There is required access and tooling you'll need in order to accomplish this. Follow the instructions below and on the subsequent pages so that you can get your environment ready to proceed with the AKS cluster creation.

Steps

  1. Latest Azure CLI installed (must be at least 2.59), or you can perform this from Azure Cloud Shell by clicking below.

  2. An Azure subscription.

    The subscription used in this deployment cannot be a free account; it must be a standard EA, pay-as-you-go, or Visual Studio benefit subscription. This is because the resources deployed here are beyond the quotas of free subscriptions.

    ⚠️ The user or service principal initiating the deployment process must have the following minimal set of Azure Role-Based Access Control (RBAC) roles:

    • Contributor role is required at the subscription level to have the ability to create resource groups and perform deployments.
    • User Access Administrator role is required at the subscription level since you'll be performing role assignments to managed identities across various resource groups.

  3. This step only applies if you are creating a new Microsoft Entra group for this deployment. If you have one already existing and you are a part of it, you can skip this prerequisite, and the remaining steps in this page, move on to the next page by clicking on the link at the bottom.

    A Microsoft Entra ID tenant to associate your Kubernetes RBAC Cluster API authentication to.

    ⚠️ The user or service principal initiating the deployment process must have the following minimal set of Microsoft Entra ID permissions assigned:

    • Microsoft Entra User Administrator is required to create a "break glass" AKS admin Microsoft Entra security group and user. Alternatively, you could get your Microsoft Entra admin to create this for you when instructed to do so.
      • If you are not part of the User Administrator group in the tenant associated to your Azure subscription, please consider creating a new tenant to use while evaluating this implementation. The Microsoft Entra tenant backing your cluster's API RBAC does NOT need to be the same tenant associated with your Azure subscription.

Create Microsoft Entra groups for AKS

Before creating the Microsoft Entra ID integrated cluster, groups must be created that can be later mapped to the Built-In Roles of "Azure Kubernetes Service Cluster User Role" and "Azure Kubernetes Service RBAC Cluster Admin".

Depending on the needs of your organization, you may have a choice of existing groups to use or a new groups may need to be created for each cluster deployment.

Navigate to "/AKS-Secure-Baseline-Private-AVM/Bicep/02-EID" folder

cd ./Scenarios/AKS-Secure-Baseline-Private-AVM/Bicep/02-EID

Use the Azure CLI or Azure PowerShell to create the Microsoft Entra groups. Replace the Microsoft Entra group names below with the name of the Microsoft Entra groups you want to create, such as AKS_ES_dev, AKS_ES_ops. There should be no space in the names.

CLI

appdevs=<Microsoft Entra group name>
aksops=<Microsoft Entra group name>

az ad group create --display-name $appdevs --mail-nickname $appdevs
az ad group create --display-name $aksops --mail-nickname $aksops

PowerShell

Running the command to create the new Microsoft Entra groups requires the New-AzADGroup cmdlet. More details can be found here.

Install New-AzADGroup cmdlet

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser
Install-Module -Name Az -Scope CurrentUser -Repository PSGallery -Force

Run the command below to create two new Microsoft Entra groups in your tenant.

./ad_groups.ps1 -appdevs <App Dev Group> -aksops <AKS Operations Team>

Ensure you are part of the Microsoft Entra group you just created or pointed to

  1. Go to Azure portal and type Microsoft Entra ID
  2. Select Microsoft Entra ID
  3. Click on Groups in the left blade
  4. Select the Admin User group you just created. For the default name, this should be AKS App Admin Team
  5. Click on Members in the left blade
  6. Location of private link for keyvault
  7. Click + Add members
  8. Enter your name in the search bar and select your user(s)
  9. Click Select

Next step

▶️ Creation of Hub Network & its respective Components