github.com/Azure/aad-pod-identity@v1.8.17/website/content/en/docs/Getting started/role-assignment.md (about) 1 --- 2 title: "Role Assignment" 3 linkTitle: "Role Assignment" 4 weight: 1 5 description: > 6 Your cluster will need the correct role assignment configuration to perform Azure-related operations. 7 --- 8 9 Your cluster will need the correct role assignment configuration to perform Azure-related operations such as assigning and un-assigning the identity on the underlying VM/VMSS. You can run the following commands to help you set up the appropriate role assignments for your cluster identity before deploying aad-pod-identity. 10 11 > NOTE: If you're running aad-pod-identity in [managed mode](../../configure/pod_identity_in_managed_mode) you don't need these role assignments. If you're using the AKS pod-managed identities add-on, refer to the [AKS add-on documentation](https://docs.microsoft.com/en-us/azure/aks/use-azure-ad-pod-identity) for the required role assignments. 12 13 AKS and aks-engine clusters require an identity to communicate with Azure. This identity can be either a **managed identity** (in the form of system-assigned identity or user-assigned identity) or a **service principal**. This section explains various role assignments that need to be performed before using AAD Pod Identity. Without the proper role assignments, your Azure cluster will not have the correct permission to assign and un-assign identities from the underlying virtual machines (VM) or virtual machine scale sets (VMSS). 14 15 In the case of self-managed clusters (manual installation of Kubernetes on Azure VMs), you'll need to assign a **user-assigned managed identity** to the VM or VMSS or use a **service principal**. This is required for MIC to perform Azure-related operations for assigning/un-assigning the identity required for applications. 16 17 ```bash 18 export SUBSCRIPTION_ID="<SubscriptionID>" 19 export RESOURCE_GROUP="<AKSResourceGroup>" 20 export CLUSTER_NAME="<AKSClusterName>" 21 22 # Optional: if you are planning to deploy your user-assigned identities 23 # in a separate resource group instead of your node resource group 24 export IDENTITY_RESOURCE_GROUP="<IdentityResourceGroup>" 25 26 curl -s https://raw.githubusercontent.com/Azure/aad-pod-identity/master/hack/role-assignment.sh | bash 27 ``` 28 29 > Note: `<AKSResourceGroup>` is where your AKS cluster is deployed to. 30 31 ## Introduction 32 33 Currently, [MIC](../../concepts/mic) uses one of the following two ways to authenticate with Azure: 34 35 1. [Managed Identity](https://docs.microsoft.com/en-us/azure/aks/use-managed-identity) (system-assigned identity or user-assigned identity) 36 2. [Service Principal](https://docs.microsoft.com/en-us/azure/aks/kubernetes-service-principal) through `/etc/kubernetes/azure.json`, which is available in every node, or credentials defined by environment variables; 37 38 > Clusters with managed identity are only compatible with AAD Pod Identity 1.5+. 39 40 ## More on authentication methods 41 42 [`/etc/kubernetes/azure.json`](https://kubernetes-sigs.github.io/cloud-provider-azure/install/configs/) is a well-known JSON file in each node that provides the details about which method MIC uses for authentication: 43 44 | Authentication method | `/etc/kubernetes/azure.json` fields used | 45 | -------------------------------- | ------------------------------------------------------------------------------------------- | 46 | System-assigned managed identity | `useManagedIdentityExtension: true` and `userAssignedIdentityID:""` | 47 | User-assigned managed identity | `useManagedIdentityExtension: true` and `userAssignedIdentityID:"<UserAssignedIdentityID>"` | 48 | Service principal (default) | `aadClientID: "<AADClientID>"` and `aadClientSecret: "<AADClientSecret>"` | 49 50 ## Obtaining the ID of the managed identity / service principal 51 52 After your cluster is provisioned, depending on your cluster identity configuration, run one of the following commands to retrieve the **ID** of your managed identity or service principal, which will be used for role assignment in the next section: 53 54 | Cluster configuration | Command | 55 | ------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | 56 | AKS cluster with service principal | `az aks show -g <AKSResourceGroup> -n <AKSClusterName> --query servicePrincipalProfile.clientId -o tsv` | 57 | AKS cluster with managed identity | `az aks show -g <AKSResourceGroup> -n <AKSClusterName> --query identityProfile.kubeletidentity.clientId -o tsv` | 58 | aks-engine cluster with service principal | Use the client ID of the service principal defined in the API model | 59 | aks-engine cluster with system-assigned identity | `az <vm|vmss> identity show -g <NodeResourceGroup> -n <VM|VMSS Name> --query principalId -o tsv` | 60 | aks-engine cluster with user-assigned identity | `az <vm|vmss> identity show -g <NodeResourceGroup> -n <VM|VMSS Name> --query userAssignedIdentities -o tsv`, then copy the `clientID` of the selected user-assigned identity | 61 62 ## Performing role assignments 63 64 The roles [**Managed Identity Operator**](https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#managed-identity-operator) and [**Virtual Machine Contributor**](https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-contributor) must be assigned to the cluster managed identity or service principal, identified by the **ID** obtained above, before deploying AAD Pod Identity so that it can assign and un-assign identities from the underlying VM/VMSS. 65 66 > For AKS cluster, the node resource group refers to the resource group with a `MC_` prefix, which contains all of the infrastructure resources associated with the cluster like VM/VMSS. 67 68 ```bash 69 az role assignment create --role "Managed Identity Operator" --assignee <ID> --scope /subscriptions/<SubscriptionID>/resourcegroups/<NodeResourceGroup> 70 az role assignment create --role "Virtual Machine Contributor" --assignee <ID> --scope /subscriptions/<SubscriptionID>/resourcegroups/<NodeResourceGroup> 71 ``` 72 73 > RBAC and non-RBAC clusters require the same role assignments. 74 75 ## User-assigned identities that are not within the node resource group 76 77 There are additional role assignments required if you wish to assign user-assigned identities that are not within the node resource group. You can run the following command to assign the **Managed Identity Operator** role with the identity resource group scope: 78 79 ```bash 80 az role assignment create --role "Managed Identity Operator" --assignee <ID> --scope /subscriptions/<SubscriptionID>/resourcegroups/<IdentityResourceGroup> 81 ``` 82 83 To enable fine-grained control on which user-assigned identity the cluster has access to, run the following command: 84 85 ```bash 86 az role assignment create --role "Managed Identity Operator" --assignee <ID> --scope /subscriptions/<SubscriptionID>/resourcegroups/<IdentityResourceGroup>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<IdentityName> 87 ``` 88 89 ## User-assigned managed identities for self-managed clusters 90 91 If you deploy the VMs and install Kubernetes instead of using tools like [aks-engine](https://github.com/Azure/aks-engine) or [capz](https://github.com/kubernetes-sigs/cluster-api-provider-azure), you'll need to assign the user-assigned managed identity to the underlying VMs. 92 93 ### For VMSS 94 95 ```bash 96 az vmss identity assign -n <VMSS name> -g <rg> --identities <IdentityResourceID> 97 ``` 98 99 ### For VMs 100 101 ```bash 102 az vm identity assign -n <VM name> -g <rg> --identities <IdentityResourceID> 103 ``` 104 Repeat for all your worker node VMs. 105 106 ## Reducing number of role assignments 107 108 Currently there's a limit of [2000 role assignments](https://docs.microsoft.com/en-us/azure/role-based-access-control/troubleshooting#azure-role-assignments-limit) allowed within an Azure subscription. Once you've hit this limit, you will not be able to assign new roles. 109 110 To reduce the number of role assignments, one thing you could do is instead of assigning the `Managed Identity Operator` role to managed identities individually, you could assign the `Managed Identity Operator` role to the resource group the managed identities belong to. Resources will inherit roles from the resource group, meaning you can create as many managed identities as you need and not affect the subscription's overall role assignment count. 111 112 ## Useful links 113 114 - [Use managed identities in AKS](https://docs.microsoft.com/en-us/azure/aks/use-managed-identity) 115 - [Service principals with AKS](https://docs.microsoft.com/en-us/azure/aks/kubernetes-service-principal) 116 - [What are managed identities for Azure resources?](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview)