github.com/Azure/aad-pod-identity@v1.8.17/website/content/en/docs/Getting started/role-assignment.md (about)

     1  ---
     2  title: "Role Assignment"
     3  linkTitle: "Role Assignment"
     4  weight: 1
     5  description: >
     6    Your cluster will need the correct role assignment configuration to perform Azure-related operations.
     7  ---
     8  
     9  Your cluster will need the correct role assignment configuration to perform Azure-related operations such as assigning and un-assigning the identity on the underlying VM/VMSS. You can run the following commands to help you set up the appropriate role assignments for your cluster identity before deploying aad-pod-identity.
    10  
    11  > NOTE: If you're running aad-pod-identity in [managed mode](../../configure/pod_identity_in_managed_mode) you don't need these role assignments. If you're using the AKS pod-managed identities add-on, refer to the [AKS add-on documentation](https://docs.microsoft.com/en-us/azure/aks/use-azure-ad-pod-identity) for the required role assignments.
    12  
    13  AKS and aks-engine clusters require an identity to communicate with Azure. This identity can be either a **managed identity** (in the form of system-assigned identity or user-assigned identity) or a **service principal**. This section explains various role assignments that need to be performed before using AAD Pod Identity. Without the proper role assignments, your Azure cluster will not have the correct permission to assign and un-assign identities from the underlying virtual machines (VM) or virtual machine scale sets (VMSS). 
    14  
    15  In the case of self-managed clusters (manual installation of Kubernetes on Azure VMs), you'll need to assign a **user-assigned managed identity** to the VM or VMSS or use a **service principal**. This is required for MIC to perform Azure-related operations for assigning/un-assigning the identity required for applications.
    16  
    17  ```bash
    18  export SUBSCRIPTION_ID="<SubscriptionID>"
    19  export RESOURCE_GROUP="<AKSResourceGroup>"
    20  export CLUSTER_NAME="<AKSClusterName>"
    21  
    22  # Optional: if you are planning to deploy your user-assigned identities
    23  # in a separate resource group instead of your node resource group
    24  export IDENTITY_RESOURCE_GROUP="<IdentityResourceGroup>"
    25  
    26  curl -s https://raw.githubusercontent.com/Azure/aad-pod-identity/master/hack/role-assignment.sh | bash
    27  ```
    28  
    29  > Note: `<AKSResourceGroup>` is where your AKS cluster is deployed to.
    30  
    31  ## Introduction
    32  
    33  Currently, [MIC](../../concepts/mic) uses one of the following two ways to authenticate with Azure:
    34  
    35  1. [Managed Identity](https://docs.microsoft.com/en-us/azure/aks/use-managed-identity) (system-assigned identity or user-assigned identity)
    36  2. [Service Principal](https://docs.microsoft.com/en-us/azure/aks/kubernetes-service-principal) through `/etc/kubernetes/azure.json`, which is available in every node, or credentials defined by environment variables;
    37  
    38  > Clusters with managed identity are only compatible with AAD Pod Identity 1.5+.
    39  
    40  ## More on authentication methods
    41  
    42  [`/etc/kubernetes/azure.json`](https://kubernetes-sigs.github.io/cloud-provider-azure/install/configs/) is a well-known JSON file in each node that provides the details about which method MIC uses for authentication:
    43  
    44  | Authentication method            | `/etc/kubernetes/azure.json` fields used                                                    |
    45  | -------------------------------- | ------------------------------------------------------------------------------------------- |
    46  | System-assigned managed identity | `useManagedIdentityExtension: true` and `userAssignedIdentityID:""`                         |
    47  | User-assigned managed identity   | `useManagedIdentityExtension: true` and `userAssignedIdentityID:"<UserAssignedIdentityID>"` |
    48  | Service principal (default)      | `aadClientID: "<AADClientID>"` and `aadClientSecret: "<AADClientSecret>"`                   |
    49  
    50  ## Obtaining the ID of the managed identity / service principal
    51  
    52  After your cluster is provisioned, depending on your cluster identity configuration, run one of the following commands to retrieve the **ID** of your managed identity or service principal, which will be used for role assignment in the next section:
    53  
    54  | Cluster configuration                            | Command                                                                                                                                                                      |
    55  | ------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
    56  | AKS cluster with service principal               | `az aks show -g <AKSResourceGroup> -n <AKSClusterName> --query servicePrincipalProfile.clientId -o tsv`                                                                      |
    57  | AKS cluster with managed identity                | `az aks show -g <AKSResourceGroup> -n <AKSClusterName> --query identityProfile.kubeletidentity.clientId -o tsv`                                                              |
    58  | aks-engine cluster with service principal        | Use the client ID of the service principal defined in the API model                                                                                                          |
    59  | aks-engine cluster with system-assigned identity | `az <vm|vmss> identity show -g <NodeResourceGroup> -n <VM|VMSS Name> --query principalId -o tsv`                                                                             |
    60  | aks-engine cluster with user-assigned identity   | `az <vm|vmss> identity show -g <NodeResourceGroup> -n <VM|VMSS Name> --query userAssignedIdentities -o tsv`, then copy the `clientID` of the selected user-assigned identity |
    61  
    62  ## Performing role assignments
    63  
    64  The roles [**Managed Identity Operator**](https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#managed-identity-operator) and [**Virtual Machine Contributor**](https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-contributor) must be assigned to the cluster managed identity or service principal, identified by the **ID** obtained above, before deploying AAD Pod Identity so that it can assign and un-assign identities from the underlying VM/VMSS.
    65  
    66  > For AKS cluster, the node resource group refers to the resource group with a `MC_` prefix, which contains all of the infrastructure resources associated with the cluster like VM/VMSS.
    67  
    68  ```bash
    69  az role assignment create --role "Managed Identity Operator" --assignee <ID> --scope /subscriptions/<SubscriptionID>/resourcegroups/<NodeResourceGroup>
    70  az role assignment create --role "Virtual Machine Contributor" --assignee <ID> --scope /subscriptions/<SubscriptionID>/resourcegroups/<NodeResourceGroup>
    71  ```
    72  
    73  > RBAC and non-RBAC clusters require the same role assignments.
    74  
    75  ## User-assigned identities that are not within the node resource group
    76  
    77  There are additional role assignments required if you wish to assign user-assigned identities that are not within the node resource group. You can run the following command to assign the **Managed Identity Operator** role with the identity resource group scope:
    78  
    79  ```bash
    80  az role assignment create --role "Managed Identity Operator" --assignee <ID> --scope /subscriptions/<SubscriptionID>/resourcegroups/<IdentityResourceGroup>
    81  ```
    82  
    83  To enable fine-grained control on which user-assigned identity the cluster has access to, run the following command:
    84  
    85  ```bash
    86  az role assignment create --role "Managed Identity Operator" --assignee <ID>  --scope /subscriptions/<SubscriptionID>/resourcegroups/<IdentityResourceGroup>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<IdentityName>
    87  ```
    88  
    89  ## User-assigned managed identities for self-managed clusters
    90  
    91  If you deploy the VMs and install Kubernetes instead of using tools like [aks-engine](https://github.com/Azure/aks-engine) or [capz](https://github.com/kubernetes-sigs/cluster-api-provider-azure), you'll need to assign the user-assigned managed identity to the underlying VMs.
    92  
    93  ### For VMSS
    94  
    95  ```bash 
    96  az vmss identity assign -n <VMSS name> -g <rg> --identities <IdentityResourceID>
    97  ```
    98  
    99  ### For VMs
   100  
   101  ```bash
   102  az vm identity assign -n <VM name> -g <rg> --identities <IdentityResourceID>
   103  ```
   104  Repeat for all your worker node VMs.
   105  
   106  ## Reducing number of role assignments
   107  
   108  Currently there's a limit of [2000 role assignments](https://docs.microsoft.com/en-us/azure/role-based-access-control/troubleshooting#azure-role-assignments-limit) allowed within an Azure subscription. Once you've hit this limit, you will not be able to assign new roles.
   109  
   110  To reduce the number of role assignments, one thing you could do is instead of assigning the `Managed Identity Operator` role to managed identities individually, you could assign the `Managed Identity Operator` role to the resource group the managed identities belong to. Resources will inherit roles from the resource group, meaning you can create as many managed identities as you need and not affect the subscription's overall role assignment count.
   111  
   112  ## Useful links
   113  
   114  - [Use managed identities in AKS](https://docs.microsoft.com/en-us/azure/aks/use-managed-identity)
   115  - [Service principals with AKS](https://docs.microsoft.com/en-us/azure/aks/kubernetes-service-principal)
   116  - [What are managed identities for Azure resources?](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview)