k8s.io/client-go@v0.22.2/plugin/pkg/client/auth/azure/README.md (about)

     1  # Azure Active Directory plugin for client authentication
     2  
     3  This plugin provides an integration with Azure Active Directory device flow. If no tokens are present in the kubectl configuration, it will prompt a device code which can be used to login in a browser. After login it will automatically fetch the tokens and store them in the kubectl configuration. In addition it will refresh and update the tokens in the configuration when expired.
     4  
     5  ## Usage
     6  
     7  1. Create an Azure Active Directory *Web App / API* application for `apiserver` following these [instructions](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-app-registration). The callback URL does not matter (just cannot be empty).
     8  
     9  2. Create a second Azure Active Directory native application for `kubectl`. The callback URL does not matter (just cannot be empty).
    10  
    11  3. On `kubectl` application's configuration page in Azure portal grant permissions to `apiserver` application by clicking on *Required Permissions*, click the *Add* button and search for the apiserver application created in step 1. Select "Access apiserver" under the *DELEGATED PERMISSIONS*. Once added click the *Grant Permissions* button to apply the changes.
    12  
    13  4. Configure the `apiserver` to use the Azure Active Directory as an OIDC provider with following options
    14  
    15     ```
    16     --oidc-client-id="spn:APISERVER_APPLICATION_ID" \
    17     --oidc-issuer-url="https://sts.windows.net/TENANT_ID/"
    18     --oidc-username-claim="sub"
    19     ```
    20  
    21     * Replace the `APISERVER_APPLICATION_ID` with the application ID of `apiserver` application
    22     * Replace `TENANT_ID` with your tenant ID.
    23     * For a list of alternative username claims that are supported by the OIDC issuer check the JSON response at `https://sts.windows.net/TENANT_ID/.well-known/openid-configuration`.
    24  
    25  5. Configure `kubectl` to use the `azure` authentication provider
    26  
    27     ```
    28     kubectl config set-credentials "USER_NAME" --auth-provider=azure \
    29       --auth-provider-arg=environment=AzurePublicCloud \
    30       --auth-provider-arg=client-id=APPLICATION_ID \
    31       --auth-provider-arg=tenant-id=TENANT_ID \
    32       --auth-provider-arg=apiserver-id=APISERVER_APPLICATION_ID
    33     ```
    34  
    35     * Supported environments: `AzurePublicCloud`, `AzureUSGovernmentCloud`, `AzureChinaCloud`, `AzureGermanCloud`
    36     * Replace `USER_NAME` and `TENANT_ID` with your user name and tenant ID
    37     * Replace `APPLICATION_ID` with the application ID of your`kubectl` application ID
    38     * Replace `APISERVER_APPLICATION_ID` with the application ID of your `apiserver` application ID
    39     * Be sure to also (create and) select a context that uses above user
    40  
    41  6. (Optionally) the AAD token has `aud` claim with `spn:` prefix. To omit that, add following auth configuration:
    42  
    43     ```
    44       --auth-provider-arg=config-mode="1"
    45     ```
    46  
    47   7. The access token is acquired when first `kubectl` command is executed
    48  
    49     ```
    50     kubectl get pods
    51  
    52     To sign in, use a web browser to open the page https://aka.ms/devicelogin and enter the code DEC7D48GA to authenticate.
    53     ```
    54  
    55     * After signing in a web browser, the token is stored in the configuration, and it will be reused when executing further commands.
    56     * The resulting username in Kubernetes depends on your [configuration of the `--oidc-username-claim` and `--oidc-username-prefix` flags on the API server](https://kubernetes.io/docs/admin/authentication/#configuring-the-api-server). If you are using any authorization method you need to give permissions to that user, e.g. by binding the user to a role in the case of RBAC.