Hi!
Kubelogin is a client-go credential plugin that implements Azure AD authentication. Kubernetes and its CLI, kubectl, are written in Go and client-go is a package or library that allows you to talk to Kubernetes from the Go language. Client-go supports credentials plugins to integrate with authentication protocols that are not supported by default by kubectl.
Even with an AAD managed AKS cluster, kubelogin allows us to do non-interactive login using a Service Principal or in the latest release — even using the Azure CLI token making it really ideal to use in CI/CD scenarios.
Create a service principal or use an existing one.
az ad sp create-for-rbac --skip-assignment --name myAKSAutomationServicePrincipal
The output is similar to the following example.
{
"appId": "<spn client id>",
"displayName": "myAKSAutomationServicePrincipal",
"name": "http://myAKSAutomationServicePrincipal",
"password": "<spn secret>",
"tenant": "<aad tenant id>"
}
Query your service principal AAD Object ID by using the command below.
az ad sp show --id <spn client id> --query "objectId"
To configure the role binding on Azure Kubernetes Service, the user in rolebinding should be the AAD Object ID.
For example,
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: sp-role-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: <service-principal-object-id>
Use Kubelogin to convert your kubeconfig
export KUBECONFIG=/path/to/kubeconfig kubelogin convert-kubeconfig -l spn export AAD_SERVICE_PRINCIPAL_CLIENT_ID=<spn client id> export AAD_SERVICE_PRINCIPAL_CLIENT_SECRET=<spn secret> kubectl get nodes
https://github.com/Azure/kubelogin
Maxime.