Emad Alashi presented on RBAC in Azure Kubernetes Service (AKS). The presentation covered how RBAC works in both Azure Active Directory and Kubernetes, and how OAuth2 device flow authentication can be used to authenticate Kubernetes clients like Kubectl. Device flow allows authentication of CLI tools by redirecting the user to a browser to authenticate, then receiving an access token to use with the Kubernetes API.

1. #GlobalAzure#GlobalAzure

2. Thank You Our Sponsors

4. Emad Alashi
@EmadAshi
http://emadashi.com

5. RBAC in Azure AKS
@emadashi

6. What is RBAC again?

7. Role
Permission 1
Permission 3
Permission 2
Permission 4
Group
Individual 3Individual 2 Individual 1

9. Azure AD
• Role
• Permission
• RoleAssignment
• User
• Group
Kubernetes
• Role/ClusterRole
• Rule
• RoleBinding
• User
• Group

10. Oauth2 Parties

11. You
Client
Resources
Auth Server

12. What is OAuth2
Device Flow?

13. Device
Client
Authorization Server
End-user at Browser
(A) Client Identifier
(B) Verification Code, User Code, &
Verification URI
(C) User Code
& Verification URI
(D) User Authenticates
(E) Client Identifier &
Verification Code…Polling
(F) Access Token
Resource Server

14. Device
Client
Kubectl represented by
AAD Client App Authorization Server
AAD
Server App
End-user at Browser
(A) Client Identifier
(B) Verification Code, User Code, &
Verification URI
(C) User Code
& Verification URI
(D) User Authenticates
(E) Client Identifier &
Verification Code…Polling
(F) Access Token
Resource Server
Kubernetes

17. Show me the console!

18. Things to watch out for!

20. Server App
"groupMembershipClaims": “All”
“ExposeAPI”

21. Client App
“AllowPublicClient”

22. Questions?
@emadashi