az aks identity-binding

Note

This command group has commands that are defined in both Azure CLI and at least one extension. Install each extension to benefit from its extended capabilities. Learn more about extensions.

Commands to manage identity bindings in Azure Kubernetes Service.

Commands

Name	Description	Type	Status
az aks identity-binding create	Create a new identity binding in a managed Kubernetes cluster.	Core	GA
az aks identity-binding create (aks-preview extension)	Create a new identity binding in a managed Kubernetes cluster.	Extension	GA
az aks identity-binding delete	Delete a specific identity binding in a managed Kubernetes cluster.	Core	GA
az aks identity-binding delete (aks-preview extension)	Delete a specific identity binding in a managed Kubernetes cluster.	Extension	GA
az aks identity-binding list	List all identity bindings under a managed Kubernetes cluster.	Core	GA
az aks identity-binding list (aks-preview extension)	List all identity bindings under a managed Kubernetes cluster.	Extension	GA
az aks identity-binding show	Show details of a specific identity binding in a managed Kubernetes cluster.	Core	GA
az aks identity-binding show (aks-preview extension)	Show details of a specific identity binding in a managed Kubernetes cluster.	Extension	GA
az aks identity-binding update	Update an existing identity binding in a managed Kubernetes cluster.	Extension	GA

az aks identity-binding create

Edit

Create a new identity binding in a managed Kubernetes cluster.

az aks identity-binding create --cluster-name
                               --managed-identity-resource-id
                               --name
                               --resource-group
                               [--acquire-policy-token]
                               [--change-reference]
                               [--no-wait]

Examples

Create a new identity binding

az aks identity-binding create -g myResourceGroup --cluster-name myCluster -n myIdentityBinding --managed-identity-resource-id /subscriptions/0000/resourceGroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myIdentity

Required Parameters

--cluster-name

Name of the managed Kubernetes cluster.

--managed-identity-resource-id

The resource ID of the managed identity to use.

--name -n

Name of the identity binding to create.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--no-wait

Do not wait for the long-running operation to finish.

Property	Value
Default value:	False

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az aks identity-binding create (aks-preview extension)

Create a new identity binding in a managed Kubernetes cluster.

az aks identity-binding create --cluster-name
                               --managed-identity-resource-id
                               --name
                               --resource-group
                               [--acquire-policy-token]
                               [--allowed-subjects-from-file]
                               [--change-reference]

Examples

Create an identity binding with allowed subjects targeting specific namespaces by name.

az aks identity-binding create --resource-group myRG --cluster-name myCluster \
  --name my-identity-binding \
  --managed-identity-resource-id /subscriptions/.../userAssignedIdentities/myMI \
  --allowed-subjects-from-file allowed-subjects.json

Required Parameters

--cluster-name

Name of the managed Kubernetes cluster.

--managed-identity-resource-id

The resource ID of the managed identity to use.

--name -n

Name of the identity binding to create.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--allowed-subjects-from-file -f

Path to a JSON file with the list of subjects authorized to use this identity binding for token exchange.

The file must contain a JSON array (max 100 entries). Each entry has a required 'namespaceSelector' and an optional 'serviceAccountSelector', each a Kubernetes label selector supporting 'matchLabels' (an array of "key=value" strings) and/or 'matchExpressions'. Use the built-in 'kubernetes.io/metadata.name' label to target specific namespaces by name. When omitted, authorization falls back to ClusterRole/ClusterRoleBinding evaluation.

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az aks identity-binding delete

Edit

Delete a specific identity binding in a managed Kubernetes cluster.

az aks identity-binding delete --cluster-name
                               --name
                               --resource-group
                               [--acquire-policy-token]
                               [--change-reference]
                               [--no-wait]
                               [--yes]

Examples

Delete an identity binding

az aks identity-binding delete -g myResourceGroup --cluster-name myCluster -n myIdentityBinding

Required Parameters

--cluster-name

Name of the managed Kubernetes cluster.

--name -n

Name of the identity binding to delete.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--no-wait

Do not wait for the long-running operation to finish.

Property	Value
Default value:	False

--yes -y

Do not prompt for confirmation.

Property	Value
Default value:	False

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az aks identity-binding delete (aks-preview extension)

Delete a specific identity binding in a managed Kubernetes cluster.

az aks identity-binding delete --cluster-name
                               --name
                               --resource-group
                               [--acquire-policy-token]
                               [--change-reference]

Required Parameters

--cluster-name

Name of the managed Kubernetes cluster.

--name -n

Name of the identity binding to delete.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az aks identity-binding list

Edit

List all identity bindings under a managed Kubernetes cluster.

az aks identity-binding list --cluster-name
                             --resource-group

Examples

List all identity bindings in a managed cluster

az aks identity-binding list -g myResourceGroup --cluster-name myCluster

Required Parameters

--cluster-name

Name of the managed Kubernetes cluster.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az aks identity-binding list (aks-preview extension)

List all identity bindings under a managed Kubernetes cluster.

az aks identity-binding list --cluster-name
                             --resource-group

Required Parameters

--cluster-name

Name of the managed Kubernetes cluster.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az aks identity-binding show

Edit

Show details of a specific identity binding in a managed Kubernetes cluster.

az aks identity-binding show --cluster-name
                             --name
                             --resource-group

Examples

Show details of an identity binding

az aks identity-binding show -g myResourceGroup --cluster-name myCluster -n myIdentityBinding

Required Parameters

--cluster-name

Name of the managed Kubernetes cluster.

--name -n

Name of the identity binding to show.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az aks identity-binding show (aks-preview extension)

Show details of a specific identity binding in a managed Kubernetes cluster.

az aks identity-binding show --cluster-name
                             --name
                             --resource-group

Required Parameters

--cluster-name

Name of the managed Kubernetes cluster.

--name -n

Name of the identity binding to show.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az aks identity-binding update

Update an existing identity binding in a managed Kubernetes cluster.

az aks identity-binding update --allowed-subjects-from-file
                               --cluster-name
                               --name
                               --resource-group
                               [--acquire-policy-token]
                               [--change-reference]

Examples

Update the allowed subjects on an existing identity binding.

az aks identity-binding update --resource-group myRG --cluster-name myCluster \
  --name my-identity-binding \
  --allowed-subjects-from-file updated-subjects.json

Required Parameters

--allowed-subjects-from-file -f

Path to a JSON file with the list of subjects authorized to use this identity binding for token exchange.

The file must contain a JSON array (max 100 entries). Each entry has a required 'namespaceSelector' and an optional 'serviceAccountSelector', each a Kubernetes label selector supporting 'matchLabels' (an array of "key=value" strings) and/or 'matchExpressions'. Use the built-in 'kubernetes.io/metadata.name' label to target specific namespaces by name. Providing this replaces the existing allowed subjects list.

--cluster-name

Name of the managed Kubernetes cluster.

--name -n

Name of the identity binding to update.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

Feedback

Was this page helpful?