Adding a group of users to a group with AKS permissions ate resource group level fails to provide necessary permissions

Question

If I correctly understand Azure then there are 3 scopes at which resource permissions can be applied:

• Subscription
• Resource Group
• Resource

I have an AKS cluster, a group "AKS-Admins" (with all roles required to access the cluster applied at the scope of the resource group that the cluster is in), and then another group Team-B with a collection of users on that team. I put the Team-B group as a member of AKS-Admins but those users cannot access the cluster. If I check the access control on the cluster resource for those user's, however, it does show that they have:
Azure Kubernetes Service Cluster Admin Role
and
Azure Kubernetes Service RBAC Cluster Admin

roles inherited.

What's going on?

Answer 1

Hello Benjamin Mask,

Thanks for your question.

Based on the information you provided it may be as a result of Kubernetes RBAC roles rather than Azure RBAC.To check this you can run below and confirm it for the affected group:

kubectl get clusterrolebinding

See external doc here: https://kubernetes.io/docs/reference/access-authn-authz/rbac/

Also, you can further confirm the RBAC roles using the documentation here:

https://learn.microsoft.com/en-us/azure/aks/manage-azure-rbac

Please let me know if you have further questions**

You can mark it 'Accept Answer' if this helped.