How to grant permission for list nodes in AKS using Azure RBAC

Kevin Rabinowitz 1 Reputation point Microsoft Employee
2024-07-16T00:34:12.4233333+00:00

Using Azure RBAC for Kubernetes Authorization, we have been able to grant users read access to most of our Kubernetes resources e.g. pods, deployments, configmaps, etc.

However, read access to nodes is still unauthorized. According to https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/containers#azure-kubernetes-service-rbac-reader, someone with the Azure Kubernetes Service RBAC reader role should also be able to list nodes, but kubectl get nodes doesn't work due to unauthorized access. Why is that? and how can I grant a user read-only access to nodes?

Screenshot below shows that the cluster has enabled Azure RBAC.

e2515960-3258-479f-9a60-de23a6dbfa0d

Azure Kubernetes Service (AKS)
Azure Kubernetes Service (AKS)
An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.
1,978 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,468 questions
0 comments No comments
{count} votes