Share via

AKS access issue

Niren Adhikary (NAD) 146 Reputation points
2022-11-28T08:49:33.13+00:00

Hi All,

We are trying to limit user access to particular namespace in AKS . To achieve this we have assigned user the following permission.

  1. Azure Kubernetes Service Cluster User Role - To list credential or run kubectl command
  2. Azure Kubernetes Service RBAC Writer Role on the created namespace- This is to allow deployment.

But we are now getting below error message - Please suggest

PS C:\Users\abc> kubectl get pods -n namespacename
Unable to connect to the server: getting credentials: exec: executable kubelogin not found

It looks like you are trying to use a client-go credential plugin that is not installed.

To learn more about this feature, consult the documentation available at:
https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins

Azure Kubernetes Service
Azure Kubernetes Service

An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.

0 comments

6 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. vipullag-MSFT 26,537 Reputation points Moderator
    2022-11-28T16:03:54.487+00:00

    @Niren Adhikary (NAD)

    Welcome to Microsoft Q&A Platform, thanks for posting your query here.

    Based on the details you shared, I would request you to run the az aks install-cli command. This should help resolved the error.

    Ref: https://learn.microsoft.com/en-us/cli/azure/aks?view=azure-cli-latest#az-aks-install-cli

    264878-image.png

    Hope this helps.

    4 people found this answer helpful.
  2. Guilherme Oenning 21 Reputation points
    2022-12-01T22:35:52.483+00:00

    @Niren Adhikary (NAD) based on the error message, it seems like that either you don’t have kubelogin installed, or it’s not in PATH.

    I wrote a guide that explains in details what kubelogin is and how to use it. That might help you as well https://aptakube.com/blog/how-to-use-azure-kubelogin

    The key part here is to download kubelogin and put it in a folder that is part of your PATH environment variable. Use the command “where kubelogin” to confirm if it’s correctly installed.

    1 person found this answer helpful.
  3. Arturo Fallas Fernández 76 Reputation points Microsoft Employee
    2022-12-13T20:43:56.087+00:00

    Hello Niren,

    Have you tried pulling the credentials again using:

    az aks get-credentials -n <clustername> -g <resourcegroup>

    Also to further troubleshoot this, is this happening only for this user or many others too? On the other hand, have you tried getting the credentials from a different terminal where you do not have any client-go credentials pre-installed like cloudshell, if this is a private cluster you could use this doc to run commands from cloudshell:

    https://learn.microsoft.com/en-us/azure/aks/command-invoke

    Also to troubleshoot you could enable the --admin flag when pulling the cluster credentials.

    0 comments
  4. lgmorand 12 Reputation points Microsoft Employee
    2022-12-01T22:16:13.06+00:00

    same issue here. the aks getcredentials seems to works but then kubectl fails.

    I suspect a difference of version between client (which is 1.25.3 for me) and the server is 1.23.X.

    edit: after upgrading the aks cluster to 1.24.6, then I can now use kubectl without issue, but I can't connect to a hub (aks fleet) which is 1.24.6. super weird

  5. Manu Philip 20,651 Reputation points MVP Volunteer Moderator
    2022-11-28T09:02:12.133+00:00

    Can you try deleting the kube cache folder under the current user logged in to the windows machine you ran the command and try again? It looks like the following folder for me

    264669-image.png

    ----------

    --please don't forget to upvote and Accept as answer if the reply is helpful--

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.