This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(224.00000000000003, 56.00000000000001%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAJ%3C/text%3E%3C/svg%3E)
When using "Azure AD authentication with Azure RBAC" we can assign different roles to AD users as Azure role assignments. I found a list of all the possible roles we can use. We can also create custom roles etc. That is clear.
What is not clear to me is, how those roles are mapped to Kubernetes roles and how we can inspect them. Looking at the ClusterRole and Role resources, those built-in roles don't seem to be visible anywhere on the cluster.
My goal is to be able to see how those roles are mapped, exactly, using kubectl, not the Azure docs.
Could you explain what is happening behind the scenes?
Thank you.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(230.39999999999998, 93%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBG%3C/text%3E%3C/svg%3E)
Hi @Aleksandar Jelić thanks for the question... are you referring to the role and cluster role bindings?
There's an example of how to list bindings using kubectl on SO here https://stackoverflow.com/questions/54602224/how-to-view-the-permissions-roles-associated-with-a-specific-service-account-in
Hi @Ben Gimblett thanks for your quick response.
Let me try to give you a concrete example.
When I visit this page https://learn.microsoft.com/en-us/answers/questions/1361516/how-are-azure-roles-mapped-to-kubernetes-roles I'm able to see example 4 built-in Azure roles that I can use to grant K8s access to users.
Looking at Azure Kubernetes Service RBAC Reader specifically I can see a description of what user with this role can do. There's also this document here https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#azure-kubernetes-service-rbac-reader that goes into more details and outlines concrete Azure actions this role includes.
Is there a way to find this role (and related role bindings) using kubectl on a K8s cluster? I would like to see what Kubernetes actions this role uses and who the subjects are. Note that this is just a concrete example. In general I'd like to understand where this mapping between Azure role and K8s role is located, and how to access it.
If I misunderstood the concept of how AKS (with Azure RBAC enabled) connects to K8s, please correct me.
Thanks again.
@Aleksandar Jelić I am researching this further, apologies for the delay
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(60.8, 4%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKM%3C/text%3E%3C/svg%3E)
Hello, @Aleksandar Jelić !
Please consider accepting the answer to help increase visibility of this question for other members of the Microsoft Q&A community. If not, please let us know what is still needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!
@Aleksandar Jelić the role mapping within guard (the service behind the webhook described in the docs which is providing the Azure RBAC integration) is not something the product folks will discuss as it's an implementation detail
However, if you want to track/see what's going on you can opt into the guard logs via an AKS diagnostic setting and query the results in log analytics (or wherever you decide to send the logs)
REF https://learn.microsoft.com/en-us/azure/aks/monitor-aks#resource-logs
What you can see here, amongst other things is the encache details logged for the auth result - so for example what decision was made for a user , with a given Az RBAC role assignment , for a given kubectl command etc.
@Ben Gimblett Thank you for the explanation.
Since guard implementation can't be revealed (completely understood), is there a document that defines the mapping of Azure role actions to Kubernetes role definitions?
For example, for role Azure Kubernetes Service RBAC Reader there are many actions that can be performed on K8s, e.g. Microsoft.ContainerService/managedClusters/configmaps/read. Is there a document that explains how this action is mapped to a concrete Kubernetes role definition / rule (API groups, resources and verbs)? So far the only explanation visible on the page for this action is "Reads configmaps". It's similar for other actions, which I'm finding a bit "mysterious".
Thanks again.
It's a good question in my opinion :) But the short answer today appears to be no.
From what I understood the mapping is considered part of the implementation. So whilst you can easily observe the result (guard logs) they dont (today) publish the logic used to make the decision - so that would be how Az RBAC roles/permissions map to native K8S.
@Ben Gimblett Thanks for looking into it :)