permissions issues

Question

Hi All

I have Azure Kubernetes service. When i check my permissions on the Kubernetes cluster, i have owner, contributor & user administrator access. i have a requirement to give access to Kubernetes resources i.e Namespaces to few other users. When i click on Namespaces i am getting the below error. experts guide me

namespaces is forbidden: User "@mydomain.com" cannot list resource "namespaces" in API group "" at the cluster scope. '@mydomain.com' does not have the required Kubernetes permissions to view this resource. Ensure you have the correct role/role binding for this user or group.

Answer 1

Hello Glenn,

Thanks for contact Microsoft Q&A

The error you are getting is related with invalid Kubernetes RBAC permission's.
https://learn.microsoft.com/en-us/troubleshoot/azure/azure-kubernetes/user-cannot-get-cluster-resources

Currently AKS support Azure RBAC for Kubernetes Authorization or Kubernetes RBAC , both integrated with Microsoft Entra ID (previously Azure AD).

We recommend using Azure RBAC for Kubernetes Authorization, as it is simpler and easier to configure than Kubernetes RBAC, but it's your decision.

Since you are user with admin access, please make sure you add your user group as admin group on the cluster, this can be configured when you enabled the Microsoft Entra ID integration in the cluster. You can find the configuration steps in our documentation bellow.
https://learn.microsoft.com/en-us/azure/aks/enable-authentication-microsoft-entra-id#before-you-begin

Additionally, if you have also configured Azure RBAC for Kubernetes authorization, you can create a role assignment with the "Azure Kubernetes Service RBAC Cluster Admin" built-in role to any user/group to provide cluster admin privileges.
https://learn.microsoft.com/en-us/azure/aks/manage-azure-rbac#create-role-assignments-for-users-to-access-the-cluster

Please let me know if this help's to resolve your issue.