Hi @Duncan House
Thanks for providing all the details! It sounds like the cluster is having trouble fully registering with Azure Arc, even though the az connectedk8s enable-features
command reports success. Let's go through a few steps to fix it:
Even though your cluster shows as connected, it seems there may be some issues with the connection. To fix this:
Disconnect the cluster from Azure Arc:
az connectedk8s delete -n <cluster-name> -g <resource-group>
Reconnect the cluster to Azure Arc:
az connectedk8s connect -n <cluster-name> -g <resource-group>
This will refresh the connection and make sure everything is registered correctly.
Once the cluster is reconnected, try enabling Azure RBAC again:
az connectedk8s enable-features -n <cluster-name> -g <resource-group> --features azure-rbac
This should properly enable the RBAC feature for your cluster.
Sometimes it takes a few minutes (5-10 minutes) for the change to take full effect. So run the command, wait a bit and then check again in the Azure Portal.
Go to Azure Arc > Kubernetes Clusters in the Azure Portal, and select your cluster. Then, check the Access Control (IAM) tab to see if Azure RBAC is showing up and if you can assign roles.
Since Azure RBAC uses Azure AD for authentication, you’ll need a tool called kubelogin. If you don’t have it installed yet, you can install it:
For macOS/Linux: Run brew install kubelogin
For Windows: Download it from GitHub.
Once installed, log in to Azure AD with:
kubelogin --azure-cli
To double-check if RBAC is actually enabled, run this command:
az connectedk8s show -n <cluster-name> -g <resource-group> --query aadProfile.enableAzureRbac
If it says true
, then Azure RBAC is all set up!
You’ll need to assign roles to the users or groups that need access to Kubernetes resources. For example, to give someone view-only access, you can run:
az role assignment create --assignee <user-or-group> --role "Azure Kubernetes Service RBAC Viewer" --scope "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Kubernetes/connectedClusters/<cluster-name>"
Once you’ve done all of this, you should be all good to go! If you still run into any issues or need more help, just let me know and we can dig a little deeper.
If you have any further queries, do let us know.