Kubeadmin removal from ARO v4.x

Question

Hi there,

I would like to ask your help to understand the documentation of the ARO v4.x, where explicitly described how to remove kubeadmin. There is security reason behind it clearly, but to do that raises another question:
Is there any Microsoft recommendation for another local user created and granted cluster admin role, or Microsoft suggests to use only the MS Active Directory only to authenticate users on the ARO service? But if only AAD is the only user management, what about if AAD goes down for any reason? so I loose the chance to log in into the cluster? Or will the Openshift cache the users from the Active Directory? I did not find any information about it.

Answer 1

@GSIMON Apologies for the delay in response since I missed on notification on this response and was not able to reach out to you earlier.

I had discussion internally and below is the response:

Firstly, "the documentation of the ARO v4.x, where explicitly described how to remove kubeadmin." is not an MS doc, it is an openshift doc: https://docs.openshift.com/container-platform/4.6/authentication/remove-kubeadmin.html#removing-kubeadmin_removing-kubeadmin

Secondly, a regular user being given cluster-admin permissions are simply as it happens to be on Kubernetes. There's no additional recommendation on that front. ReferenceHowever, if he is removing kubeadmin user you:

• must have configured at least one identity provider.
• must have added the cluster-admin role to a user.
• must be logged in as an administrator.

Reference: https://docs.openshift.com/container-platform/4.6/authentication/remove-kubeadmin.html#removing-kubeadmin_removing-kubeadmin

You can review Openshift docs for Openshift guidelines:
https://docs.openshift.com/aro/3/admin_guide/index.html
https://docs.openshift.com/container-platform/4.6/authentication/understanding-authentication.html#rbac-users_understanding-authentication

Here is what Microsoft recommends:

When an Azure Red Hat OpenShift 4 cluster is created, a temporary administrative user is created. Connect to your cluster, add users and groups and configure the appropriate permissions for both.

Reference: https://learn.microsoft.com/en-us/azure/openshift/migration#authentication

Now if you want to use AAD then,SLA for AAD: https://azure.microsoft.com/en-us/support/legal/sla/active-directory/v1_0/

Procedure for AAD integration with ARO:
https://learn.microsoft.com/en-us/azure/openshift/configure-azure-ad-cli
https://learn.microsoft.com/en-us/azure/openshift/configure-azure-ad-ui

Hope it helps!!!

Please "Accept as Answer" if it helped so it can help others in community looking for help on similar topics.

Answer 2

@GSIMON Apologies for the delay in response and all the inconvenience caused because of the issue.

For improved security and management, Azure Red Hat OpenShift lets you integrate with Azure Active Directory (Azure AD) and use Kubernetes role-based access control (Kubernetes RBAC). You can also monitor the health of your cluster and resources. So basically you can grant access to user based upon your requirement. For example if you give a Reader role to a user on cluster then that particular user will be able to just read the data and not make any changes.

Similarly if you give contributor role to a user then they will be able to make read and write data as well but that in turn is limited as well.

This way you do have a complete control over your cluster and since the entrusted users have access to the cluster you can monitor their activity or any changes to AKS cluster in portal itself.

You can find more info here

You can indeed configure Identity Provider as well from where user can be redirected to authenticate.

More information here.

Hope it helps!!!

Please "Accept as Answer" if it helped so it can help others in community looking for help on similar topics.

Answer 3

Sorry for delay. We agreed to remove the kube-admin as our security requirement, and we are going to create a local cluster-admin on ARO with a hard password.
Thank you for taking care of this question.