az aks bastion

Note

This reference is part of the aks-preview extension for the Azure CLI (version 2.85.0 or higher). The extension will automatically install the first time you run an az aks bastion command. Learn more about extensions.

Commands to manage or connect to Azure Bastion for a managed Kubernetes cluster.

Commands

Name Description Type Status
az aks bastion disable

Disable managed Azure Bastion host for a managed Kubernetes cluster.

 Extension GA
az aks bastion enable

Enable managed Azure Bastion host for a managed Kubernetes cluster.

 Extension GA
az aks bastion tunnel

Connect to a managed Kubernetes cluster using Azure Bastion.

 Extension GA
az aks bastion update

Update managed Azure Bastion host for a managed Kubernetes cluster.

 Extension GA

az aks bastion disable

Disable managed Azure Bastion host for a managed Kubernetes cluster.

az aks bastion disable --name
                       --resource-group
                       [--acquire-policy-token]
                       [--aks-custom-headers]
                       [--change-reference]
                       [--no-wait]

Examples

Disable managed Azure Bastion host for a managed Kubernetes cluster.

az aks bastion disable --name MyManagedCluster --resource-group MyResourceGroup

Required Parameters

--name -n

Name of the managed cluster.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property Value
Parameter group: Global Policy Arguments
--aks-custom-headers

Send custom headers. When specified, format should be Key1=Value1,Key2=Value2.

--change-reference

The related change reference ID for this resource operation.

Property Value
Parameter group: Global Policy Arguments
--no-wait

Do not wait for the long-running operation to finish.

Property Value
Default value: False
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az aks bastion enable

Enable managed Azure Bastion host for a managed Kubernetes cluster.

az aks bastion enable --name
                      --resource-group
                      [--acquire-policy-token]
                      [--aks-custom-headers]
                      [--bastion-public-ip]
                      [--bastion-scale-units]
                      [--bastion-sku {Premium, Standard}]
                      [--change-reference]
                      [--no-wait]

Examples

Enable managed Azure Bastion host for a managed Kubernetes cluster with default settings.

az aks bastion enable --name MyManagedCluster --resource-group MyResourceGroup

Enable managed Azure Bastion host with premium sku and custom scale units.

az aks bastion enable --name MyManagedCluster --resource-group MyResourceGroup --bastion-sku premium --bastion-scale-units 7

Enable managed Azure Bastion host with BYO public IP address.

az aks bastion enable --name MyManagedCluster --resource-group MyResourceGroup --bastion-public-ip /subscriptions/{subscription-id}/resourceGroups/MyResourceGroup/providers/Microsoft.Network/publicIPAddresses/MyPublicIP

Required Parameters

--name -n

Name of the managed cluster.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property Value
Parameter group: Global Policy Arguments
--aks-custom-headers

Send custom headers. When specified, format should be Key1=Value1,Key2=Value2.

--bastion-public-ip

The resource ID of an existing public IP address to be assigned to the managed Azure Bastion host.

When not specified, a new public IP address will be created and assigned to the managed Azure Bastion host.

--bastion-scale-units

The number of scale units for the managed Azure Bastion host.

--bastion-sku -s

Specify the SKU of the managed Azure Bastion host.

Property Value
Accepted values: Premium, Standard
--change-reference

The related change reference ID for this resource operation.

Property Value
Parameter group: Global Policy Arguments
--no-wait

Do not wait for the long-running operation to finish.

Property Value
Default value: False
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az aks bastion tunnel

Connect to a managed Kubernetes cluster using Azure Bastion.

The command will launch a subshell with the kubeconfig set to connect to the cluster via Bastion. Use exit or Ctrl-D (i.e. EOF) to exit the subshell.

az aks bastion tunnel --name
                      --resource-group
                      [--acquire-policy-token]
                      [--admin]
                      [--bastion]
                      [--change-reference]
                      [--kubeconfig-path]
                      [--port]
                      [--yes]

Examples

Connect to a managed Kubernetes cluster using Azure Bastion with custom port and admin credentials.

az aks bastion tunnel -g MyResourceGroup --name MyManagedCluster --bastion MyBastionResource --port 50001 --admin

Connect using an existing kubeconfig file.

az aks bastion tunnel -g MyResourceGroup --name MyManagedCluster --kubeconfig-path ~/.kube/config

Required Parameters

--name -n

Name of the managed cluster.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property Value
Parameter group: Global Policy Arguments
--admin

Use the cluster admin credentials to connect to the bastion.

Property Value
Default value: False
--bastion

The name or resource ID of a pre-deployed Bastion resource configured to connect to the current AKS cluster.

If not specified, the command will try to identify an existing Bastion resource within the cluster's node resource group.

--change-reference

The related change reference ID for this resource operation.

Property Value
Parameter group: Global Policy Arguments
--kubeconfig-path

Path to an existing kubeconfig file to use.

If specified, uses this kubeconfig file at its original location instead of fetching credentials from Azure.

--port

The local port number used for the bastion connection.

If not provided, a random port will be used.

--yes -y

Do not prompt for confirmation.

Property Value
Default value: False
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az aks bastion update

Update managed Azure Bastion host for a managed Kubernetes cluster.

az aks bastion update --name
                      --resource-group
                      [--acquire-policy-token]
                      [--aks-custom-headers]
                      [--bastion-scale-units]
                      [--bastion-sku {Premium, Standard}]
                      [--change-reference]
                      [--no-wait]

Examples

Upgrade managed Azure Bastion host to Premium SKU.

az aks bastion update --name MyManagedCluster --resource-group MyResourceGroup --bastion-sku premium

Scale managed Azure Bastion host.

az aks bastion update --name MyManagedCluster --resource-group MyResourceGroup --bastion-scale-units 7

Required Parameters

--name -n

Name of the managed cluster.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property Value
Parameter group: Global Policy Arguments
--aks-custom-headers

Send custom headers. When specified, format should be Key1=Value1,Key2=Value2.

--bastion-scale-units

The number of scale units for the managed Azure Bastion host.

--bastion-sku -s

Specify the SKU of the managed Azure Bastion host.

Property Value
Accepted values: Premium, Standard
--change-reference

The related change reference ID for this resource operation.

Property Value
Parameter group: Global Policy Arguments
--no-wait

Do not wait for the long-running operation to finish.

Property Value
Default value: False
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False