AZ-500 Question 129
Select 2You manage an Azure Kubernetes Service (AKS) cluster that is integrated with Azure Active Directory (Azure AD). Developers can sign in using Azure AD credentials, but they cannot access or perform the actions they expect in certain namespaces. After investigating, you realize that role-based access was never properly configured for Azure AD users. Which two actions should you take to ensure that only authorized Azure AD users can authenticate and attain the correct Kubernetes permissions?
- A
Create or update a cluster role binding that references an Azure AD security group containing the developers.
- B
Use the 'az aks update' command with '--enable-aad' and '--aad-tenant-id' parameters if the cluster was not originally created with AAD enabled.
- C
Deploy a Kubernetes secret with each developer's Azure AD credentials into the target namespaces.
- D
Configure a new Azure AD service principal for each user using 'az ad sp create'.
- E
Assign the Azure 'Storage Blob Data Contributor' role to the developer's Azure AD group.
Show answer and explanation
Correct answers: A, B
Explanation
Configuring authentication for AKS with Azure AD involves enabling Azure AD integration on your cluster and then creating Kubernetes role bindings to map Azure AD users or groups to the appropriate Kubernetes roles. Using the 'az aks update' command with the --enable-aad and --aad-tenant-id parameters is essential if you did not enable Azure AD when initially creating the cluster. After enabling AAD, creating or updating a role binding or cluster role binding that references an Azure AD group is the correct way to grant minimal and appropriate access inside the Kubernetes cluster. Refer to the official Microsoft documentation on 'Integrate Azure Active Directory with Azure Kubernetes Service' for additional details.
- A. Correct.
Correct. In order for Azure AD users or groups to have the necessary permissions in AKS, you must create the appropriate role binding or cluster role binding that references their Azure AD group. This ensures they inherit the correct Kubernetes RBAC permissions based on their Azure AD membership.
- B. Correct.
Correct. If the cluster did not have Azure Active Directory integration at creation, you need to enable it by updating the cluster settings. Specifying the --enable-aad and --aad-tenant-id parameters ensures the cluster knows which tenant to authenticate against.
- C. Incorrect.
Incorrect. Storing Azure AD credentials in a Kubernetes secret is both insecure and unnecessary. Azure AD authentication should be handled dynamically through token-based authentication, not by embedding credentials in secrets.
- D. Incorrect.
Incorrect. You do not need to create individual service principals for each user. AKS with Azure AD integration handles user authentication through Azure AD accounts and groups, so creating separate application registrations is unnecessary for basic RBAC scenarios.
- E. Incorrect.
Incorrect. The Azure 'Storage Blob Data Contributor' role is related to Azure Storage permissions, not Kubernetes cluster access. To grant Kubernetes permissions, you must use either cluster role bindings or role bindings that are specific to Kubernetes resources.