Azure Kubernetes Services has the capability to integrate Azure Active Directory users and groups into Kubernetes RBAC controls within the AKS Kubernetes API Server. This should be utilized to enable granular access to Kubernetes resources within the AKS clusters supporting RBAC controls not just of the overarching AKS instance but also the individual resources managed within Kubernetes.
If RBAC is not enabled, the granularity of permissions granted to Kubernetes resources is diminished presenting more permissions than needed to users requiring access to Kubernetes resources in AKS.
By default, RBAC is enabled.
Note: Kubernetes Service is not supported in Gov Cloud, So this control will not evaluate for Gov Cloud Subscriptions.
Create a new AKS cluster with RBAC enabled.
1. Sign in to the Azure portal.
2. In the top left-hand corner of the Azure portal, select + Create a resource > Containers > Kubernetes Service.
3. On the Basics page, configure the following options:
- Project details
- Cluster details
- Primary node pool
4. Select Next: Scale.
5. Fill in your scaling requirements, then at the bottom of the screen, click Next:Authentication.
6. Enable the option for Kubernetes role-based access controls (RBAC).
7. Click Review + create and then Create when validation completes.