aks terraform azure_active_directory_role_based_access_control 选项

Question

我正在使用 azurerm v4，并希望通过内部角色管理 AKS 访问。 在我的地形中我有这个块：

// I create an AD group...
resource "azuread_group" "aks_admins" {
  display_name     = "aks-${var.sub} admins"
  security_enabled = true
  description      = "used to manage access to the ${var.sub} aks cluster"
}

// then I create a cluster...
resource "azurerm_kubernetes_cluster" "this" {

  ... other settings...

  azure_active_directory_role_based_access_control {
    azure_rbac_enabled = true
    // what does this next bit actually do????
    admin_group_object_ids = [
      azuread_group.aks_admins.object_id
    ] 
  }
}

文档说

admin_group_object_ids -（可选）应在集群上具有管理员角色的 Azure Active Directory 组的对象 ID 列表。

“应该在集群上具有管理员角色”是什么意思。实际上是什么意思？ 我是否需要手动将该组作为“Azure Kubernetes 服务集群管理角色”添加到我的集群 IAM 中？

通过设置该值我可以获得什么价值？

Answer 1

aks terraform azure_active_directory_role_based_access_control 选项

如果您使用 EntraID 角色，我们应该按照 EntraID 文档使用必要的权限将角色分配给组，并在分配之前确保您具有以下权限 Microsoftdoc。

演示配置：

resource "azuread_group" "aks_admins" {
  display_name       = var.admin_group_name
  security_enabled   = true
  assignable_to_role = true
  description        = "Admin group for managing the AKS cluster"
}

resource "azuread_group_member" "group_members" {
  for_each = toset(var.user_object_ids)

  group_object_id  = azuread_group.aks_admins.object_id
  member_object_id = each.value
}

resource "azurerm_role_assignment" "reader_role" {
  scope                = azurerm_kubernetes_cluster.aks.id
  role_definition_name = "Reader" # Assigning Reader role to the group
  principal_id         = azuread_group.aks_admins.object_id
}


resource "azurerm_kubernetes_cluster" "aks" {
  name                = var.aks_name
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  dns_prefix          = "${var.aks_name}-dns"

  default_node_pool {
    name       = "default"
    vm_size    = "Standard_DS2_v2"
    node_count = 2
  }

  identity {
    type = "SystemAssigned"
  }

  azure_active_directory_role_based_access_control {
    azure_rbac_enabled = true
    admin_group_object_ids = [
      azuread_group.aks_admins.object_id
    ]
  }
}

部署：

参考：

azureread_group |资源 | Hashicorp/azure |地形 | Terraform 注册表