{"id":212,"date":"2020-01-03T04:19:37","date_gmt":"2020-01-03T03:19:37","guid":{"rendered":"http:\/\/aymen-segni.com\/?p=212"},"modified":"2020-01-03T04:35:54","modified_gmt":"2020-01-03T03:35:54","slug":"secure-aks-at-the-deployment-part-1","status":"publish","type":"post","link":"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/","title":{"rendered":"Secure AKS at the deployment &#8211; part 1 &#8211;"},"content":{"rendered":"\n<hr class=\"wp-block-separator\"\/>\n\n\n\n<h2 class=\"has-vivid-cyan-blue-color has-text-color wp-block-heading\">Introduction<\/h2>\n\n\n\n<p>Welcome to the Azure AKS Kubernetes deployment security Workshop. <br>We won&#8217;t spend too much time on the presentation of AKS, the service that has been very popular in recent months.<br>In brief, AKS is Microsoft\u2019s new managed container orchestration service. It is gradually replacing Azure Container service and focuses only on the Cloud Native Computing foundation (CNCF) Kubernetes orchestration engine.<br> In the last workshop: <span style=\"text-decoration: underline;\"><a rel=\"noreferrer noopener\" aria-label=\"Create a Kubernetes cluster with Azure AKS using Terraform (opens in a new tab)\" href=\"https:\/\/aymen-segni.com\/index.php\/2019\/12\/24\/create-a-kubernetes-cluster-with-azure-aks-using-terraform\/\" target=\"_blank\">Create a Kubernetes cluster with Azure AKS using Terraform<\/a>,<\/span> we have discussed the Azure Kubernetes Service (AKS) basics, the Infrastructure as Code (IaC) mechanism with a focus on Hashicorp Terraform and how to deploy a Kubernetes cluster with AKS using Terraform.<br>With this lab, you\u2019ll go through tasks that will help you &nbsp;master the basic and more advanced topics required to secure Azure AKS Kubernetes cluster at the deployment level based on the following mechanisms and technologies:<\/p>\n\n\n\n<ol class=\"ul-black wp-block-list\"><li>\u2705Azure AD <a rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\" href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/fundamentals\/active-directory-whatis\" target=\"_blank\"><span style=\"text-decoration: underline;\">(AAD)<\/span><\/a><\/li><li>\u2705AKS with Role-Based Access Control<a href=\"https:\/\/kubernetes.io\/docs\/reference\/access-authn-authz\/rbac\/\"><span style=\"text-decoration: underline;\"> (RBAC)<\/span><\/a><\/li><li>\u2705Container Network Interface <a href=\"https:\/\/github.com\/containernetworking\/cni\"><span style=\"text-decoration: underline;\">(C<\/span><\/a><span style=\"text-decoration: underline;\"><a rel=\"noreferrer noopener\" aria-label=\"N (opens in a new tab)\" href=\"https:\/\/github.com\/containernetworking\/cni\" target=\"_blank\">N<\/a><\/span><a href=\"https:\/\/github.com\/containernetworking\/cni\"><span style=\"text-decoration: underline;\">I)<\/span><\/a><\/li><li>\u2705Azure <span style=\"text-decoration: underline;\"><a rel=\"noreferrer noopener\" aria-label=\"Network policy (opens in a new tab)\" href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/aks\/use-network-policies\" target=\"_blank\">Network policy<\/a><\/span><\/li><li>\u2705Azure<span style=\"text-decoration: underline;\"><a rel=\"noreferrer noopener\" aria-label=\" Key Vault (opens in a new tab)\" href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/key-vault\/basic-concepts\" target=\"_blank\"> Key Vault<\/a><\/span><\/li><\/ol>\n\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n\n<p>This article is part of a series:<\/p>\n\n\n\n<ul class=\"ul-black wp-block-list\"><li>Secure AKS at the deployment: part 1<\/li><li><a href=\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-2\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"Secure AKS at the deployment: part 2 (opens in a new tab)\"><span style=\"text-decoration: underline;\">Secure AKS at the deployment: part 2<\/span><\/a><\/li><li><a href=\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-3\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"Secure AKS at the deployment: part 3 (opens in a new tab)\"><span style=\"text-decoration: underline;\">Secure AKS at the deployment: part 3<\/span><\/a><\/li><\/ul>\n\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n\n<h2 class=\"has-vivid-cyan-blue-color has-text-color wp-block-heading\">Assumptions and Prerequisites<\/h2>\n\n\n\n<ul class=\"ul-black wp-block-list\"><li>You have basic knowledge of&nbsp;<a rel=\"noreferrer noopener\" aria-label=\"Azure (opens in a new tab)\" href=\"https:\/\/azure.microsoft.com\/en-us\/\" target=\"_blank\">Azure<\/a><\/li><li>Have basic knowledge of&nbsp;<a rel=\"noreferrer noopener\" aria-label=\"Kubernetes (opens in a new tab)\" href=\"https:\/\/kubernetes.io\/\" target=\"_blank\">Kubernetes<\/a><\/li><li>You have&nbsp;<a rel=\"noreferrer noopener\" aria-label=\"Terraform&nbsp; (opens in a new tab)\" href=\"https:\/\/learn.hashicorp.com\/terraform\/getting-started\/install.html\" target=\"_blank\"><span style=\"text-decoration: underline;\">Terraform&nbsp;<\/span><\/a>installed in your local machine <\/li><li>You have basic experience with Terraform <\/li><li>Azure subscription: Sign up for an Azure account, if you don\u2019t own one already. You will receive USD200 in free credits.<\/li><\/ul>\n\n\n\n<h2 class=\"has-vivid-cyan-blue-color has-text-color wp-block-heading\">Implement Azure AD to secure AKS at the deployment <\/h2>\n\n\n\n<div class=\"wp-block-image is-style-default\"><figure class=\"aligncenter size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/azure-active-directory.jpg\" alt=\"Integrate AAD to secure Azure AKS Kubernetes cluster at the deployment\" class=\"wp-image-239\" width=\"581\" height=\"326\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/azure-active-directory.jpg 800w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/azure-active-directory.jpg 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/azure-active-directory.jpg 768w\" sizes=\"auto, (max-width: 581px) 100vw, 581px\" \/><\/figure><\/div>\n\n\n\n<p>In order to secure AKS at the deployment level, Azure Kubernetes Service (AKS) can be configured to use Azure Active Directory (AAD) for user authentication. In this configuration, you can sign in to an AKS cluster by using your Azure AD authentication token.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1- Azure networks solutions and AKS deployment <\/h3>\n\n\n\n<p>The default deployment of AKS <span style=\"text-decoration: underline;\"><a href=\"https:\/\/docs.microsoft.com\/fr-fr\/azure\/aks\/kubernetes-walkthrough-portal\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"proposed by Azure (opens in a new tab)\">proposed by Azure<\/a><\/span> hides a lot of things that are happening in the background. <br>Indeed, we do not know where the cluster is deployed or how the network is configured. By default, the network plugin used is <span style=\"text-decoration: underline;\"><a href=\"https:\/\/kubernetes.io\/docs\/concepts\/extend-kubernetes\/compute-storage-net\/network-plugins\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"kubenet (opens in a new tab)\">kubenet<\/a><\/span>, which is good for testing but does not allow us to test all the possibilities of AKS.<\/p>\n\n\n\n<p>In this part, let&#8217;s take a few assumptions:<\/p>\n\n\n\n<ul class=\"ul-black wp-block-list\"><li>The underlying Azure network is already in place<\/li><li> We will use Azure CNI for our AKS cluster<\/li><\/ul>\n\n\n\n<p>Provisioning an <span style=\"text-decoration: underline;\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/virtual-network\/virtual-networks-overview\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"Azure Virtual Network (opens in a new tab)\">Azure Virtual Network<\/a><\/span> (Vnet) is an essential step before deploying the AKS cluster. The main reason is closely related to the choice of the CNI. With <span style=\"text-decoration: underline;\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/aks\/configure-azure-cni\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"CNI Azure (opens in a new tab)\">CNI Azure<\/a><\/span>, Kubernetes nodes but also pods rely on the private IP addresses of the VNet and more specifically of the target subnet for deployment.<\/p>\n\n\n\n<p>Theoretically, to deploy an AKS cluster capable of hosting an appropriate number of workloads (i.e. pods), the network design should be meticulously carried out in order to provide sufficient IP address space for the AKS cluster. <br>Azure documentation gives us the following formula to calculate the minimum size of the target subnet for an AKS cluster, according to the number of workloads:<\/p>\n\n\n\n<p class=\"has-text-color has-background has-very-light-gray-color has-very-dark-gray-background-color\"><em>(number of nodes + 1) + ((number of nodes + 1) * maximum pods per node that you configure)<\/em><\/p>\n\n\n\n<p>Example for a 50 node cluster:&nbsp;<code>(51) + (51 * 30 (default)) = 1,581<\/code>&nbsp;(\/21 or larger)<\/p>\n\n\n\n<p>Example for a 50 node cluster that also includes provision to scale up an additional 10 nodes:&nbsp;<code>(61) + (61 * 30 (default)) = 1,891<\/code>&nbsp;(\/21 or larger)<\/p>\n\n\n\n<p class=\"has-text-color has-background has-very-dark-gray-color has-pale-cyan-blue-background-color\">\u2139\ufe0f <strong>Note<br> <\/strong>The maximum number of pods per node configured to 30 by default with Azure CNI. Fortunately, this is a soft limit that can be changed to 110 pods per node, either at the of deployment level, or after deployment with az cli for example.<\/p>\n\n\n\n<p>With Azure CNI, we can also use Network Policies in Kubernetes. <br>Since we want to secure the Azure AKS Kubernetes cluster at its deployment, network policies are required.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2- Integrate AKS with Azure AD <\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Prerequisites<\/h4>\n\n\n\n<p>Since AKS is a service managed by Microsoft, it provides an interesting features such as integration with Azure Active Directory.<br> For a company already using Azure AD as a source of identity, either from synchronization with an LDAP on premise, or in Cloud Native mode, the possibility of using Azure AD directly to authenticate AKS users is a big advantage.<br> In addition, because of Azure AD\u2019s ability to force Multi Factor Authentication (MFA) or not, a user with MFA enabled will be forced to use their authentication device to access AKS. Although a little more restrictive, the use of MFA is to be taken as a good practice.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Authentication details<\/h4>\n\n\n\n<p>Azure AD authentication is provided to AKS clusters that have OpenID Connect. OpenID Connect is an identity layer built on top of the OAuth 2.0 protocol.<br>For more information about OpenID Connect, see&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/develop\/v1-protocols-openid-connect-code\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"Authorize access to web applications using OpenID Connect and Azure AD (opens in a new tab)\">Authorize access to web applications using OpenID Connect and Azure AD<\/a>.<br><br>Without going into too much detail here, let&#8217;s summarize how it works:<\/p>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<p><strong>1- AAD App Server<\/strong><br>An application registered with AAD is required. This application, called a server application, is associated with the AKS cluster and is used to retrieve group memberships from AAD users.<br>To be able to perform this function, the application needs to have rights on the Microsoft Graph API:<br> &#8211; Application access: Read directory data<br> -Delegated permissions: Sign in and read user profile and Read Directory data<br>Through this application and the associated Service Principal (SP), the AKS cluster becomes able to verify the identity of the authenticating user.<br><strong>2- AAD App client <\/strong><br>A second application, \u201cNative App\u201d, qualified client, accessing the first application is required. <\/p>\n<\/div><\/div>\n\n\n\n<h4 class=\"wp-block-heading\">Create Azure AD server component<\/h4>\n\n\n\n<p>This section shows you how to create the required Azure AD components. You can also&nbsp;<span style=\"text-decoration: underline;\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/aks\/azure-ad-integration\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"complete these steps using the Azure porta (opens in a new tab)\">complete these steps using the Azure porta<\/a><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/aks\/azure-ad-integration\">l<\/a>.<\/span><br>For the complete sample script used in this lab, see&nbsp;<span style=\"text-decoration: underline;\"><a href=\"https:\/\/github.com\/AymenSegni\/secure-azure-aks-cluster-on-deployment\/blob\/master\/integrate-az-ad.sh\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"Azure CLI samples - AKS integration with Azure AD (opens in a new tab)\">Azure CLI samples &#8211; AKS integration with Azure AD<\/a><\/span><a href=\"https:\/\/github.com\/AymenSegni\/secure-azure-aks-cluster-on-deployment\/blob\/master\/integrate-az-ad.sh\"><span style=\"text-decoration: underline;\">.<\/span><\/a><\/p>\n\n\n\n<p><strong>Assumptions<\/strong> <br>&#8211; Azure CLI version 2.0.61 or later installed and configured is required. Run&nbsp;<code>az --version<\/code>&nbsp;to find the version. If you need to install or upgrade, see&nbsp;<span style=\"text-decoration: underline;\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/cli\/azure\/install-azure-cli\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"Install Azure CLI (opens in a new tab)\">Install Azure CLI<\/a><\/span>.<br>&#8211; Create a variable for your desired AKS cluster name. The following example uses the name<code><em>run-it-on-cloud<\/em><\/code><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"111\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.33.43-1024x111.png\" alt=\"secure aks cluster at the deployment assumptions \" class=\"wp-image-275\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.33.43.png 1024w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.33.43.png 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.33.43.png 768w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.33.43.png 1276w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<p><strong>1- Create the AAD App server<\/strong><br>Create the server application component using the&nbsp;<code>az ad app create<\/code>&nbsp;command, then update the group membership claims using the&nbsp;<code>az ad app update&nbsp;<\/code>command. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"201\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.21.04-1024x201.png\" alt=\"secure aks cluster at the deployment aad integration\" class=\"wp-image-273\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.21.04.png 1024w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.21.04.png 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.21.04.png 768w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.21.04.png 1256w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<p><strong>2- Create the SP<\/strong><br>Now let\u2019s  create a service principal for the server app using the&nbsp;<code>az ad sp create<\/code>&nbsp;command. This service principal is used to authenticate itself within the Azure platform. Then, get the service principal secret using the&nbsp;<code>az ad sp credential reset<\/code>&nbsp;command and assign to the variable named&nbsp;<em>serverApplicationSecret<\/em>&nbsp;for use in one of the following steps:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"230\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.41.49-1024x230.png\" alt=\"Create SP \" class=\"wp-image-278\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.41.49.png 1024w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.41.49.png 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.41.49.png 768w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.41.49.png 1176w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<p><strong>3<\/strong>&#8211;<strong> Set AAD App permission<\/strong>s<br>Assign these permissions using the<code>&nbsp;az ad app permission add&nbsp;<\/code>command and grant the permissions assigned in the previous step for the server application using the&nbsp;<code>az ad app permission grant<\/code>&nbsp;command. This step fails if the current account is not a global admin. You also need to add permissions for Azure AD application to request information that may otherwise require administrative consent using the&nbsp;<code>az ad app permission admin-consent<\/code>:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"112\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.51.31-1024x112.png\" alt=\"Permission\" class=\"wp-image-282\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.51.31.png 1024w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.51.31.png 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.51.31.png 768w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.51.31.png 1536w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.51.31.png 2048w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.51.31.png 1280w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.51.31.png 1920w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"79\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.57.55-1024x79.png\" alt=\"az ad app permissions\" class=\"wp-image-283\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.57.55.png 1024w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.57.55.png 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.57.55.png 768w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.57.55.png 1502w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.57.55.png 1280w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"79\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.58.24-1024x79.png\" alt=\"\" class=\"wp-image-284\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.58.24.png 1024w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.58.24.png 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.58.24.png 768w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.58.24.png 1350w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-21.58.24.png 1280w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<p><strong>4- Provision  the AAD App client <\/strong><br>The second Azure AD App is used when a user logs to the AKS cluster with the Kubernetes CLI (<code>kubectl<\/code>).<br>in this section, will create the client App, the associated  service principal SP and finally set the necessary permissions<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"295\" src=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-22.14.58-1024x295.png\" alt=\"\" class=\"wp-image-288\" srcset=\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-22.14.58.png 1024w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-22.14.58.png 300w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-22.14.58.png 768w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-22.14.58.png 1536w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-22.14.58.png 1986w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-22.14.58.png 1280w, https:\/\/aymen-segni.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-27-at-22.14.58.png 1920w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<p>The the complete sample script used in this section:<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\n<style>.gist table { margin-bottom: 0; }<\/style><div style=\"tab-size: 8\" id=\"gist100267483\" class=\"gist\">\n    <div class=\"gist-file\" translate=\"no\" data-color-mode=\"light\" data-light-theme=\"light\">\n      <div class=\"gist-data\">\n        \n<div class=\"js-gist-file-update-container js-task-list-container\">\n      <div id=\"file-aad-aks-integration-sh\" class=\"file my-2\">\n    \n    <div itemprop=\"text\"\n      class=\"Box-body p-0 blob-wrapper data type-shell  \"\n      style=\"overflow: auto\" tabindex=\"0\" role=\"region\"\n      aria-label=\"aad-aks-integration.sh content, created by AymenSegni on 09:19PM on December 27, 2019.\"\n    >\n\n        \n<div class=\"js-check-hidden-unicode js-blob-code-container blob-code-content\">\n\n  <template class=\"js-file-alert-template\">\n  <div data-view-component=\"true\" class=\"flash flash-warn flash-full d-flex flex-items-center\">\n  <svg aria-hidden=\"true\" height=\"16\" viewBox=\"0 0 16 16\" version=\"1.1\" width=\"16\" data-view-component=\"true\" class=\"octicon octicon-alert\">\n    <path d=\"M6.457 1.047c.659-1.234 2.427-1.234 3.086 0l6.082 11.378A1.75 1.75 0 0 1 14.082 15H1.918a1.75 1.75 0 0 1-1.543-2.575Zm1.763.707a.25.25 0 0 0-.44 0L1.698 13.132a.25.25 0 0 0 .22.368h12.164a.25.25 0 0 0 .22-.368Zm.53 3.996v2.5a.75.75 0 0 1-1.5 0v-2.5a.75.75 0 0 1 1.5 0ZM9 11a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\"><\/path>\n<\/svg>\n    <span>\n      This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.\n      <a class=\"Link--inTextBlock\" href=\"https:\/\/github.co\/hiddenchars\" target=\"_blank\">Learn more about bidirectional Unicode characters<\/a>\n    <\/span>\n\n\n  <div data-view-component=\"true\" class=\"flash-action\">        <a href=\"{{ revealButtonHref }}\" data-view-component=\"true\" class=\"btn-sm btn\">    Show hidden characters\n<\/a>\n<\/div>\n<\/div><\/template>\n<template class=\"js-line-alert-template\">\n  <span aria-label=\"This line has hidden Unicode characters\" data-view-component=\"true\" class=\"line-alert tooltipped tooltipped-e\">\n    <svg aria-hidden=\"true\" height=\"16\" viewBox=\"0 0 16 16\" version=\"1.1\" width=\"16\" data-view-component=\"true\" class=\"octicon octicon-alert\">\n    <path d=\"M6.457 1.047c.659-1.234 2.427-1.234 3.086 0l6.082 11.378A1.75 1.75 0 0 1 14.082 15H1.918a1.75 1.75 0 0 1-1.543-2.575Zm1.763.707a.25.25 0 0 0-.44 0L1.698 13.132a.25.25 0 0 0 .22.368h12.164a.25.25 0 0 0 .22-.368Zm.53 3.996v2.5a.75.75 0 0 1-1.5 0v-2.5a.75.75 0 0 1 1.5 0ZM9 11a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\"><\/path>\n<\/svg>\n<\/span><\/template>\n\n  <table data-hpc class=\"highlight tab-size js-file-line-container\" data-tab-size=\"4\" data-paste-markdown-skip data-tagsearch-path=\"aad-aks-integration.sh\">\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L1\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"1\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC1\" class=\"blob-code blob-code-inner js-file-line\">#!\/bin\/bash<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L2\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"2\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC2\" class=\"blob-code blob-code-inner js-file-line\"># Provide your own unique aksname within the Azure AD tenant<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L3\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"3\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC3\" class=\"blob-code blob-code-inner js-file-line\">aksname=&quot;run-it-on-cloud&quot;<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L4\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"4\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC4\" class=\"blob-code blob-code-inner js-file-line\">resourcegroup=&quot;runItOnCloud&quot;<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L5\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"5\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC5\" class=\"blob-code blob-code-inner js-file-line\">location=&quot;westeurope&quot;<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L6\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"6\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC6\" class=\"blob-code blob-code-inner js-file-line\">\n<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L7\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"7\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC7\" class=\"blob-code blob-code-inner js-file-line\">\n<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L8\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"8\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC8\" class=\"blob-code blob-code-inner js-file-line\"># Create the Azure AD application Server<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L9\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"9\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC9\" class=\"blob-code blob-code-inner js-file-line\">serverApplicationId=$(az ad app create \\<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L10\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"10\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC10\" class=\"blob-code blob-code-inner js-file-line\">    &#8211;display-name &quot;${aksname}Server&quot; \\<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L11\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"11\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC11\" class=\"blob-code blob-code-inner js-file-line\">    &#8211;identifier-uris &quot;https:\/\/${aksname}Server&quot; \\<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L12\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"12\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC12\" class=\"blob-code blob-code-inner js-file-line\">    &#8211;query appId -o tsv)<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L13\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"13\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC13\" class=\"blob-code blob-code-inner js-file-line\">\n<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L14\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"14\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC14\" class=\"blob-code blob-code-inner js-file-line\"># Update the application group memebership claims<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L15\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"15\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC15\" class=\"blob-code blob-code-inner js-file-line\">az ad app update &#8211;id $serverApplicationId &#8211;set groupMembershipClaims=All<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L16\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"16\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC16\" class=\"blob-code blob-code-inner js-file-line\">\n<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L17\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"17\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC17\" class=\"blob-code blob-code-inner js-file-line\"># Create a service principal for the Azure AD application<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L18\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"18\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC18\" class=\"blob-code blob-code-inner js-file-line\">az ad sp create &#8211;id $serverApplicationId<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L19\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"19\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC19\" class=\"blob-code blob-code-inner js-file-line\">\n<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L20\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"20\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC20\" class=\"blob-code blob-code-inner js-file-line\"># Get the service principal secret<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L21\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"21\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC21\" class=\"blob-code blob-code-inner js-file-line\">serverApplicationSecret=$(az ad sp credential reset \\<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L22\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"22\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC22\" class=\"blob-code blob-code-inner js-file-line\">    &#8211;name $serverApplicationId \\<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L23\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"23\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC23\" class=\"blob-code blob-code-inner js-file-line\">    &#8211;credential-description &quot;AKSPassword&quot; \\<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L24\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"24\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC24\" class=\"blob-code blob-code-inner js-file-line\">    &#8211;query password -o tsv)<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L25\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"25\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC25\" class=\"blob-code blob-code-inner js-file-line\"># The Azure AD needs permissions to perform the following actions:<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L26\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"26\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC26\" class=\"blob-code blob-code-inner js-file-line\"># 1-Read directory data<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L27\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"27\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC27\" class=\"blob-code blob-code-inner js-file-line\"># 2-Sign in and read user profile<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L28\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"28\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC28\" class=\"blob-code blob-code-inner js-file-line\">\n<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L29\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"29\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC29\" class=\"blob-code blob-code-inner js-file-line\">az ad app permission add \\<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L30\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"30\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC30\" class=\"blob-code blob-code-inner js-file-line\">    &#8211;id $serverApplicationId \\<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L31\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"31\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC31\" class=\"blob-code blob-code-inner js-file-line\">    &#8211;api 00000003-0000-0000-c000-000000000000 \\<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L32\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"32\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC32\" class=\"blob-code blob-code-inner js-file-line\">    &#8211;api-permissions e1fe6dd8-ba31-4d61-89e7-88639da4683d=Scope 06da0dbc-49e2-44d2-8312-53f166ab848a=Scope 7ab1d382-f21e-4acd-a863-ba3e13f7da61=Role<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L33\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"33\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC33\" class=\"blob-code blob-code-inner js-file-line\"># grant the permissions assigned in the previous step for the server application <\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L34\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"34\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC34\" class=\"blob-code blob-code-inner js-file-line\"># You must be the Azure AD tenant admin for these steps to successfully complete<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L35\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"35\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC35\" class=\"blob-code blob-code-inner js-file-line\">az ad app permission grant &#8211;id $serverApplicationId &#8211;api 00000003-0000-0000-c000-000000000000<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L36\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"36\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC36\" class=\"blob-code blob-code-inner js-file-line\">az ad app permission admin-consent &#8211;id  $serverApplicationId<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L37\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"37\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC37\" class=\"blob-code blob-code-inner js-file-line\">\n<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L38\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"38\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC38\" class=\"blob-code blob-code-inner js-file-line\"># Create the Azure AD application Client <\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L39\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"39\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC39\" class=\"blob-code blob-code-inner js-file-line\">clientApplicationId=$(az ad app create \\<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L40\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"40\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC40\" class=\"blob-code blob-code-inner js-file-line\">    &#8211;display-name &quot;${aksname}Client&quot; \\<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L41\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"41\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC41\" class=\"blob-code blob-code-inner js-file-line\">    &#8211;native-app \\<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L42\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"42\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC42\" class=\"blob-code blob-code-inner js-file-line\">    &#8211;reply-urls &quot;https:\/\/${aksname}Client&quot; \\<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L43\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"43\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC43\" class=\"blob-code blob-code-inner js-file-line\">    &#8211;query appId -o tsv)<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L44\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"44\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC44\" class=\"blob-code blob-code-inner js-file-line\">\n<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L45\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"45\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC45\" class=\"blob-code blob-code-inner js-file-line\"># Create a service principal for the client application<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L46\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"46\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC46\" class=\"blob-code blob-code-inner js-file-line\">az ad sp create &#8211;id $clientApplicationId<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L47\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"47\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC47\" class=\"blob-code blob-code-inner js-file-line\">\n<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L48\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"48\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC48\" class=\"blob-code blob-code-inner js-file-line\"># Get the oAuth2 ID for the server app to allow authentication flow<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L49\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"49\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC49\" class=\"blob-code blob-code-inner js-file-line\">oAuthPermissionId=$(az ad app show &#8211;id $serverApplicationId &#8211;query &quot;oauth2Permissions[0].id&quot; -o tsv)<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L50\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"50\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC50\" class=\"blob-code blob-code-inner js-file-line\">\n<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L51\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"51\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC51\" class=\"blob-code blob-code-inner js-file-line\"># Assign permissions for the client and server applications to communicate with each other<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L52\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"52\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC52\" class=\"blob-code blob-code-inner js-file-line\">az ad app permission add &#8211;id $clientApplicationId &#8211;api $serverApplicationId &#8211;api-permissions $oAuthPermissionId=Scope<\/td>\n        <\/tr>\n        <tr>\n          <td id=\"file-aad-aks-integration-sh-L53\" class=\"blob-num js-line-number js-blob-rnum\" data-line-number=\"53\"><\/td>\n          <td id=\"file-aad-aks-integration-sh-LC53\" class=\"blob-code blob-code-inner js-file-line\">az ad app permission grant &#8211;id $clientApplicationId &#8211;api $serverApplicationId<\/td>\n        <\/tr>\n  <\/table>\n<\/div>\n\n\n    <\/div>\n\n  <\/div>\n\n<\/div>\n\n      <\/div>\n      <div class=\"gist-meta\">\n        <a href=\"https:\/\/gist.github.com\/AymenSegni\/630a6853056a3594f18edc21ac51e8cc\/raw\/948467ec18b0d9ded7493afa3bf5ae63ea1e456f\/aad-aks-integration.sh\" style=\"float:right\" class=\"Link--inTextBlock\">view raw<\/a>\n        <a href=\"https:\/\/gist.github.com\/AymenSegni\/630a6853056a3594f18edc21ac51e8cc#file-aad-aks-integration-sh\" class=\"Link--inTextBlock\">\n          aad-aks-integration.sh\n        <\/a>\n        hosted with &#10084; by <a class=\"Link--inTextBlock\" href=\"https:\/\/github.com\">GitHub<\/a>\n      <\/div>\n    <\/div>\n<\/div>\n\n<\/div><\/figure>\n\n\n\n<h2 class=\"has-vivid-cyan-blue-color has-text-color wp-block-heading\">Conclusion <\/h2>\n\n\n\n<p>To conclude, in this first part, we have gathered the prerequisites to use Azure AD as a source of identity for an AKS cluster.<\/p>\n\n\n\n<h2 class=\"has-vivid-cyan-blue-color has-text-color wp-block-heading\">Next steps<\/h2>\n\n\n\n<p>In the next part, we will use Terraform and Azure CLI to deploy an AKS cluster using the AAD services created to implement the Kubernetes RBAC authentication.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Secure Azure AKS Kubernetes cluster at the deployment level using: \u2705Azure AD, \u2705RBAC, \u2705Azure CNI, \u2705 Azure network policy, \u2705Azure Key Vault \u2705 Terraform<\/p>\n","protected":false},"author":1,"featured_media":461,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[9,13,8,10,12],"tags":[14,11,17,19,6,2,15,16],"class_list":["post-212","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud","category-deployment","category-devops","category-kubernetes","category-security","tag-aks","tag-azure","tag-cloud","tag-deployment","tag-devops","tag-kubernetes","tag-security","tag-terraform"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v21.0 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Secure AKS at the deployment - part 1 - Run It On Cloud<\/title>\n<meta name=\"description\" content=\"Secure Azure AKS Kubernetes cluster at the deployment level using: \u2705Azure AD, \u2705RBAC, \u2705Azure CNI, \u2705 Azure network policy, \u2705Azure Key Vault \u2705 Terraform\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Secure AKS at the deployment - part 1 - Run It On Cloud\" \/>\n<meta property=\"og:description\" content=\"Secure Azure AKS Kubernetes cluster at the deployment level using: \u2705Azure AD, \u2705RBAC, \u2705Azure CNI, \u2705 Azure network policy, \u2705Azure Key Vault \u2705 Terraform\" \/>\n<meta property=\"og:url\" content=\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/\" \/>\n<meta property=\"og:site_name\" content=\"Run It On Cloud\" \/>\n<meta property=\"article:published_time\" content=\"2020-01-03T03:19:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-01-03T03:35:54+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i0.wp.com\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Kubernetes-Security-600x400_1554495004.png?fit=600%2C400&ssl=1\" \/>\n\t<meta property=\"og:image:width\" content=\"600\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"aymen-segni\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@https:\/\/x.com\/axsegni\" \/>\n<meta name=\"twitter:site\" content=\"@axsegni\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"aymen-segni\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/\"},\"author\":{\"name\":\"aymen-segni\",\"@id\":\"https:\/\/aymen-segni.com\/#\/schema\/person\/32033966e7bd410bbaf1b79c7e94b59d\"},\"headline\":\"Secure AKS at the deployment &#8211; part 1 &#8211;\",\"datePublished\":\"2020-01-03T03:19:37+00:00\",\"dateModified\":\"2020-01-03T03:35:54+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/\"},\"wordCount\":1268,\"commentCount\":3,\"publisher\":{\"@id\":\"https:\/\/aymen-segni.com\/#\/schema\/person\/32033966e7bd410bbaf1b79c7e94b59d\"},\"keywords\":[\"aks\",\"Azure\",\"cloud\",\"deployment\",\"devops\",\"kubernetes\",\"security\",\"terraform\"],\"articleSection\":[\"Cloud\",\"Deployment\",\"Devops\",\"Kubernetes\",\"Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/\",\"url\":\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/\",\"name\":\"Secure AKS at the deployment - part 1 - Run It On Cloud\",\"isPartOf\":{\"@id\":\"https:\/\/aymen-segni.com\/#website\"},\"datePublished\":\"2020-01-03T03:19:37+00:00\",\"dateModified\":\"2020-01-03T03:35:54+00:00\",\"description\":\"Secure Azure AKS Kubernetes cluster at the deployment level using: \u2705Azure AD, \u2705RBAC, \u2705Azure CNI, \u2705 Azure network policy, \u2705Azure Key Vault \u2705 Terraform\",\"breadcrumb\":{\"@id\":\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/aymen-segni.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Secure AKS at the deployment &#8211; part 1 &#8211;\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/aymen-segni.com\/#website\",\"url\":\"https:\/\/aymen-segni.com\/\",\"name\":\"Run It On Cloud\",\"description\":\"Accelerate your Cloud &amp; MLOps Journey\",\"publisher\":{\"@id\":\"https:\/\/aymen-segni.com\/#\/schema\/person\/32033966e7bd410bbaf1b79c7e94b59d\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/aymen-segni.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/aymen-segni.com\/#\/schema\/person\/32033966e7bd410bbaf1b79c7e94b59d\",\"name\":\"aymen-segni\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/aymen-segni.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2025\/02\/72799.jpg\",\"contentUrl\":\"https:\/\/aymen-segni.com\/wp-content\/uploads\/2025\/02\/72799.jpg\",\"width\":896,\"height\":1152,\"caption\":\"aymen-segni\"},\"logo\":{\"@id\":\"https:\/\/aymen-segni.com\/#\/schema\/person\/image\/\"},\"description\":\"Staff Engineer with over a decade of experience in building, scaling, and leading MLOPS, Cloud Native, SRE, and DevOps platforms across high-growth and enterprise environments. I specialize in architecting production-grade systems with a strong emphasis on resilience, security, and developer experience; bringing together deep expertise in distributed systems, Kubernetes, and modern platform engineering to empower engineering teams and accelerate business value. My work spans Cloud (AWS, GCP, Azure, OpenStack), Kubernetes, SRE (SLOs, observability, incident response), AI infrastructure and AgentOps (vLLM, Nvidia, RayServe, etc), and Platform Engineering (Backstage, Keptn, GitOps, self-service). I\u2019ve led teams through Cloud Native transformations, established scalable SRE practices, and built internal platforms that streamline operations and reduce cognitive load. With a strong programming background, and Infrastructure as Code (Terraform, Helm, Ansible), I drive automation-first approaches to eliminate toil, ensure reliability, and enable secure, compliant deployment pipelines. My focus today is on building Cloud Native AI platforms, where DevOps meets AI Infrastructure Stacks to support scalable, production-ready LLMs and AI Platforms. As a dedicated mentor, both within my teams and through platforms like MentorCruise, I am passionate about helping engineers perform at their best and assisting organizations in scaling with confidence. Driven by systems thinking, platform-as-a-product mindset, and engineering excellence, I help teams ship faster, operate smarter, and scale with confidence.\",\"sameAs\":[\"https:\/\/aymen-segni.com\",\"https:\/\/www.linkedin.com\/in\/aymen-segni\",\"https:\/\/twitter.com\/https:\/\/x.com\/axsegni\"],\"url\":\"https:\/\/aymen-segni.com\/index.php\/author\/admin8647\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Secure AKS at the deployment - part 1 - Run It On Cloud","description":"Secure Azure AKS Kubernetes cluster at the deployment level using: \u2705Azure AD, \u2705RBAC, \u2705Azure CNI, \u2705 Azure network policy, \u2705Azure Key Vault \u2705 Terraform","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/","og_locale":"en_US","og_type":"article","og_title":"Secure AKS at the deployment - part 1 - Run It On Cloud","og_description":"Secure Azure AKS Kubernetes cluster at the deployment level using: \u2705Azure AD, \u2705RBAC, \u2705Azure CNI, \u2705 Azure network policy, \u2705Azure Key Vault \u2705 Terraform","og_url":"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/","og_site_name":"Run It On Cloud","article_published_time":"2020-01-03T03:19:37+00:00","article_modified_time":"2020-01-03T03:35:54+00:00","og_image":[{"width":600,"height":400,"url":"https:\/\/i0.wp.com\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Kubernetes-Security-600x400_1554495004.png?fit=600%2C400&ssl=1","type":"image\/png"}],"author":"aymen-segni","twitter_card":"summary_large_image","twitter_creator":"@https:\/\/x.com\/axsegni","twitter_site":"@axsegni","twitter_misc":{"Written by":"aymen-segni","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/#article","isPartOf":{"@id":"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/"},"author":{"name":"aymen-segni","@id":"https:\/\/aymen-segni.com\/#\/schema\/person\/32033966e7bd410bbaf1b79c7e94b59d"},"headline":"Secure AKS at the deployment &#8211; part 1 &#8211;","datePublished":"2020-01-03T03:19:37+00:00","dateModified":"2020-01-03T03:35:54+00:00","mainEntityOfPage":{"@id":"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/"},"wordCount":1268,"commentCount":3,"publisher":{"@id":"https:\/\/aymen-segni.com\/#\/schema\/person\/32033966e7bd410bbaf1b79c7e94b59d"},"keywords":["aks","Azure","cloud","deployment","devops","kubernetes","security","terraform"],"articleSection":["Cloud","Deployment","Devops","Kubernetes","Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/","url":"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/","name":"Secure AKS at the deployment - part 1 - Run It On Cloud","isPartOf":{"@id":"https:\/\/aymen-segni.com\/#website"},"datePublished":"2020-01-03T03:19:37+00:00","dateModified":"2020-01-03T03:35:54+00:00","description":"Secure Azure AKS Kubernetes cluster at the deployment level using: \u2705Azure AD, \u2705RBAC, \u2705Azure CNI, \u2705 Azure network policy, \u2705Azure Key Vault \u2705 Terraform","breadcrumb":{"@id":"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/aymen-segni.com\/index.php\/2020\/01\/03\/secure-aks-at-the-deployment-part-1\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/aymen-segni.com\/"},{"@type":"ListItem","position":2,"name":"Secure AKS at the deployment &#8211; part 1 &#8211;"}]},{"@type":"WebSite","@id":"https:\/\/aymen-segni.com\/#website","url":"https:\/\/aymen-segni.com\/","name":"Run It On Cloud","description":"Accelerate your Cloud &amp; MLOps Journey","publisher":{"@id":"https:\/\/aymen-segni.com\/#\/schema\/person\/32033966e7bd410bbaf1b79c7e94b59d"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/aymen-segni.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/aymen-segni.com\/#\/schema\/person\/32033966e7bd410bbaf1b79c7e94b59d","name":"aymen-segni","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/aymen-segni.com\/#\/schema\/person\/image\/","url":"https:\/\/aymen-segni.com\/wp-content\/uploads\/2025\/02\/72799.jpg","contentUrl":"https:\/\/aymen-segni.com\/wp-content\/uploads\/2025\/02\/72799.jpg","width":896,"height":1152,"caption":"aymen-segni"},"logo":{"@id":"https:\/\/aymen-segni.com\/#\/schema\/person\/image\/"},"description":"Staff Engineer with over a decade of experience in building, scaling, and leading MLOPS, Cloud Native, SRE, and DevOps platforms across high-growth and enterprise environments. I specialize in architecting production-grade systems with a strong emphasis on resilience, security, and developer experience; bringing together deep expertise in distributed systems, Kubernetes, and modern platform engineering to empower engineering teams and accelerate business value. My work spans Cloud (AWS, GCP, Azure, OpenStack), Kubernetes, SRE (SLOs, observability, incident response), AI infrastructure and AgentOps (vLLM, Nvidia, RayServe, etc), and Platform Engineering (Backstage, Keptn, GitOps, self-service). I\u2019ve led teams through Cloud Native transformations, established scalable SRE practices, and built internal platforms that streamline operations and reduce cognitive load. With a strong programming background, and Infrastructure as Code (Terraform, Helm, Ansible), I drive automation-first approaches to eliminate toil, ensure reliability, and enable secure, compliant deployment pipelines. My focus today is on building Cloud Native AI platforms, where DevOps meets AI Infrastructure Stacks to support scalable, production-ready LLMs and AI Platforms. As a dedicated mentor, both within my teams and through platforms like MentorCruise, I am passionate about helping engineers perform at their best and assisting organizations in scaling with confidence. Driven by systems thinking, platform-as-a-product mindset, and engineering excellence, I help teams ship faster, operate smarter, and scale with confidence.","sameAs":["https:\/\/aymen-segni.com","https:\/\/www.linkedin.com\/in\/aymen-segni","https:\/\/twitter.com\/https:\/\/x.com\/axsegni"],"url":"https:\/\/aymen-segni.com\/index.php\/author\/admin8647\/"}]}},"jetpack_featured_media_url":"https:\/\/aymen-segni.com\/wp-content\/uploads\/2020\/01\/Kubernetes-Security-600x400_1554495004.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/posts\/212","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/comments?post=212"}],"version-history":[{"count":107,"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/posts\/212\/revisions"}],"predecessor-version":[{"id":531,"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/posts\/212\/revisions\/531"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/media\/461"}],"wp:attachment":[{"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/media?parent=212"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/categories?post=212"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aymen-segni.com\/index.php\/wp-json\/wp\/v2\/tags?post=212"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}