Azure / AKS

Azure Kubernetes Service
https://azure.github.io/AKS/
1.97k stars 306 forks source link

Enable user with limited namespace permissions, to use Kubernetes resource view for AAD integrated AKS #2286

Open lissff opened 3 years ago

lissff commented 3 years ago

What happened:

For AAD integrated AKS, if user only had access to limited namespace, with role/rolebindings, .e.g.

_**apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: rolebinding-test-admin namespace: test roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: admin subjects:

User cannot use Kubernetes resource view in AKS portal to view/manage resources in his namespace. It only works for clusterRoles.

What you expected to happen: User should view/edit resources in his namespace in Kubernetes resource view in AKS portal

How to reproduce it (as minimally and precisely as possible):

Anything else we need to know?:

Environment:

ghost commented 3 years ago

Hi lissff, AKS bot here :wave: Thank you for posting on the AKS Repo, I'll do my best to get a kind human from the AKS team to assist you.

I might be just a bot, but I'm told my suggestions are normally quite good, as such: 1) If this case is urgent, please open a Support Request so that our 24/7 support team may help you faster. 2) Please abide by the AKS repo Guidelines and Code of Conduct. 3) If you're having an issue, could it be described on the AKS Troubleshooting guides or AKS Diagnostics? 4) Make sure your subscribed to the AKS Release Notes to keep up to date with all that's new on AKS. 5) Make sure there isn't a duplicate of this issue already reported. If there is, feel free to close this one and '+1' the existing issue. 6) If you have a question, do take a look at our AKS FAQ. We place the most common ones there!

ghost commented 3 years ago

Triage required from @Azure/aks-pm

ghost commented 3 years ago

Action required from @Azure/aks-pm

ghost commented 3 years ago

Issue needing attention of @Azure/aks-leads

ghost commented 3 years ago

Issue needing attention of @Azure/aks-leads

ghost commented 3 years ago

Issue needing attention of @Azure/aks-leads

ghost commented 3 years ago

Issue needing attention of @Azure/aks-leads

ghost commented 3 years ago

Issue needing attention of @Azure/aks-leads

ghost commented 3 years ago

Issue needing attention of @Azure/aks-leads

ghost commented 3 years ago

Issue needing attention of @Azure/aks-leads

ghost commented 3 years ago

Issue needing attention of @Azure/aks-leads

ghost commented 3 years ago

Issue needing attention of @Azure/aks-leads

ghost commented 3 years ago

Issue needing attention of @Azure/aks-leads

ghost commented 2 years ago

@jenetlan, @chandraneel, @raghulmsft would you be able to assist?

Issue Details
**What happened**: For AAD integrated AKS, if user only had access to limited namespace, with role/rolebindings, .e.g. _**apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: rolebinding-test-admin namespace: test roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: admin subjects: - apiGroup: rbac.authorization.k8s.io kind: Group name: ***** User cannot use Kubernetes resource view in AKS portal to view/manage resources in his namespace. It only works for clusterRoles. **What you expected to happen**: User should view/edit resources in his namespace in Kubernetes resource view in AKS portal **How to reproduce it (as minimally and precisely as possible)**: **Anything else we need to know?**: **Environment**: - Kubernetes version (use `kubectl version`): - Size of cluster (how many worker nodes are in the cluster?) - General description of workloads in the cluster (e.g. HTTP microservices, Java app, Ruby on Rails, machine learning, etc.) - Others:
Author: lissff
Assignees: miwithro
Labels: `azure/portal`, `feature-request`
Milestone: -
ghost commented 2 years ago

Action required from @Azure/aks-pm

ghost commented 2 years ago

Issue needing attention of @Azure/aks-leads

ghost commented 2 years ago

Issue needing attention of @Azure/aks-leads

ghost commented 2 years ago

Issue needing attention of @Azure/aks-leads

raghulmsft commented 2 years ago

@lissff Thanks for sharing it with us! I'm a PM with the AKS portal team and will look into it!

ghost commented 1 year ago

Action required from @Azure/aks-pm