Security & RBAC

# Enable AKS-managed Azure AD integration
az aks update \
  --resource-group myResourceGroup \
  --name myAKSCluster \
  --enable-aad \
  --aad-admin-group-object-ids "$(az ad group show -g AKS-Admins --query id -o tsv)"

# Fetch kubeconfig (interactive login prompt)
az aks get-credentials -g myResourceGroup -n myAKSCluster

# First kubectl command triggers Azure AD device-code login
kubectl get nodes

# ClusterRoleBinding mapping an Azure AD group to cluster-admin
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: aad-admins-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: "a1b2c3d4-aaaa-bbbb-cccc-123456789abc"   # Azure AD group Object ID

# Namespace-scoped Role + RoleBinding for a dev team
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: team-alpha
  name: developer-role
rules:
- apiGroups: ["", "apps"]
  resources: ["pods", "deployments", "services", "configmaps"]
  verbs: ["get", "list", "watch", "create", "update", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: team-alpha
  name: team-alpha-devs
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: developer-role
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: "e5f6a7b8-dddd-eeee-ffff-abcdef012345"   # Azure AD group for Team Alpha

# 1. Enable workload identity on the cluster
az aks update -g myRG -n myAKS --enable-oidc-issuer --enable-workload-identity

# 2. Get the OIDC issuer URL
OIDC_ISSUER=$(az aks show -g myRG -n myAKS --query "oidcIssuerProfile.issuerUrl" -o tsv)

# 3. Create a user-assigned managed identity
az identity create -g myRG -n myapp-identity
CLIENT_ID=$(az identity show -g myRG -n myapp-identity --query clientId -o tsv)

# 4. Create a Kubernetes service account annotated with the identity
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
  name: myapp-sa
  namespace: default
  annotations:
    azure.workload.identity/client-id: "$CLIENT_ID"
EOF

# 5. Create the federated credential (trust between Azure AD identity and K8s SA)
az identity federated-credential create \
  --name myapp-fedcred \
  --identity-name myapp-identity \
  --resource-group myRG \
  --issuer "$OIDC_ISSUER" \
  --subject system:serviceaccount:default:myapp-sa \
  --audience api://AzureADTokenExchange

# Enable Azure Policy add-on
az aks enable-addons --addons azure-policy -g myRG -n myAKS

# Assign a built-in policy: "Kubernetes cluster should not allow privileged containers"
POLICY_DEF="/providers/Microsoft.Authorization/policyDefinitions/95edb821-ddaf-4404-9732-666045e056b4"
az policy assignment create \
  --name "no-privileged-pods" \
  --policy "$POLICY_DEF" \
  --scope "/subscriptions/$SUB_ID/resourceGroups/myRG/providers/Microsoft.ContainerService/managedClusters/myAKS" \
  --params '{"effect":{"value":"Deny"}}'

# Deny-all ingress baseline for a namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress

---
# Allow only frontend → backend on port 8080
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080

# Label a namespace to enforce the "restricted" Pod Security Standard
kubectl label namespace production \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/warn=restricted \
  pod-security.kubernetes.io/audit=restricted

# Enable the add-on
az aks enable-addons --addons azure-keyvault-secrets-provider -g myRG -n myAKS

# Verify driver pods are running
kubectl get pods -n kube-system -l app=secrets-store-csi-driver

# SecretProviderClass referencing Key Vault
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: kv-secrets
  namespace: default
spec:
  provider: azure
  parameters:
    usePodIdentity: "false"
    useVMAssignedIdentity: "false"
    clientID: ""
    keyvaultName: "myKeyVault"
    objects: |
      array:
        - |
          objectName: db-connection-string
          objectType: secret
        - |
          objectName: tls-cert
          objectType: secret
    tenantId: ""
  secretObjects:                          # Optional: sync as K8s Secret
  - secretName: db-secret-k8s
    type: Opaque
    data:
    - objectName: db-connection-string
      key: connectionString

# Pod mounting Key Vault secrets
apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    azure.workload.identity/use: "true"
spec:
  serviceAccountName: myapp-sa
  containers:
  - name: app
    image: myacr.azurecr.io/myapp:v1
    volumeMounts:
    - name: secrets-store
      mountPath: "/mnt/secrets"
      readOnly: true
    env:
    - name: DB_CONN
      valueFrom:
        secretKeyRef:
          name: db-secret-k8s
          key: connectionString
  volumes:
  - name: secrets-store
    csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: "kv-secrets"

# Create an Azure AD group for read-only users
az ad group create --display-name "AKS-Viewers" --mail-nickname "aks-viewers"
VIEWER_GROUP_ID=$(az ad group show -g "AKS-Viewers" --query id -o tsv)

# Add a user to the group
az ad group member add --group "AKS-Viewers" --member-id "<USER_OBJECT_ID>"

# Create a ClusterRoleBinding for the group
cat <<EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: aad-viewers
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: view
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: "$VIEWER_GROUP_ID"
EOF

# Test — have the viewer user run:
#   az aks get-credentials -g myRG -n myAKS
#   kubelogin convert-kubeconfig -l azurecli
#   kubectl get pods --all-namespaces        # ✅ works
#   kubectl delete pod nginx -n default      # ❌ Forbidden

# 1. Create Key Vault and store a secret
az keyvault create -n myKV -g myRG --location eastus
az keyvault secret set --vault-name myKV --name db-password --value "S3cure!P@ss"

# 2. Grant the workload identity access to Key Vault secrets
IDENTITY_CLIENT_ID=$(az identity show -g myRG -n myapp-identity --query clientId -o tsv)
az keyvault set-policy --name myKV \
  --secret-permissions get \
  --spn "$IDENTITY_CLIENT_ID"

# 3. Apply the SecretProviderClass (from YAML above — update clientID, tenantId, keyvaultName)
kubectl apply -f secret-provider-class.yaml

# 4. Deploy the pod
kubectl apply -f pod-with-kv.yaml

# 5. Verify the secret is mounted
kubectl exec myapp -- cat /mnt/secrets/db-password
# Output: S3cure!P@ss

# Deploy two test pods
kubectl run frontend --image=nginx -l app=frontend -n production
kubectl run backend --image=nginx -l app=backend -n production
kubectl expose pod backend --port=80 -n production

# Before policy — frontend can reach backend
kubectl exec frontend -n production -- curl -s --max-time 3 backend
# ✅ HTML response

# Apply deny-all
kubectl apply -f deny-all-ingress.yaml

# After policy — frontend is blocked
kubectl exec frontend -n production -- curl -s --max-time 3 backend
# ❌ Timeout

# Apply allow rule for frontend → backend
kubectl apply -f allow-frontend-to-backend.yaml

# Now frontend can reach backend again
kubectl exec frontend -n production -- curl -s --max-time 3 backend
# ✅ HTML response

# Step 1: Confirm the user's Azure AD identity
az ad signed-in-user show --query '{name:displayName, objectId:id}'

# Step 2: Check which groups the user belongs to
az ad user get-member-objects --id "<USER_OBJECT_ID>"

# Step 3: Look at all RoleBindings in the target namespace
kubectl get rolebindings -n team-alpha -o yaml | grep -A5 "subjects"

# Step 4: Compare group Object IDs — does the binding reference the right group?
# Common mistake: using the group's displayName instead of its Object ID

# Step 5: Check cluster-level bindings too
kubectl get clusterrolebindings -o yaml | grep -B5 "<GROUP_OR_USER_ID>"

# Step 6: Verify Azure AD integration is enabled
az aks show -g myRG -n myAKS --query "aadProfile"

# Fix: Either add the user to the correct Azure AD group,
# or create/update the RoleBinding with the right group Object ID.

# Step 1: Describe the pod to see the exact error
kubectl describe pod myapp
# Look for events like "FailedMount" or "rpc error"

# Step 2: Check CSI driver pods are running
kubectl get pods -n kube-system -l app=secrets-store-csi-driver
kubectl get pods -n kube-system -l app=secrets-store-provider-azure

# Step 3: Check the SecretProviderClass YAML
kubectl get secretproviderclass kv-secrets -o yaml
# Verify: keyvaultName, tenantId, clientID are correct

# Step 4: If using workload identity — verify federated credential
az identity federated-credential list --identity-name myapp-identity -g myRG -o table
# Check issuer URL and subject match

# Step 5: Check Key Vault access policy
az keyvault show -n myKV --query "properties.accessPolicies"
# Verify the managed identity has GET permission for secrets

# Step 6: Check pod has the workload identity label and service account
kubectl get pod myapp -o yaml | grep -A2 "serviceAccountName"
kubectl get pod myapp -o yaml | grep "azure.workload.identity"

# Fix: Common causes are wrong clientID in SecretProviderClass,
# missing Key Vault access policy, or missing pod label/SA annotation.

# Step 1: Read the full error message — it names the constraint
# e.g., "azurepolicy-k8sazurev2noprivilege-..." or "container-restricted-..."

# Step 2: List Gatekeeper constraints
kubectl get constraints
kubectl get constrainttemplates

# Step 3: Describe the specific constraint that blocked the pod
kubectl describe constraint azurepolicy-k8sazurev2noprivilege-xxxxx
# Shows which policy definition it maps to and the enforcement action

# Step 4: Check Azure Policy assignments on the cluster
az policy assignment list --scope "/subscriptions/$SUB_ID/resourceGroups/myRG" \
  --query "[?contains(policyDefinitionId,'Container')].{name:displayName,effect:parameters.effect.value}" -o table

# Step 5: Review your pod spec against the policy
#   - Is securityContext.privileged set to true?
#   - Are resource limits missing?
#   - Is the image from a disallowed registry?

# Step 6: For PSA rejections, check namespace labels
kubectl get namespace production --show-labels | grep pod-security

# Fix: Update the pod spec to comply with the policy, or
# (temporarily) change the policy effect from Deny to Audit for debugging.