01 Run aks show command (OSX/Linux/UNIX) using the name of the cluster that you want to re-create as identifier parameter (see Audit section part II to identify the right resource) and custom query filters to get the specified AKS cluster configuration details. The information requested will be required later when the new Azure Kubernetes Service cluster will be launched:
az aks show
--name cc-data-mining-cluster
--resource-group cloud-shell-storage-westeurope
02 The command output should return the requested function configuration information:
{
"aadProfile": null,
"addonProfiles": {
"httpApplicationRouting": {
"config": null,
"enabled": false
}
},
"agentPoolProfiles": [
{
"availabilityZones": null,
"count": 3,
"enableAutoScaling": null,
"maxCount": null,
"maxPods": 110,
"minCount": null,
"name": "agentpool",
"orchestratorVersion": "1.13.10",
"osDiskSizeGb": 150,
"osType": "Linux",
"provisioningState": "Succeeded",
"type": "AvailabilitySet",
"vmSize": "Standard_B2s"
}
],
"apiServerAuthorizedIpRanges": null,
"dnsPrefix": "cc-data-mining-cluster-dns",
"enablePodSecurityPolicy": null,
"enableRbac": false,
"fqdn": "cc-data-mining-cluster-dns-abcdabcd.hcp.westeurope.azmk8s.io",
"id": "/subscriptions/abcdabcd-1243-abcd-1243-abcd1243abcd/resourcegroups/cloud-shell-storage-westeurope/providers/Microsoft.ContainerService/managedClusters/cc-data-mining-cluster",
"identity": null,
"kubernetesVersion": "1.13.10",
"linuxProfile": null,
"location": "westeurope",
"maxAgentPools": 2,
"name": "cc-data-mining-cluster",
"networkProfile": {
"dnsServiceIp": "10.0.0.10",
"dockerBridgeCidr": "172.18.0.1/16",
"loadBalancerSku": "Basic",
"networkPlugin": "kubenet",
"networkPolicy": null,
"podCidr": "10.182.0.0/16",
"serviceCidr": "10.0.0.0/16"
},
"nodeResourceGroup": "MC_cloud-shell-storage-westeurope_cc-data-mining-cluster_westeurope",
"resourceGroup": "cloud-shell-storage-westeurope",
"servicePrincipalProfile": {
"clientId": "1234abcd-1243-abcd-1243-abcd1243abcd"
},
"type": "Microsoft.ContainerService/ManagedClusters",
"windowsProfile": null
}
03 Run ad sp create-for-rbac command (OSX/Linux/UNIX) to generate the service principal required for AKS cluster creation. Use the --skip-assignment parameter to prevent any additional default assignments from being allocated:
az ad sp create-for-rbac
--skip-assignment
04 The command output should return the configuration metadata for the newly created service principal:
{
"appId": "01234567-1234-1234-1234-123456789012",
"displayName": "azure-cli-2019-09-20-12-02-11",
"name": "http://azure-cli-2019-09-20-12-02-11",
"password": "abcdabcd-1234-abcd-1234-abcd1234abcd",
"tenant": "aaaabbbb-aaaa-bbbb-cccc-aaaabbbbcccc"
}
04 Run aks create command (OSX/Linux/UNIX) to launch a new Azure Kubernetes Service (AKS) cluster with the Kubernetes Role-Based Access Control (RBAC) function enabled, using the cluster configuration details returned at step no. 2 and 4. For --service-principal command parameter use the "appId" attribute value returned at step no. 4 and for --client-secret parameter use the "password" attribute value (the command does not produce an output):
az aks create
--name cc-data-mining-rbac-cluster
--resource-group cloud-shell-storage-westeurope
--location "westeurope"
--node-count 3
--node-vm-size "Standard_B2s"
--node-osdisk-size 150
--kubernetes-version "1.13.10"
--service-principal "01234567-1234-1234-1234-123456789012"
--client-secret "abcdabcd-1234-abcd-1234-abcd1234abcd"
--no-ssh-key
--enable-rbac
06 Repeat steps no. 1 – 5 for each Azure Kubernetes Service cluster that you want to re-create in order to enable Kubernetes Role-Based Access Control (RBAC), available within the current subscription.
07 Repeat steps no. 1 – 6 for each subscription created in your Microsoft Azure cloud account.
Security