Skip to main content

AKS Cluster Access for Cloudaware

Configure Azure Kubernetes Service (AKS) cluster access so Cloudaware can discover Kubernetes objects when Microsoft Entra ID (formerly, Azure AD) integration is enabled on the cluster.

If your AKS cluster is not Microsoft Entra/AD‑managed, it is usually sufficient to grant the Cloudaware app the Azure permission Microsoft.ContainerService/managedClusters/listClusterUserCredential/action (for example, via the Azure Kubernetes Service Cluster User Role).

For AD‑integrated clusters, you must also configure Kubernetes RBAC as described below.

Prerequisites​

  • Access to a Cloudaware account.
  • A user with access to the Admin Console for managing integrations (Cloudaware Administrator).
  • Cloudaware Azure integration configured:
  • AKS cluster with Microsoft Entra ID/Azure AD enabled.
    • Ensure to have Owner/Contributor or appropriate permissions in Azure to view the enterprise applications and AKS configuration.
    • Ensure to have cluster-admin (or equivalent) permissions in the AKS cluster to apply RBAC objects.
  • You have kubectl installed and configured to connect to the target AKS cluster.
    • kubectl access to the AKS cluster with privileges to create ClusterRoles and ClusterRoleBindings.

Configuration​

Locate the Cloudaware Service Principal ID​

  1. In the Azure portal, go to Microsoft Entra ID.
  2. Open Enterprise applications.
  3. Find and select the Azure application used for Cloudaware (for example, cloudaware-api-access).
  4. On the Overview blade, copy the Object ID.

This Object ID is the service principal identifier that will be used in the Kubernetes role binding.

Create Kubernetes RBAC for Cloudaware​

Create a file named cloudaware-rbac.yaml with the following contents:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cloudaware-reader
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cloudaware-reader-application-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cloudaware-reader
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: <SERVICE-PRINCIPAL-OBJECT-ID>

Where:

  • cloudaware-reader is a ClusterRole that grants Cloudaware read‑only access (get, watch, list) to all Kubernetes resources in the cluster.
  • cloudaware-reader-application-binding is a ClusterRoleBinding that attaches this ClusterRole to the Cloudaware Azure application.
  • <SERVICE-PRINCIPAL-OBJECT-ID> must be replaced with the Object ID you copied from the Enterprise applications view.

You can further restrict the ClusterRole if you only want Cloudaware to see a subset of API groups or resource types, but the example above provides broad read‑only access consistent with the set of AKS objects ingested by CMDB.

Apply the RBAC Manifest​

Use kubectl to apply the RBAC manifest to your AKS cluster:

kubectl apply -f cloudaware-rbac.yaml

Verify that the ClusterRole and ClusterRoleBinding have been created:

kubectl get clusterrole cloudaware-reader
kubectl get clusterrolebinding cloudaware-reader-application-binding

Verification in Cloudaware​

After RBAC is configured and the Azure permissions are in place:

  • Allow time for the next discovery cycle (up to 24 hours in some environments).
  • In Cloudaware CMDB Navigator, check the MICROSOFT AZURE → COMPUTE → AKS.
  • Confirm that AKS cluster resources (namespaces, nodes, pods, services, role bindings, etc.) are populated.

Troubleshooting​

If AKS resources do not appear:

  • Confirm that:
    • The Azure app has the required Reader (or equivalent) role assignments and AKS permissions (listClusterUserCredential).
    • The service principal Object ID in the ClusterRoleBinding matches the Cloudaware Azure application.
    • The Kubernetes RBAC objects are present and not overridden by other policies.
  • Review Azure and Kubernetes audit logs for denied requests from the Cloudaware app.

Supported AKS Objects​

Azure AKS ObjectCMDB Object API Name
Azure AKS ClusterCA10Z1__CaAzureAksCluster__c
Azure AKS Cluster Agent Pool ProfileCA10Z1__CaAzureAksClusterAgentPoolProfile__c
Azure AKS Cluster Config MapCA10Z1__CaAzureAksClusterConfigMap__c
Azure AKS Cluster Daemon SetCA10Z1__CaAzureAksClusterDaemonSet__c
Azure AKS Cluster DeploymentCA10Z1__CaAzureAksClusterDeployment__c
Azure AKS Cluster EndpointCA10Z1__CaAzureAksClusterEndpoint__c
Azure AKS Cluster FactCA10Z1__CaAzureAksClusterFact__c
Azure AKS Cluster HPACA10Z1__CaAzureAksClusterHpa__c
Azure AKS Cluster IngressCA10Z1__CaAzureAksClusterIngress__c
Azure AKS Cluster Limit RangeCA10Z1__CaAzureAksClusterLimitRange__c
Azure AKS Cluster NamespaceCA10Z1__CaAzureAksClusterNamespace__c
Azure AKS Cluster Network PolicyCA10Z1__CaAzureAksClusterNetworkPolicy__c
Azure AKS Cluster Network Policy RuleCA10Z1__CaAzureAksClusterNetworkPolicyRule__c
Azure AKS Cluster NodeCA10Z1__CaAzureAksClusterNode__c
Azure AKS Cluster Node AddressCA10Z1__CaAzureAksClusterNodeAddress__c
Azure AKS Cluster Node ConditionCA10Z1__CaAzureAksClusterNodeCondition__c
Azure AKS Cluster PodCA10Z1__CaAzureAksClusterPod__c
Azure AKS Cluster Pod ContainerCA10Z1__CaAzureAksClusterPodContainer__c
Azure AKS Cluster Pod Disruption BudgetCA10Z1__CaAzureAksClusterPodDisruptionBudget__c
Azure AKS Cluster Public IP Address LinkCA10Z1__CaAzureAksClusterPublicIpAddressLink__c
Azure AKS Cluster Public IP Prefix LinkCA10Z1__CaAzureAksClusterPublicIpPrefixLink__c
Azure AKS Cluster Replica SetCA10Z1__CaAzureAksClusterReplicaSet__c
Azure AKS Cluster Resource QuotaCA10Z1__CaAzureAksClusterResourceQuota__c
Azure AKS Cluster RoleCA10Z1__CaAzureAksClusterRole__c
Azure AKS Cluster Role BindingCA10Z1__CaAzureAksClusterRoleBinding__c
Azure AKS Cluster SecretCA10Z1__CaAzureAksClusterSecret__c
Azure AKS Cluster ServiceCA10Z1__CaAzureAksClusterService__c
Azure AKS Cluster Service AccountCA10Z1__CaAzureAksClusterServiceAccount__c
Azure AKS Cluster Service Account SecretCA10Z1__CaAzureAksClusterServiceAccountSecret__c
Azure AKS Cluster Stateful SetCA10Z1__CaAzureAksClusterStatefulSet__c
Azure AKS Cluster Storage ClassCA10Z1__CaAzureAksClusterStorageClass__c