AKS Cluster

Cluster Info

The PowerShell module provides cluster details in JSON format. To gather AKS cluster info:

Get-AzAksCluster -ResourceGroupName <resource-group-name> -Name <cluster-name>

  • JSON fields
    • currentKubernetesVersion - the version of K8s currently running
    • kubernetesVersion - the target version of K8s
    • AgentPoolProfiles - array of agent pool definitions
      • Count - # of active nodes
      • VmSize - Azure VM SKU, e.g., Standard_D16ds_v5
      • OsDiskType - disk type available, typically Ephemeral
      • OsDiskSizeGB - disk size in GB
      • OsType - Linux or Windows
      • OsSKU - e.g., Ubuntu
      • MaxCount, MinCount - max and min nodes in pool
      • Mode - User or System. BP: System exclusively for K8s components
      • EnableAutoScaling
      • ScaleDownMode - action when scaling down, e.g., Delete
      • Type - node types, e.g., VirtualMachineScaleSets
      • OrchestratorVersion
      • CurrentOrchestratorVersion
      • NodeImageVersion - e.g., AKSUbuntu-2204gen2containerd-202604.24.0
      • UpgradeSettings - settings used during node pool upgrades
        • MaxSurge - Pct increase of nodes, e.g., 25%
    • NodeLabels - array of K8s labels
    • NodeTaints - array of K8s taints
    • Identity.UserAssignedIdentities - the security principals assigned to the cluster. BP: use a user-assigned Managed Identity.

NOTE: AzCLI and Azure PowerShell module emit different JSON.

AKS Objects

K8s Controller Types

AKS Security

AKS-specific Roles

cf AKS built-in roles

  • Azure Kubernetes Service RBAC (increasing permissions)
    • Reader: within specific namespace
      • read-only to most objects
      • cannot
        • read secrets
        • view roles or role bindings
    • Writer: within specific namespace
      • r/w to most objects
      • access secrets
      • cannot
        • view roles or role bindings
    • Admin: within specific namespace
      • r/w to most resources or cluster scope
      • create roles and role bindings
      • cannot
        • write to namespace
        • alter resource quotas
    • Cluster Admin: Full control over every resource in the cluster and in all namespaces.