Integrate your Azure Active Directory

This topic tells you how to integrate your Azure Active Directory (commonly known as AD).

Integrate Azure AD with a new or existing AKS without Pinniped

Perform the following procedures to integrate Azure AD with a new or existing AKS without Pinniped.

Prerequisites

Meet these prerequisites:

• Download and install the Azure CLI
• Download and install the Tanzu CLI
• Download and install the Tanzu CLI RBAC plug-in

Set up a platform operator

To set up a platform operator:

1. Navigate to the Azure Active Directory Overview page.

2. Select Groups under the Manage side menu.

3. Identify or create an admin group for the AKS cluster.

4. Retrieve the object ID of the admin group.

5. Take one of the following actions.

   • Create an AKS Cluster with Azure AD enabled by running:

     az group create --name RESOURCE-GROUP --location LOCATION
     az aks create -g RESOURCE-GROUP -n MANAGED-CLUSTER --enable-aad --aad-admin-group-object-ids OBJECT-ID
     

     Where:

     • RESOURCE-GROUP is your resource group
     • LOCATION is your location
     • MANAGED-CLUSTER is your managed cluster
     • OBJECT-ID is the object ID

   • Enable Azure AD integration on the existing cluster by running:

     az aks update -g RESOURCE-GROUP -n MANAGED-CLUSTER --enable-aad --aad-admin-group-object-ids OBJECT-ID
     

     Where:

     • RESOURCE-GROUP is your resource group
     • MANAGED-CLUSTER is your managed cluster
     • OBJECT-ID is the object ID

6. Add Platform Operators to the admin group.

7. Log in to the AKS cluster by running:

   az aks get-credentials --resource-group RESOURCE-GROUP --name MANAGED-CLUSTER --admin
   

   Where:

   • RESOURCE-GROUP is your resource group
   • MANAGED-CLUSTER is your managed cluster

Set up a Tanzu Application Platform default role group

To set up a Tanzu Application Platform default role group:

1. Navigate to the Azure Active Directory Overview page.

2. Select Groups under the Manage side menu.

3. Identify or create a list of groups in the Azure AD for each of the Tanzu Application Platform default roles (app-operator, app-viewer, and app-editor).

4. Retrieve the corresponding object IDs for each group.

5. Add users to the groups accordingly.

6. For each object ID retrieved earlier, use the Tanzu CLI RBAC plug-in to bind the object id group to a role by running:

   tanzu rbac binding add -g OBJECT-ID -r TAP-ROLE -n NAMESPACE
   

   Where:

   • OBJECT-ID is the object ID
   • TAP-ROLE is the Tanzu Application Platform role
   • NAMESPACE is the namespace

Set up kubeconfig

To set up kubeconfig:

1. Set up the kubeconfig to point to the AKS cluster by running:

   az aks get-credentials --resource-group RESOURCE-GROUP --name MANAGED-CLUSTER
   

   Where:

   • RESOURCE-GROUP is your resource group
   • MANAGED-CLUSTER is your managed cluster

2. Run any kubectl command to trigger a browser login. For example:

   kubectl get pods
   

Integrate Azure AD with Pinniped

Perform the following procedures to set up Azure AD with Pinniped.

Prerequisites

Meet these prerequisites:

• Download and install the Tanzu CLI
• Download and install the Tanzu CLI RBAC plug-in
• Install Pinniped supervisor and concierge on the cluster without setting up the OIDCIdentityProvider and secret.

Set up the Azure AD app

To set up the Azure AD app:

1. Navigate to the Azure Active Directory Overview page.

2. Select App registrations under the Manage side menu.

3. Select New Registration.

4. Enter the name of the application. For example, gke-pinniped-supervisor-app.

5. Under Supported account types, select Accounts in this organisational directory only (VMware, Inc. only - Single tenant).

6. Under Redirect URI, select Web as the platform.

7. Enter the call URI to the supervisor. For example, https://pinniped-supervisor.example.com/callback.

8. Select Register to create the app.

9. If not already redirected, navigate to the app settings page.

10. Select Token configuration under the Manage menu.

11. Select Add groups claim > All groups (includes distribution lists but not groups assigned to the application).

12. Select Add to create the group claim.

13. Select the app name in the breadcrumb navigation to return to the app settings page.

14. Select the Endpoints tab and record the value in the OpenID Connect metadata document field.

15. Return to the app settings page.

16. Record the Application (client) ID.

17. Select Certificates & secrets under the Manage menu.

18. Create a new client secret and record this value.

19. Add the following YAML to oidc_identity_provider.yaml.

    ---
    apiVersion: idp.supervisor.pinniped.dev/v1alpha1
    kind: OIDCIdentityProvider
    metadata:
      namespace: pinniped-supervisor
      name: azure-ad
    spec:
      # Specify the upstream issuer URL.
      issuer: ISSUER-URL
    
      authorizationConfig:
        additionalScopes: ["openid", "email", "profile"]
        allowPasswordGrant: false
    
      # Specify how claims are mapped to Kubernetes identities.
      claims:
        username: preferred_username
        groups: groups
    
      # Specify the name of the Kubernetes Secret that contains your
      # application's client credentials (created below).
      client:
        secretName: azure-ad-client-credentials
    ---
    apiVersion: v1
    kind: Secret
    metadata:
      namespace: pinniped-supervisor
      name: azure-ad-client-credentials
    type: secrets.pinniped.dev/oidc-client
    stringData:
      clientID: "AZURE-AD-CLIENT-ID"
      clientSecret: "AZURE-AD-CLIENT-SECRET"
    

    Where:

    • ISSUER-URL is the OpenID Connect metadata document URL you recorded earlier, but without the trailing /.well-known/openid-configuration
    • AZURE-AD-CLIENT-ID is the Azure AD client ID you recorded earlier
    • AZURE-AD-CLIENT-SECRET is the Azure AD client secret you recorded earlier

20. Apply your changes from the kubectl CLI by running:

    kubectl apply workspace/pinniped-supervisor/oidc_identity_provider.yaml
    

Set up the Tanzu Application Platform default role group

To set up a Tanzu Application Platform default role group:

1. Navigate to the Azure Active Directory Overview page.

2. Select Groups under the Manage side menu.

3. Identify or create a list of groups in the Azure AD for each of the Tanzu Application Platform default roles (app-operator, app-viewer, and app-editor).

4. Retrieve the corresponding object IDs for each group.

5. Add users to the groups accordingly.

6. For each object ID retrieved earlier, use the Tanzu CLI RBAC plug-in to bind the object id group to a role by running:

   tanzu rbac binding add -g OBJECT-ID -r TAP-ROLE -n NAMESPACE
   

   Where:

   • OBJECT-ID is the object ID
   • TAP-ROLE is the Tanzu Application Platform role
   • NAMESPACE is the namespace

Set up kubeconfig

Follow these steps to set up kubeconfig:

1. Set up kubeconfig using the Pinniped CLI by running:

   pinniped get kubeconfig --kubeconfig-context YOUR-KUBECONFIG-CONTEXT > /tmp/concierge-kubeconfig
   

   Where YOUR-KUBECONFIG-CONTEXT is your your kubeconfig context.

2. Run any kubectl command to trigger a browser login. For example:

   export KUBECONFIG="/tmp/concierge-kubeconfig"
   kubectl get pods