> Hello. My name is Michael Withrow.
I'm a Senior Program Manager
with Azure Kubernetes Service.
This is a walk-through of
Just-in-Time access to Azure Kubernetes Service.
With integrating Just-in-Time access,
it is no longer required to
give all of your administrators
a full-time access to your Kubernetes resources.
Now leveraging that Just-in-Time
integration with your Azure Kubernetes cluster,
you can provide administrators as needed
access to cluster resources.
In the demo we're going to do,
I'm going to walk everybody through
all the required resources to set up the integration.
Then I'll simulate a user who's needing
access to an AKS cluster,
submitting a Just-in-Time request
to add that user to the required group,
and then through that group initiation,
that user will be able to log on.
With that, I will get into the demo.
If you look from a required resources perspective,
the starting point is around Active Directory itself.
The key is that the license should at least be at
a P1 level so that you can leverage
the Just-in-Time access capabilities.
From there, you can start to build out groups that are
tied into that Just-in-Time access capability,
and you'll see here that on this group itself
that this Azure AD roles can
be assigned to the group is clicked Yes.
That's the key integration point.
You'll also notice that I look at that group that
essentially there's no members associated with it.
Just to walk you through,
I could go through and build a new group,
and notice that I would want to click that to be Yes,
to basically set that up.
But the last point that's built
out as well is the Kubernetes cluster.
The key is that this cluster is AD enabled,
and it's pulled that group into the configuration.
In order for users to get into this cluster,
they need to be a member of that demo group.
Now as I alluded to earlier,
there are actually no members
that are associated with this group.
Now from a user resource perspective,
I just want to access the cluster.
Now I'm going to basically put in a call,
and obviously I don't have access.
Now I'm going to call out to my administrator to say,
"Hey, I need access."
Now the administrator can go right into the group from
the group configuration and go
right into privileged access,
and now simply add an assignment.
Now go through and grab that DemoUser,
sorry, that I called out here from a capability.
Now we'll say that user is going to be a member.
Select that group, and now I've got that user stacked in.
Now this is the Git call itself,
so I'm going to mark that user as active and say,
admin access for node maintenance,
could be pod maintenance, whatever it is.
Notice that the time bomb here that I can leverage.
By default it's six months,
but I could set it to whatever I need to,
so I can go back to April,
set that to the 16th and say give the user an hour,
and go to the actual assignment.
Now that'll take a second,
it's going through configuring the user.
You'll see that that user is now stacked in there,
and what this is going to do is actually
inject the user into the group.
Now you can see that user
is actually a member of the group,
which gives the user access to the cluster.
Now when I go through and run my credential call,
so now I'm going to overwrite my basic credentials,
now I'm going to run my Kube call,
and now I need to re-authenticate.
Now I'm going to pump the code in,
grab my demo user.
Now let's go to authenticate
with those new set of credentials,
which gives me that group permissions,
which allows me to now make a call within the cluster.
Now based off of that configuration,
once that hour is up,
that user will automatically be pulled back
out of that group and no longer will have access,
and will have to submit another request to get access.
If I needed to, that administrator could go in
now that the user is actually
done with whatever calls they're doing.
You could through the administrative portal
that I was just in before,
go through and remove that user
from the configuration as well.
That concludes the demo.
Now in summary, what we essentially walked
through was integration with
Just-in-Time access with the Kubernetes cluster,
users can be given rights as needed to
perform their duties in a time boxed manner.
Here are some of the resources
for how you can set that up.
This is a link to our AKS documentation on
that integration. Thank you very much