Entra sign-in works on the harbor AKS cluster, but every authentica…

Question

Entra sign-in works on the harbor AKS cluster, but every authenticated user is still effectively cluster-admin. What should the security engineer enable for authorization?

Accepted Answer

Turn on Azure RBAC for Kubernetes authorization and assign built-in Kubernetes Azure roles such as Azure Kubernetes Service RBAC Reader, Writer, Admin, or Cluster Admin at cluster or namespace scope. — Entra tells AKS who you are; Azure RBAC for Kubernetes decides what you can do. Flip that authorization switch and hand out Reader/Writer/Admin roles—not a blanket cluster-admin for every badge.

Answer

Distribute a full RoleBinding YAML for cluster-admin to every namespace and require git commits for each user.

Answer

Disable Entra integration and return to a single shared admin kubeconfig to simplify permissions.

Answer

Assign only Azure Reader on the AKS resource in Azure RBAC and assume Kubernetes API authorization is unchanged.

Entra sign-in works on the harbor AKS cluster, but every authenticated user is still effectively cluster-admin. What should the security engineer enable for authorization?

Short Explanation

Full Explanation