{"action":"created","issue":{"url":"https://api.github.com/repos/MicrosoftDocs/azure-docs/issues/13517","repository_url":"https://api.github.com/repos/MicrosoftDocs/azure-docs","labels_url":"https://api.github.com/repos/MicrosoftDocs/azure-docs/issues/13517/labels{/name}","comments_url":"https://api.github.com/repos/MicrosoftDocs/azure-docs/issues/13517/comments","events_url":"https://api.github.com/repos/MicrosoftDocs/azure-docs/issues/13517/events","html_url":"https://github.com/MicrosoftDocs/azure-docs/issues/13517","id":351197911,"node_id":"MDU6SXNzdWUzNTExOTc5MTE=","number":13517,"title":"\"/managedClusters/listClusterAdminCredential/action\" is not working as expected","user":{"login":"praveendhac","id":7813705,"node_id":"MDQ6VXNlcjc4MTM3MDU=","avatar_url":"https://avatars2.githubusercontent.com/u/7813705?v=4","gravatar_id":"","url":"https://api.github.com/users/praveendhac","html_url":"https://github.com/praveendhac","followers_url":"https://api.github.com/users/praveendhac/followers","following_url":"https://api.github.com/users/praveendhac/following{/other_user}","gists_url":"https://api.github.com/users/praveendhac/gists{/gist_id}","starred_url":"https://api.github.com/users/praveendhac/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/praveendhac/subscriptions","organizations_url":"https://api.github.com/users/praveendhac/orgs","repos_url":"https://api.github.com/users/praveendhac/repos","events_url":"https://api.github.com/users/praveendhac/events{/privacy}","received_events_url":"https://api.github.com/users/praveendhac/received_events","type":"User","site_admin":false},"labels":[{"id":836703193,"node_id":"MDU6TGFiZWw4MzY3MDMxOTM=","url":"https://api.github.com/repos/MicrosoftDocs/azure-docs/labels/cxp","name":"cxp","color":"bf1394","default":false},{"id":836703308,"node_id":"MDU6TGFiZWw4MzY3MDMzMDg=","url":"https://api.github.com/repos/MicrosoftDocs/azure-docs/labels/in-progress","name":"in-progress","color":"c1d9ff","default":false},{"id":853283851,"node_id":"MDU6TGFiZWw4NTMyODM4NTE=","url":"https://api.github.com/repos/MicrosoftDocs/azure-docs/labels/product-question","name":"product-question","color":"43e08a","default":false},{"id":963935214,"node_id":"MDU6TGFiZWw5NjM5MzUyMTQ=","url":"https://api.github.com/repos/MicrosoftDocs/azure-docs/labels/role-based-access-control/svc","name":"role-based-access-control/svc","color":"ededed","default":false},{"id":836702742,"node_id":"MDU6TGFiZWw4MzY3MDI3NDI=","url":"https://api.github.com/repos/MicrosoftDocs/azure-docs/labels/triaged","name":"triaged","color":"0e8a16","default":false}],"state":"open","locked":false,"assignee":{"login":"mike-urnun-msft","id":36717703,"node_id":"MDQ6VXNlcjM2NzE3NzAz","avatar_url":"https://avatars2.githubusercontent.com/u/36717703?v=4","gravatar_id":"","url":"https://api.github.com/users/mike-urnun-msft","html_url":"https://github.com/mike-urnun-msft","followers_url":"https://api.github.com/users/mike-urnun-msft/followers","following_url":"https://api.github.com/users/mike-urnun-msft/following{/other_user}","gists_url":"https://api.github.com/users/mike-urnun-msft/gists{/gist_id}","starred_url":"https://api.github.com/users/mike-urnun-msft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mike-urnun-msft/subscriptions","organizations_url":"https://api.github.com/users/mike-urnun-msft/orgs","repos_url":"https://api.github.com/users/mike-urnun-msft/repos","events_url":"https://api.github.com/users/mike-urnun-msft/events{/privacy}","received_events_url":"https://api.github.com/users/mike-urnun-msft/received_events","type":"User","site_admin":false},"assignees":[{"login":"mike-urnun-msft","id":36717703,"node_id":"MDQ6VXNlcjM2NzE3NzAz","avatar_url":"https://avatars2.githubusercontent.com/u/36717703?v=4","gravatar_id":"","url":"https://api.github.com/users/mike-urnun-msft","html_url":"https://github.com/mike-urnun-msft","followers_url":"https://api.github.com/users/mike-urnun-msft/followers","following_url":"https://api.github.com/users/mike-urnun-msft/following{/other_user}","gists_url":"https://api.github.com/users/mike-urnun-msft/gists{/gist_id}","starred_url":"https://api.github.com/users/mike-urnun-msft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mike-urnun-msft/subscriptions","organizations_url":"https://api.github.com/users/mike-urnun-msft/orgs","repos_url":"https://api.github.com/users/mike-urnun-msft/repos","events_url":"https://api.github.com/users/mike-urnun-msft/events{/privacy}","received_events_url":"https://api.github.com/users/mike-urnun-msft/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2018-08-16T13:08:24Z","updated_at":"2018-08-16T17:56:56Z","closed_at":null,"author_association":"NONE","body":"Following https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations\r\n\r\nlistClusterAdminCredential is not working as expected.\r\n\r\nCreated below custom role\r\n```\r\n$ az role definition update --role-definition custRoleBlockCAdmin.json\r\n{\r\n  \"assignableScopes\": [\r\n    \"/subscriptions/xx-yy-11-22/\"\r\n  ],\r\n  \"description\": \"Restrict users from getting ClusterAdmin credentials\",\r\n  \"id\": \"/subscriptions/xx-yy-11-22/providers/Microsoft.Authorization/roleDefinitions/aa-bb-88-99\",\r\n  \"name\": \"xxyyzz-6635-4390-9e84-112233\",\r\n  \"permissions\": [\r\n    {\r\n      \"actions\": [\r\n        \"*\"\r\n      ],\r\n      \"dataActions\": [],\r\n      \"notActions\": [\r\n        \"Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action\"\r\n      ],\r\n      \"notDataActions\": []\r\n    }\r\n  ],\r\n  \"roleName\": \"Restrict getting ClusterAdmin kubeconfig\",\r\n  \"roleType\": \"CustomRole\",\r\n  \"type\": \"Microsoft.Authorization/roleDefinitions\"\r\n}\r\n```\r\n\r\nApplied the role to user from Portal. Logged in as the user using az login and executed below commands.\r\n\r\n```\r\n$ az aks get-credentials -n dex-aks -g dex-aks -f rmv_dex-aks_clusteradmin.config\r\nMerged \"dex-aks\" as current context in rmv_dex-aks_clusteradmin.config\r\n\r\n$ az aks get-credentials -n dex-aks -g dex-aks --admin -f rmv_dex-aks_clusteradmin.config\r\nMerged \"dex-aks-admin\" as current context in rmv_dex-aks_clusteradmin.config\r\n```\r\n\r\nExpectation: \r\naz aks get-credentials command should work without \"--admin\" parameter and block when the parameter is passed."},"comment":{"url":"https://api.github.com/repos/MicrosoftDocs/azure-docs/issues/comments/413631872","html_url":"https://github.com/MicrosoftDocs/azure-docs/issues/13517#issuecomment-413631872","issue_url":"https://api.github.com/repos/MicrosoftDocs/azure-docs/issues/13517","id":413631872,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMzYzMTg3Mg==","user":{"login":"mike-urnun-msft","id":36717703,"node_id":"MDQ6VXNlcjM2NzE3NzAz","avatar_url":"https://avatars2.githubusercontent.com/u/36717703?v=4","gravatar_id":"","url":"https://api.github.com/users/mike-urnun-msft","html_url":"https://github.com/mike-urnun-msft","followers_url":"https://api.github.com/users/mike-urnun-msft/followers","following_url":"https://api.github.com/users/mike-urnun-msft/following{/other_user}","gists_url":"https://api.github.com/users/mike-urnun-msft/gists{/gist_id}","starred_url":"https://api.github.com/users/mike-urnun-msft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mike-urnun-msft/subscriptions","organizations_url":"https://api.github.com/users/mike-urnun-msft/orgs","repos_url":"https://api.github.com/users/mike-urnun-msft/repos","events_url":"https://api.github.com/users/mike-urnun-msft/events{/privacy}","received_events_url":"https://api.github.com/users/mike-urnun-msft/received_events","type":"User","site_admin":false},"created_at":"2018-08-16T17:56:56Z","updated_at":"2018-08-16T17:56:56Z","author_association":"CONTRIBUTOR","body":"@praveendhac Thank you for reporting this issue! We will review and share any relevant info. "}}
{"actor":{"display_login":"mike-urnun-msft"}}