<p>I'm setting up RBAC in my AKS cluster which is integrated with Azure AD following the instructions <a href="https://learn.microsoft.com/en-us/azure/aks/azure-ad-rbac?toc=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fazure%2Faks%2FTOC.json&amp;bc=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fazure%2Fbread%2Ftoc.json" rel="nofollow noreferrer">here</a>. I have created an AD group in my AAD tenant, added a user to it. Then the group is assigned "Cluster User role" in the AKS cluster as per the instructions. Created a Role and Rolebinding as shown below:</p>

<p>Role:</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: development
  name: restricted-role
rules:
- apiGroups: [""] 
  resources: ["pods"]
  verbs: ["get", "watch", "list"]
</code></pre>

<p>RoleBinding:</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: development
subjects:
- kind: Group
  name: 308f50cb-e05a-4340-99d4-xxxxxxxb 
  apiGroup: rbac.authorization.k8s.io
  namespace: development
roleRef:
  kind: Role 
  name: restricted-role 
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>I then tried login using the new user credentials:</p>

<pre><code>az login --username kubeuser@xxx.onmicrosoft.com --password xxxx

az aks get-credentials --name mycluster --resource-group myrg --overwrite-existing
</code></pre>

<p>As per the documentation, I should be only allowed to do kubectl get pods on the development namespace. However, using this new user credentials, I see that I can do kubectl get pods --all-namespaces, kubectl get svc --all-namespaces etc. and view the results, as if the Rolebinding does not have any impact at all. I also have verified by <a href="https://resources.azure.com/" rel="nofollow noreferrer">checking</a> that my cluster has </p>

<blockquote>
  <p>"enableRBAC": true</p>
</blockquote>

<p>Can someone please tell me what is wrong with this configuration?</p>

<p>Using the command:</p>
<pre><code>az aks show -g &lt;rg&gt; -n &lt;clusterName&gt; --query aadProfile
</code></pre>
<p>you can confirm if the cluster has Azure Active Directory enabled. If so, the <code>kubeconfig</code> file you get from the following command:</p>
<pre><code>az aks get-credentials -g &lt;rg_name&gt; -n &lt;aks_name&gt;
</code></pre>
<p>should look like:</p>
<pre><code>user:
  auth-provider:
    config:
      apiserver-id: &lt;appserverid&gt;
      client-id: &lt;clientid&gt;
      environment: AzurePublicCloud
      tenant-id: &lt;tenant&gt;
    name: azure
</code></pre>
