Skip to content

Commit

Permalink
updated support doc
Browse files Browse the repository at this point in the history
  • Loading branch information
naman-msft committed Jan 30, 2025
1 parent 1fbb00c commit 36076e2
Show file tree
Hide file tree
Showing 2 changed files with 17 additions and 31 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ az vm run-command invoke --resource-group $MY_RESOURCE_GROUP_NAME --name $MY_VM_

## CPU

### <a id="mpstat"></a>mpstat
### mpstat

The `mpstat` utility is part of the `sysstat` package. It displays per CPU utilization and averages, which is helpful to quickly identify CPU usage. `mpstat` provides an overview of CPU utilization across the available CPUs, helping identify usage balance and if a single CPU is heavily loaded.

Expand Down
46 changes: 16 additions & 30 deletions scenarios/azure-aks-docs/articles/aks/trusted-access-feature.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ description: Learn how to use the Trusted Access feature to give Azure resources
author: schaffererin
ms.topic: how-to
ms.custom: devx-track-azurecli, innovation-engine
ms.date: 11/05/2024
ms.date: 03/05/2024
ms.author: schaffererin
---

Expand Down Expand Up @@ -36,15 +36,27 @@ You can use Trusted Access to give explicit consent to your system-assigned mana
* [What is Azure Kubernetes Service backup?][aks-azure-backup]
* [Turn on an agentless container posture](/azure/defender-for-cloud/concept-agentless-containers)
* In the same subscription as the Azure resource that you want to access the cluster, [create an AKS cluster](tutorial-kubernetes-deploy-cluster.md).
* [Define environment variables](#define-environment-variables).

## Connect to your cluster
### Define environment variables

Configure `kubectl` to connect to your cluster using the [`az aks get-credentials`][az-aks-get-credentials] command.
To simplify the configuration steps in this article, you can define environment variables using the following commands. Make sure to replace the placeholder values with your own.

```azurecli-interactive
export LOCATION="myLocation"
export RESOURCE_GROUP_NAME="myResourceGroup"
export CLUSTER_NAME="myClusterName"
export ROLE_BINDING_NAME="myRoleBindingName"
export SOURCE_RESOURCE_ID="mySourceResourceID"
export ROLE_NAME_1="myRoleName1"
export ROLE_NAME_2="myRoleName2"
```

## Connect to your cluster

Configure `kubectl` to connect to your cluster using the [`az aks get-credentials`][az-aks-get-credentials] command.

```azurecli-interactive
az aks get-credentials --resource-group ${RESOURCE_GROUP_NAME} --name ${CLUSTER_NAME} --overwrite-existing
```

Expand All @@ -58,42 +70,16 @@ kubectl get nodes

The roles that you select depend on the Azure services that you want to access the AKS cluster. Azure services help create roles and role bindings that build the connection from the Azure service to AKS.

To find the roles that you need, see the documentation for the Azure service that you want to connect to AKS. You can also use the Azure CLI to list the roles that are available for the Azure service using the `az aks trustedaccess role list --location <location>` command.
To find the roles that you need, see the documentation for the Azure service that you want to connect to AKS. You can also use the Azure CLI to list the roles that are available for the Azure service using the `az aks trustedaccess role list --location $LOCATION` command.

## Create a Trusted Access role binding

After you confirm which role to use, use the Azure CLI to create a Trusted Access role binding in the AKS cluster. The role binding associates your selected role with the Azure service.

```azurecli-interactive
export RANDOM_SUFFIX=$(openssl rand -hex 3)
export ROLE_BINDING_NAME="myRoleBindingName${RANDOM_SUFFIX}"
export SOURCE_RESOURCE_ID=$(az storage account list --resource-group $RESOURCE_GROUP_NAME --query '[0].id' -o tsv)
export ROLE_NAME_1="myRoleName1"
export ROLE_NAME_2="myRoleName2"
az aks trustedaccess rolebinding create --resource-group ${RESOURCE_GROUP_NAME} --cluster-name ${CLUSTER_NAME} --name ${ROLE_BINDING_NAME} --source-resource-id ${SOURCE_RESOURCE_ID} --roles ${ROLE_NAME_1},${ROLE_NAME_2}
```

Results:

<!-- expected_similarity=0.3 -->

```json
{
"id": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/${RESOURCE_GROUP_NAME}/providers/Microsoft.ContainerService/managedClusters/${CLUSTER_NAME}/trustedAccessRoleBindings/${ROLE_BINDING_NAME}",
"name": "${ROLE_BINDING_NAME}",
"provisioningState": "Succeeded",
"resourceGroup": "${RESOURCE_GROUP_NAME}",
"roles": [
"${ROLE_NAME_1}",
"${ROLE_NAME_2}"
],
"sourceResourceId": "${SOURCE_RESOURCE_ID}",
"systemData": null,
"type": "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings"
}
```

## Update an existing Trusted Access role binding

For an existing role binding that has an associated source service, you can update the role binding with new roles using the `az aks trustedaccess rolebinding update --resource-group $RESOURCE_GROUP_NAME --cluster-name $CLUSTER_NAME --name $ROLE_BINDING_NAME --roles $ROLE_NAME_3,$ROLE_NAME_4` command. This command updates the role binding with the new roles that you specify.
Expand Down

0 comments on commit 36076e2

Please sign in to comment.