weird authorization error when authenticating via service principal

[David He]

I was following this guide to authenticate against my cluster via service principal. So what I did was:

• Firstly register an app in EntraID
• Grant the app some permissions via RBAC

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ado-svc-role
rules:
  - apiGroups: [""]
    resources: ["pods", "services", "deployments"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ado-svc-role-binding
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: <app_object_id>
roleRef:
  kind: ClusterRole
  name: ado-svc-role
  apiGroup: rbac.authorization.k8s.io

• Auth and verification

export AAD_SERVICE_PRINCIPAL_CLIENT_ID=<app-client-id>
export AAD_SERVICE_PRINCIPAL_CLIENT_SECRET=<app-secret-id>

az login --service-principal -u <app-client-id> -p <app-client-secret> --tenant <tenant-id>

az aks get-credentials --subscription <subscription-id> --resource-group <resource-group-name> --name <cluster-name> --file ./custom-kubeconfig

export KUBECONFIG=$(pwd)/custom-kubeconfig

kubelogin --kubeconfig "${KUBECONFIG}" convert-kubeconfig -l spn --client-id ${AAD_SERVICE_PRINCIPAL_CLIENT_ID} --client-secret ${AAD_SERVICE_PRINCIPAL_CLIENT_SECRET} \
    --tenant-id <tenant-id>

kubectl get nodes

Expected Result

Command returns nodes information.

Actual Result

kubectl get nodes command returns error below:

Error from server (Forbidden): nodes is forbidden: User "xxxx" cannot list resource "nodes" in API group "" at the cluster scope

Comments

The user xxxx cannot be linked to the app I've used to login in any way - the uuid of the user (masked by xxxx) is unknown to me.

[Weinong Wang]

the uuid of the user, masked by xxx, is the object ID of the service principal.
you can verify that by az ad sp show --id xxxx

[David He]

@weinong Thanks for getting back. That command returns a different object id than that of my app on EntraID. Any idea why?

However, it still throws the same error even after I set the name of subject to the one returned from cli. Not sure if I've done anything wrong?

[David He]

[Weinong Wang]

first of all, your cluster role doesn't have permission to list nodes. this is the reason you got Forbidden.

in your cluster role binding, <app_object_id> should match the object ID on the portal.

[David He]

@weinong sorry a copy & paste mistake - I'd have used kubectl get pods -n main --kubeconfig ${KUBECONFIG}. However, this command gives me the exact same auth error.

I can also confirm the role points to the object_id of my service principal even though it's different than the one shown in the error message.

[David He]

Close it as I've mistaken application object id for service principal object id. They are fundamentally different.