diff --git a/examples/aks-kubelogin/Program.cs b/examples/aks-kubelogin/Program.cs new file mode 100644 index 000000000..cdee0cf10 --- /dev/null +++ b/examples/aks-kubelogin/Program.cs @@ -0,0 +1,49 @@ +using k8s; +using System; +using System.IO; +using System.Text; + +var server = "https://example.hcp.eastus.azmk8s.io"; // the server url of your aks +var clientid = "00000000-0000-0000-0000-000000000000"; // the client id of the your msi +var kubelogin = @"C:\bin\kubelogin.exe"; // the path to the kubelogin.exe + +using var configstream = new MemoryStream(Encoding.ASCII.GetBytes($""" +apiVersion: v1 +clusters: +- cluster: + insecure-skip-tls-verify: true + server: {server} + name: aks +contexts: +- context: + cluster: aks + user: msi + name: aks +current-context: aks +kind: Config +users: +- name: msi + user: + exec: + apiVersion: client.authentication.k8s.io/v1beta1 + args: + - get-token + - --login + - msi + - --server-id + - 6dae42f8-4368-4678-94ff-3960e28e3630 + - --client-id + - {clientid} + command: {kubelogin} + env: null +""")); + +var config = KubernetesClientConfiguration.BuildConfigFromConfigFile(configstream); +IKubernetes client = new Kubernetes(config); +Console.WriteLine("Starting Request!"); + +var list = client.CoreV1.ListNamespacedPod("default"); +foreach (var item in list.Items) +{ + Console.WriteLine(item.Metadata.Name); +} diff --git a/examples/aks-kubelogin/README.md b/examples/aks-kubelogin/README.md new file mode 100644 index 000000000..ab71071b0 --- /dev/null +++ b/examples/aks-kubelogin/README.md @@ -0,0 +1,24 @@ +# AKS C# example using kubelogin + MSI + +This example shows how to use the [kubelogin](https://github.com/Azure/kubelogin) to authenticate using [managed identities](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview) with Azure Kubernetes Service (AKS) using the C# SDK. + + +## Prerequisites + + - turn on AAD support for AKS, see [here](https://docs.microsoft.com/en-us/azure/aks/managed-aad) + - create a managed identity for the AKS cluster + - assign the managed identity the `Azure Kubernetes Service RBAC Cluster Admin` (or other RBAC permission) on the AKS cluster + - assign the managed identity to the VM, see [here](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm) + - install the [kubelogin](https://github.com/Azure/kubelogin) to your machine + +## Running the code + + *You must the the code on VM with MSI* + + - Replace `server` with the address of your AKS cluster + - Replace `clientid` with the client id of the managed identity + - Replace `kubelogin` with the path to the kubelogin executable + +``` +dotnet run +``` \ No newline at end of file diff --git a/examples/aks-kubelogin/aks-kubelogin.csproj b/examples/aks-kubelogin/aks-kubelogin.csproj new file mode 100644 index 000000000..11afe8d56 --- /dev/null +++ b/examples/aks-kubelogin/aks-kubelogin.csproj @@ -0,0 +1,5 @@ + + + Exe + + \ No newline at end of file