Skip to content

[AKS] Use AAD auth by default for AKS addons #29422

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
VeryEarly merged 2 commits into from
Apr 22, 2026
Merged

[AKS] Use AAD auth by default for AKS addons #29422

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2df7e68
Use AAD auth for AKS addons
NoriZC Apr 20, 2026
8927014
record test
NoriZC Apr 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions src/Aks/Aks.Test/ScenarioTests/KubernetesTests.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,22 +212,23 @@ function Test-EnableAndDisableAzAksAddons
{
New-AzResourceGroup -Name $resourceGroupName -Location 'eastus'

$cluster = New-AzAksCluster -ResourceGroupName $resourceGroupName -Name $kubeClusterName -NodeVmSize $nodeVmSize
$cluster = New-AzAksCluster -ResourceGroupName $resourceGroupName -Name $kubeClusterName -NodeVmSize $nodeVmSize -GenerateSshKey
Copy link

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using -GenerateSshKey in this scenario test can make the test flaky and can have side effects on the build agent: New-AzAksCluster -GenerateSshKey writes to {HOME}/.ssh/id_rsa and throws if that file already exists. Prefer passing -SshKeyValue from a test-generated temporary key (or reusing an existing test key) so the test doesn’t depend on or modify the agent’s user profile.

Copilot uses AI. Check for mistakes.
Assert-Null $cluster.AddonProfiles

$cluster = $cluster | Enable-AzAksAddon -Name AzurePolicy
Assert-AreEqual $true $cluster.AddonProfiles['azurepolicy'].Enabled
$cluster = $cluster | Disable-AzAksAddon -Name AzurePolicy
Assert-AreEqual $false $cluster.AddonProfiles['azurepolicy'].Enabled

$cluster2 = New-AzAksCluster -ResourceGroupName $resourceGroupName -Name $kubeClusterName2 -NodeVmSize $nodeVmSize
$cluster2 = New-AzAksCluster -ResourceGroupName $resourceGroupName -Name $kubeClusterName2 -NodeVmSize $nodeVmSize -GenerateSshKey
Copy link

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using -GenerateSshKey in this scenario test can make the test flaky and can have side effects on the build agent: New-AzAksCluster -GenerateSshKey writes to {HOME}/.ssh/id_rsa and throws if that file already exists. Prefer passing -SshKeyValue from a test-generated temporary key (or reusing an existing test key) so the test doesn’t depend on or modify the agent’s user profile.

Copilot uses AI. Check for mistakes.
Assert-Null $cluster2.AddonProfiles
#$workspace = New-AzOperationalInsightsWorkspace -Location $location -Name 'akstestws' -ResourceGroupName $resourceGroupName
#$workspaceId = $workspace.ResourceId
$workspaceId = '/subscriptions/0e745469-49f8-48c9-873b-24ca87143db1/resourceGroups/AKS_TEST_RG/providers/Microsoft.OperationalInsights/workspaces/akstestws'

$cluster2 = Enable-AzAksAddon -Name 'Monitoring' -WorkspaceResourceId $workspaceId -ResourceGroupName $resourceGroupName -ClusterName $kubeClusterName2
Assert-AreEqual $true $cluster2.AddonProfiles['omsagent'].Enabled
Assert-AreEqual 'true' $cluster2.AddonProfiles['omsagent'].Config['useAADAuth']
$cluster2 = Disable-AzAksAddon -Name 'Monitoring' -ResourceGroupName $resourceGroupName -ClusterName $kubeClusterName2
Assert-AreEqual $false $cluster2.AddonProfiles['omsagent'].Enabled
}
Expand Down
2 changes: 2 additions & 0 deletions src/Aks/Aks/ChangeLog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,8 @@
- Additional information about change #1
-->
## Upcoming Release
* Set `useAADAuth` to `true` by default in the omsagent addon profile when enabling the Monitoring addon via `Enable-AzAksAddOn` and `New-AzAksCluster`
- This ensures compatibility with the latest Azure Monitor agent which requires AAD authentication
Comment on lines +21 to +22
Copy link

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changelog entry uses the acronym "AAD" without expanding it. In ChangeLog.md entries, less-obvious acronyms should be explained on first use (e.g., "AAD (Azure Active Directory)") and the entry should focus on user impact (for example, clarifying how enabling the Monitoring add-on behavior changes for users).

Suggested change
* Set `useAADAuth` to `true` by default in the omsagent addon profile when enabling the Monitoring addon via `Enable-AzAksAddOn` and `New-AzAksCluster`
- This ensures compatibility with the latest Azure Monitor agent which requires AAD authentication
* Updated the Monitoring addon behavior in `Enable-AzAksAddOn` and `New-AzAksCluster` to set `useAADAuth` to `true` by default in the omsagent addon profile
- When you enable the Monitoring addon, Azure Active Directory authentication is now enabled by default for compatibility with the latest Azure Monitor agent

Copilot uses AI. Check for mistakes.

## Version 7.1.1
* Fixed the default SSH key generation logic in `New-AzAksCluster` to enforce RSA key type (instead of ed25519 that became the default in OpenSSH 9.4 and above)
Expand Down
3 changes: 2 additions & 1 deletion src/Aks/Aks/Utils/AddonUtils.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,7 +84,8 @@ private static IDictionary<string, ManagedClusterAddonProfile> EnableAddonMonito
string addonServiceName = Constants.AddOnUserReadNameToServiceNameMapper.GetValueOrDefault(Constants.AddOnNameMonitoring, null);
Dictionary<string, string> config = new Dictionary<string, string>
{
{ "logAnalyticsWorkspaceResourceID", TrimWorkspaceResourceId(workspaceResourceIdValue) }
{ "logAnalyticsWorkspaceResourceID", TrimWorkspaceResourceId(workspaceResourceIdValue) },
{ "useAADAuth", "true" }
};
ManagedClusterAddonProfile addonProfile = new ManagedClusterAddonProfile(true, config);
addonProfiles = EnableAddonsProfile(addonProfiles, addonServiceName, addonProfile);
Expand Down
Loading