启用AD RBAC且禁用本地账户时，Terraform部署AKS遇授权错误求助

问题定位 #

你遇到的Error: Unauthorized错误主要来自两个核心问题：

• AKS集群的管理员组配置参数错误
• Kubernetes Provider未通过正确的Azure AD认证方式访问新创建的AKS集群

修复步骤 #

1. 修正AKS集群的管理员组对象ID #

在azurerm_kubernetes_cluster的azure_active_directory_role_based_access_control块中，admin_group_object_ids需要传入AD组的对象ID，而非组的资源ID。原代码中使用azuread_group.k8sadmins.id是错误的，应改为azuread_group.k8sadmins.object_id：

azure_active_directory_role_based_access_control {
  managed                = true
  azure_rbac_enabled     = true
  admin_group_object_ids = [azuread_group.k8sadmins.object_id] # 修正此处
}

2. 正确配置Kubernetes Provider #

原代码直接引用本地~/.kube/config，但新创建的AKS集群配置尚未写入该文件，且禁用本地账户后无法通过传统方式访问。需通过AKS集群内置的kubeconfig配置Provider，并借助kubelogin工具完成Azure AD认证：

首先确保已安装kubelogin（可通过az aks install-cli命令安装），然后更新Kubernetes Provider配置：

provider "kubernetes" {
  host                   = azurerm_kubernetes_cluster.example.kube_config.0.host
  client_certificate     = base64decode(azurerm_kubernetes_cluster.example.kube_config.0.client_certificate)
  client_key             = base64decode(azurerm_kubernetes_cluster.example.kube_config.0.client_key)
  cluster_ca_certificate = base64decode(azurerm_kubernetes_cluster.example.kube_config.0.cluster_ca_certificate)
  
  # 通过kubelogin完成Azure AD认证
  exec {
    api_version = "client.authentication.k8s.io/v1beta1"
    command     = "kubelogin"
    args = [
      "get-token",
      "--environment", "AzurePublicCloud",
      "--server-id", azurerm_kubernetes_cluster.example.kube_config.0.cluster_id
    ]
  }
}

3. 调整角色分配的依赖顺序 #

确保AD组创建完成后再分配角色，避免因组未完全创建导致的权限问题：

resource "azurerm_role_assignment" "example" {
  depends_on           = [azurerm_resource_group.example, azuread_group.k8sadmins] # 添加AD组依赖
  scope                = azurerm_resource_group.example.id
  role_definition_name = "Azure Kubernetes Service Cluster Admin Role"
  principal_id         = azuread_group.k8sadmins.object_id
}

4. 优化Lifecycle配置 #

原代码中lifecycle { ignore_changes = all }会阻止所有后续配置更新，建议仅忽略敏感或无需变更的字段（如服务主体密钥）：

lifecycle {
  ignore_changes = [service_principal.client_secret]
}

5. 验证运行账户权限 #

确保执行Terraform的Azure账户具备以下权限：

• 资源组创建权限（Contributor角色）
• Azure AD组创建权限
• 角色分配权限（User Access Administrator角色）
• AKS集群创建权限

完整修正后的代码示例 #

provider "azurerm" {
  features {}
} 

provider "azuread" {}  

data "azuread_user" "aad" {
  mail_nickname = "madhurshukla23jan_gmail.com#EXT#"
} 

resource "azuread_group" "k8sadmins" {
  display_name     = "Kubernetes Admins"
  members          = [data.azuread_user.aad.object_id]
  security_enabled = true
} 

resource "azurerm_resource_group" "example" {
  name     = "example-resources131"
  location = "West Europe"
} 

resource "azurerm_role_assignment" "example" {
  depends_on           = [azurerm_resource_group.example, azuread_group.k8sadmins]
  scope                = azurerm_resource_group.example.id
  role_definition_name = "Azure Kubernetes Service Cluster Admin Role"
  principal_id         = azuread_group.k8sadmins.object_id
}

resource "azurerm_kubernetes_cluster" "example" {
  name                = "example-aks131"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  dns_prefix          = "exampleaks131"

  default_node_pool {
    name       = "default"
    node_count = 1
    vm_size    = "Standard_D2_v2"
  }

  azure_active_directory_role_based_access_control {
    managed                = true
    azure_rbac_enabled     = true
    admin_group_object_ids = [azuread_group.k8sadmins.object_id]
  }

  local_account_disabled = true

  service_principal {
    client_id     = "xxxxxx"
    client_secret = "xxxxxx"
  }

  tags = {
    Environment = "Production"
  }

  lifecycle {
    ignore_changes = [service_principal.client_secret]
  }
}

provider "kubernetes" {
  host                   = azurerm_kubernetes_cluster.example.kube_config.0.host
  client_certificate     = base64decode(azurerm_kubernetes_cluster.example.kube_config.0.client_certificate)
  client_key             = base64decode(azurerm_kubernetes_cluster.example.kube_config.0.client_key)
  cluster_ca_certificate = base64decode(azurerm_kubernetes_cluster.example.kube_config.0.cluster_ca_certificate)
  
  exec {
    api_version = "client.authentication.k8s.io/v1beta1"
    command     = "kubelogin"
    args = [
      "get-token",
      "--environment", "AzurePublicCloud",
      "--server-id", azurerm_kubernetes_cluster.example.kube_config.0.cluster_id
    ]
  }
}

resource "kubernetes_namespace" "example" {
  metadata {
    name = "your-namespace-name-test13"
  }
}

内容的提问来源于stack exchange，提问作者Madhur