Azure Authorizer

Guard installation guide can be found here. To use Azure, create a client cert with Organization set to Azure.For Azure CommonName is optional. To ease this process, use the Guard cli to issue a client cert/key pair.

$ guard init client [CommonName] -o Azure

Azure authenticator guide can be found here.

ARC mode

Guard can be configured with arc mode which uses service principal (azure.client-id configured for authentication) with read access on subscription of kubernetes cluster.

Deploy guard server

To generate installer YAMLs for guard server you can use the following command.

# generate Kubernetes YAMLs for deploying guard server
$ guard get installer \
    -- all authentication options as per Azure authenticatoin guide
    --authz-providers=azure \
    --azure.authz-mode=arc \
    --azure.resource-id=<arc k8s cluster arm resource id> \
    --azure.skip-authz-check=<comma separated list of user email ids for which Azure RBAC will be skipped>
    --azure.authz-resolve-group-memberships=true \
    --azure.skip-authz-for-non-aad-users=true \
    --azure.allow-nonres-discovery-path-access=true \
    > installer.yaml

$ kubectl apply -f installer.yaml

Note Azure authorization can be enabled only with Azure authentication. Create single installer.yaml with both authentication and authorization options together. ARC mode can be enabled with client credential mode or On-Behalf-Of (OBO) mode. Keep azure.skip-authz-for-non-aad-users=true for certificate users (non AAD users) to work with Azure authorization. You are required to set separate Kubernetes RBAC authorizer for certificate users.

Further Reading: