Least-privilege deployment role

Mon, 01 Jan 0001 00:00:00 +0000

The deployment identity can use a custom role scoped to an existing target resource group. Creating that resource group, defining the custom role, and assigning it are bootstrap operations performed by an administrator. The deployment identity needs these management-plane actions:

[
 "Microsoft.Resources/subscriptions/resourceGroups/read",
 "Microsoft.Resources/deployments/read",
 "Microsoft.Resources/deployments/write",
 "Microsoft.Resources/deployments/validate/action",
 "Microsoft.Resources/deployments/whatIf/action",
 "Microsoft.Resources/deployments/operations/read",
 "Microsoft.ContainerService/managedClusters/read",
 "Microsoft.ContainerService/managedClusters/write",
 "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
 "Microsoft.Authorization/roleAssignments/read",
 "Microsoft.Authorization/roleAssignments/write"
]

These permissions let just validate, just deploy-aks, and just credentials run, and let main.bicep grant the selected principal Azure Kubernetes Service RBAC Cluster Admin on the new cluster. No policy-assignment permission is required. Resource-group deletion remains an administrator cleanup operation and is deliberately outside this role.

Manage Kubeflow users

Mon, 01 Jan 0001 00:00:00 +0000

Background

Change the Dex password and add more static users. Integrating Dex with Microsoft Entra ID is not covered here.

Change the Dex password

The deployment no longer ships a default password: rendered manifests carry an unusable sentinel, and just deploy-kubeflow generates a real one at install time. To replace it at any point, run:

just configure-dex

That generates a 32-character password and its cost-12 bcrypt hash, validates the hash, replaces the dex-passwords Secret, restarts Dex, refreshes the Istio RequestAuthentication JWKS URI, and prints the password once. To generate a password and hash without touching the cluster, run just password.

Kubeflow on AKS

Least-privilege deployment role

Manage Kubeflow users

Background

Change the Dex password