Unable to list pods within the specific namespace from the AKS Cluster using the VM User assigned managed identity

Question

Hi Team,

I have an AKS Cluster with namespace "sample", in which I have deployed just a nginx pod. I have a requirement to list the pods running in the namespace to perform a health check from the VM. My AKS cluster is created with "Microsoft Entra ID Authentication with Azure RBAC". I gave the VM's user assigned identity the maximum permission of "AKS Cluster Admin Role" and "AKS RBAC Admin role". However when I try to use the Kubernetes REST API to list the pods I am getting the following error:

{

"kind": "Status",

"apiVersion": "v1",

"metadata": {},

"status": "Failure",

"message": "Unauthorized",

"reason": "Unauthorized",

"code": 401

}

Step1: I tried to retrieve token of the user assigned managed identity using the following command

TOKEN=$(az account get-access-token --resource=https://management.azure.com/ --query accessToken -o tsv)

Step2: I gave the below command to list the pods which is giving me the 401 error.

curl -k -X GET https://$APISERVER/api/v1/namespaces/sample/pods -H "Authorization: Bearer $TOKEN"

Also, I have created the ClusterRoleBinding with cluster role "cluster-admin" to the object id of the User assigned managed identity of VM. (tried with Client id as well).

Please advise what I am missing with this.

Answer 1

Hi @Jeyasingh, Vijayalingam,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

We do not have a direct REST API to list the pods in the AKS cluster. You can use the command kubectl get pods to get the list of pods in the AKS cluster.

I would recommend you refer to this- https://learn.microsoft.com/en-us/answers/questions/2122637/can-anyone-provide-api-documentation-or-guidance-o

If you have any further queries, do let us know.