We are using AKS in Azure, and we have RBAC setup so our admins can login to the cluster.
We are logging into the cluster and trying something simple to list the deployments with:
az aks get-credentials --resource-group groupname --name aksname --subscription subid
kubectl get deployments --all-namespaces=true
When using kubectl get deployments --all-namespaces=true we are asked to open a browser and enter the code, however an error comes back in the browser and the login fails:
Request Id: 8d0fd182-1b31-45ee-8798-c7f799662c00
Correlation Id: ed808bbb-76b4-4cd7-b62b-da4807acc4ae
Timestamp: 2021-06-16T00:22:55.668Z
App name: Azure Kubernetes Service AAD Client
App id: 80faf920-1908-4b52-b5ef-a8e7bedfc67a
IP address: <IP>
Device identifier: Not available
Device platform: Windows 10
Device state: Unregistered
We have a Conditional Access policy that says outside of our Office LAN, users that connect must use 1. MFA, and 2. Have a hybrid Joined Device.
It seems the error Device state: Unregistered is not correct, because our devices are Hybrid Joined. Possibly the Azure Kubernetes Service AAD Client is not able to pickup the device state?
We tried to add the Azure Kubernetes Service AAD Client as an exception in the CA policy, but it's not available in the App List.
Any suggestions? Could be that Azure Kubernetes Service AAD Client has a bug?