Add an AKS Cluster

Before You Begin

Ensure that the API server that you will be adding to strongDM is accessible from your strongDM Gateways/Relays. See our guide on Gateways for more information.

Instructions

1. Log in to the Admin UI and select Clusters from the left-hand navigation menu.

2. In the upper right-hand section of the screen, click the add cluster button.

3. In the cluster settings, set:

   • Display Name: Type in a name for the server (e.g., “aks-sandbox”); this name will show up in the Admin UI.

   We recommend that you choose a name without spaces because some Kubernetes management interfaces, such as Visual Studio Code, do not function properly with cluster names containing spaces.

   • Cluster Type: Select AKS.

   • Hostname: Enter the hostname or IP address of the API server (e.g., “api.aks.example.com”).

     It's imperative that the relay server can connect to the entry you choose for Hostname. To verify the connection, hop on the relay server, and from a command prompt, type the following: $ nc -z <HOSTNAME> port. If your relay can connect to this hostname, you'll be able to proceed.

   • Port: Enter the port (default: 443) to connect to the API server.

   • Secret Store: Choose where the credentials for this cluster will be stored (i.e., strongDM, AWS Secrets Manager, Vault Secret Store, or GCP Secrets Manager).

   • Server CA: Paste the server certificate (plaintext or Base64-encoded), or import a PEM file. You can either generate the server certificate on the API server or get it in Base64 format from your existing Kubernetes configuration (i.e., kubeconfig) file.

     To get the server CA from your kubeconfig file:

     1. Open the CLI and type cat ~/.kube/config to view the file.

     2. In the file, under - cluster, copy the certificate-authority-data value. That is the server certificate in Base64 encoding.

   • Client Certificate: Paste the client certificate (plaintext or Base64-encoded), or import a PEM file. You can either generate the client certificate on the API server or get it in Base64 format from your existing Kubernetes configuration (i.e., kubeconfig) file.

     To get the client certificate from your kubeconfig file:

     1. From the CLI, type cat ~/.kube/config to view the file.

     2. In the file, under - name, copy the client-certificate-data value. That is the client certificate in Base64 encoding.

   • Client Key: Paste the client key (plaintext or Base64-encoded), or import a PEM file. You can either generate the client key on the API server or get it in Base64 format from your existing Kubernetes configuration (i.e., kubeconfig) file.

     To get the client key from your kubeconfig file:

     1. Open the CLI and type cat ~/.kube/config to view the file.

     2. In the file, under - name, copy the client-key-data value. That is the private client key in Base64 encoding.

     When your users connect to this cluster via strongDM, they will have exactly the same rights as the user associated with these keys.

   • Healthcheck Namespace: If enabled for your organization, allows you to specify the namespace used for the resource healthcheck. The supplied credentials must have the rights to perform one of the following kubectl commands in the specified namespace: get pods, get deployments, or describe namespace.

4. Click the create button.

The Admin UI will update and show your new server in a green or yellow state. If yellow, click the pencil icon to the right of the server to re-open the Connection Details screen, and then click Diagnostics to determine where the connection is failing.

If any errors occur, please copy them into an email and send them to support@strongdm.com.