Add an AKS Cluster

Prerequisites

Ensure that the API server you intend to add to strongDM is accessible from your strongDM gateways or relays. See our guide on Gateways for more information.

Steps

1. Log in to the Admin UI and go to Infrastructure > Clusters.

2. Click the Add cluster button.

3. In the dialog that appears, set the following configuration properties:

   

   1. Display Name (Required): Enter a meaningful name for this resource, such as aks-sandbox. This name displays throughout strongDM. Do not include special characters like quotes (") or angle brackets (< or >).

      Some Kubernetes management interfaces, such as Visual Studio Code, do not function properly with cluster names containing spaces. If you run into problems, please choose a name without spaces for this field.

   2. Cluster Type (Required): Select AKS.

   3. Hostname (Required): Enter the hostname or IP address of the API server, such as api.aks.example.com. It is imperative that the relay server can connect to the entry you choose for Hostname. To verify the connection, log in to the relay server, and from a command prompt, type $ nc -z <HOSTNAME> port. If your relay can connect to this hostname, you can proceed.

   4. Port (Required): Enter the port (default: 443) to connect to the API server.

   5. Port Override: After a resource is created, the port override is automatically generated. A value between 1024-59999 is assigned as long as it is not used by another resource. You can optionally overwrite it with your own preferred port later in the Port Overrides settings. Note that after specifying the port override number, you must also update the kubectl configuration. See section Port Overrides for more information.

   6. Secret Store: If a Secret Store integration is configured, select where the credentials for this cluster are stored.

   7. Server CA (Required): Paste the server certificate (plaintext or Base64-encoded), or import a PEM file. You can either generate the server certificate on the API server or get it in Base64 format from your existing Kubernetes configuration (kubeconfig) file.

      To get the server CA from your kubeconfig file:

      1. Open the CLI and type cat ~/.kube/config to view the file.
      2. In the file, under - cluster, copy the certificate-authority-data value. That is the server certificate in Base64 encoding.

   8. Client Certificate (Required): Paste the client certificate (plaintext or Base64-encoded), or import a .PEM file. You can either generate the client certificate on the API server or get it in Base64 format from your existing Kubernetes configuration (kubeconfig) file.

      To get the client certificate from your kubeconfig file:

      1. From the CLI, type cat ~/.kube/config to view the file.
      2. In the file, under - name, copy the client-certificate-data value. That is the client certificate in Base64 encoding.

   9. Client Key (Required): Paste the client key (plaintext or Base64-encoded), or import a .PEM file. You can either generate the client key on the API server or get it in Base64 format from your existing Kubernetes configuration (kubeconfig) file.

      To get the client key from your kubeconfig file:

   10. Open the CLI and type cat ~/.kube/config to view the file.

   11. In the file, under - name, copy the client-key-data value. That is the private client key in Base64 encoding.

       When your users connect to this cluster via strongDM, they have exactly the same rights as the user associated with these keys.

   12. Healthcheck Namespace (Optional): If enabled for your organization, you can use this field to specify the namespace used for the resource healthcheck. The supplied credentials must have the rights to perform one of the following kubectl commands in the specified namespace: get pods, get deployments, or describe namespace. If you do not specify a namespace, this field defaults to default.

   13. Authentication (Required): Select either Leased Credential (the default model to access the cluster) or Remote Identities (to use the Remote Identities of strongDM users to access the cluster).

   14. Healthcheck Username (Required): If Authentication is set to Remote Identities, enter the username that should be used to verify strongDM's connection to it. Note that the username must already exist on the target cluster.

   15. Resource Tags (Optional): Assign tags to the resource by entering key-value pairs in the format <KEY>=<VALUE>, such as env=dev.

4. Click the create button.

The Admin UI updates and shows your new server in a green or yellow state. Green indicates a successful connection. If it is yellow, click the pencil icon to the right of the server to reopen the Connection Details screen. Then click Diagnostics to determine where the connection is failing.

If any errors occur, please copy them into an email and send them to support@strongdm.com.