rage.fail

azure-aks-nodepool-executes-as-kubelet-mi

explicit azure emits ExecutesAs

match (record)

{ "field": "properties.identityProfile.kubeletidentity", "resource_type": "Microsoft.ContainerService/managedClusters" }

where

identityProfile.kubeletidentity is set (non-null)

emit

source type	`VirtualMachine`
target type	`ManagedIdentity`
source	`<VMSS instance (individual node) executing the kubelet>`
target	`<kubelet user-assigned MI (resourceId from identityProfile.kubeletidentity)>`

Narrative

AKS node pool nodes in cluster {cluster.name} run as kubelet MI {mi.name}.

Raw rule rules/explicit/azure-aks.yaml

id: azure-aks-nodepool-executes-as-kubelet-mi
emits: ExecutesAs
applies_to:
- azure
match_record:
  resource_type: Microsoft.ContainerService/managedClusters
  field: properties.identityProfile.kubeletidentity
where:
- identityProfile.kubeletidentity is set (non-null)
emit:
  source_type: VirtualMachine
  target_type: ManagedIdentity
  source: <VMSS instance (individual node) executing the kubelet>
  target: <kubelet user-assigned MI (resourceId from identityProfile.kubeletidentity)>
  api_source: az aks show --name <name> --resource-group <rg>
  evidence_field: properties.identityProfile.kubeletidentity.resourceId
  narrative: AKS node pool nodes in cluster {cluster.name} run as kubelet MI {mi.name}.