Step 3: Enable optimization on AKS clusters

To allow Perforce Unified Compliance to authenticate and securely retrieve metrics from Azure Kubernetes Service (AKS) clusters, complete the following prerequisites:

  • Create an Azure Service Principal for Perforce Unified Compliance.

  • Create and assign the required roles to the Service Principal.

  • Enable Microsoft Entra ID (formerly Azure Active Directory) integration and Azure RBAC on your AKS clusters.

Create a Service Principal

Perforce Unified Compliance requires an Azure Service Principal with read-only access to perform AKS cluster discovery and metrics collection. If you don't already have one, follow the Microsoft documentation for creating an Azure service principal.

After creating the Service Principal, record the following values, you need them when connecting the account to Perforce Unified Compliance:

  • appId: Client ID

  • password: Client Secret

  • tenant: Tenant ID

Create and assign the custom role

The Service Principal requires two roles assigned at subscription scope:

  • Reader: Built-in Azure role that grants read access to subscription metadata.

  • Puppet Cloud Desired State Reader: Custom role that grants read-only access to AKS infrastructure and Kubernetes cluster data. For the role definition JSON, see Custom role for Service Principal.

Create the custom role

  1. Copy the role definition JSON from Custom role for Service Principal and save it as a JSON file. Replace <your_subscription_id> in the assignableScopes field with your subscription ID.

  2. In the Azure portal, go to Subscriptions and select your subscription.

  3. In the left panel, select Access control (IAM).

  4. Select + Add > Add custom role.

  5. Under Baseline permissions, select Start from JSON, then import your updated JSON file.

  6. Select Review + create.

Assign the roles to the Service Principal

Repeat the following steps for both the Reader role and the Puppet Cloud Desired State Reader custom role:

  1. In the Azure portal, go to Subscriptions and select your subscription.

  2. Select Access control (IAM) > Add > Add role assignment.

  3. Select the role to assign.

  4. Under Members, select your Perforce Unified Compliance Service Principal.

  5. Select Review + assign.

Assigning the roles at subscription scope makes them apply to all resource groups under that subscription.

Before you begin

Ensure the following prerequisites are met:

  • You have an existing AKS cluster or plan to create one

  • Azure CLI version 2.0.61 or later is installed

  • kubectl (the Kubernetes command-line tool) is installed and configured.

  • You have access to a Microsoft Entra ID tenant

Enable access to a single cluster

To enable Entra ID and Azure RBAC on a single cluster, run the following command in the Azure CLI:

Copy 
az aks update \
    --name <cluster_name> \
    --resource-group <resource_group_name> \
    --enable-aad \
    --enable-azure-rbac

Enable access to multiple clusters

If you manage multiple AKS clusters, you can automate the update using a script. You must have Owner or Contributor access to each cluster.

In the Azure CLI, use the following script:

Copy 
az aks list --query '[].{name:name,rg:resourceGroup}' -o tsv | while read -r CLUSTER_NAME RG; do
echo "Updating cluster: $CLUSTER_NAME in RG: $RG"
az aks update \
    --name "$CLUSTER_NAME" \
    --resource-group "$RG" \
    --enable-aad \
    --enable-azure-rbac
done

Verify the configuration

To confirm that Entra ID and Azure RBAC are enabled on a cluster, run the following command in the Azure CLI:

Copy 
az aks show --name <cluster_name> --resource-group <resource_group_name> \
--query "{AADenabled: aadProfile.managed, AzureRBACenabled: azurePortalFqdn}" -o table

Next steps

After completing the steps to configure the account, you can connect to Perforce Unified Compliance. Follow the instructions in Connect an Azure account.