Add AKS Kubernetes RBAC with Microsoft Entra groups quickstart

[Rebecca Calixte (Rebecca-Calixte)]

Summary

Adds a Terraform quickstart for using Microsoft Entra ID groups with Kubernetes role-based access control (Kubernetes RBAC) in Azure Kubernetes Service (AKS).

The sample demonstrates how to scope existing Microsoft Entra groups to separate Kubernetes namespaces by using AKS Cluster User role assignments, Kubernetes Roles, and RoleBindings.

Includes

• Existing AKS cluster lookup
• Microsoft Entra group object ID inputs
• AKS Cluster User role assignments
• Separate dev and sre Kubernetes namespaces
• Namespace-scoped Kubernetes Roles and RoleBindings
• Validation steps for confirming allowed and denied namespace access
• Cleanup guidnce

Validation

• terraform fmt completed successfully
• terraform init -backend=false completed successfully
• terraform validate completed successfully

[Rebecca Calixte (Rebecca-Calixte)]

The E2E check is failing because this sample intentionally requires four user-provided values: an existing AKS resource group, cluster name, and two existing Entra group object IDs. The walkthrough documents these prerequisites, so there aren’t safe default values to provide. Should this prerequisite-based sample receive an E2E exception, or is there an approved method for supplying test prerequisites in this repository?

[Vishwajeet Ranade (vranade-microsoft)]

Root cause and fix:

Root cause: The e2e-check job runs terraform apply -input=false -auto-approve on each changed quickstart with no variables. quickstart/101-aks-entra-k8s-rbac intentionally requires four caller-supplied values (resource_group_name, aks_cluster_name, appdev_group_object_id, opssre_group_object_id), so apply failed with Error: No value for required variable.

Fix (using the repo's sanctioned pattern for prerequisite-based samples, as in 202-machine-learning-moderately-secure-existing-VNet):

Added quickstart/101-aks-entra-k8s-rbac/prequisite/ which creates a resource group, an AKS cluster with Microsoft Entra integration and Kubernetes RBAC (azure_rbac_enabled = false), and the two Entra security groups, exporting them as outputs.
Registered quickstart/101-aks-entra-k8s-rbac in the speicalTests map in test/e2e/quickstart_test.go; the test applies the prerequisite first and passes its outputs as vars to the quickstart. Sub-folders are skipped by the generic test, so the prerequisite is not applied standalone.
Documented the prerequisite folder in the quickstart README.
Validation: terraform fmt -check, terraform init -backend=false and terraform validate pass for the prerequisite config (confirming the azurerm 4.x schema usage), and go vet ./e2e/ compiles the test package. CodeQL found no alerts.

Note on the review comment about the folder name: prequisite is intentional — it matches the existing folder name and the prequistePath variable used by 202-machine-learning-moderately-secure-existing-VNet, so renaming it here would break consistency with the established convention.

[Vishwajeet Ranade (vranade-microsoft)]

Approving copilot changes. No manual changes involved.

[Vishwajeet Ranade (vranade-microsoft)]

Approving changes made by Copilot. No manual edits involved.