# A Helm Chart for AKS Permissions

**Summary**: This wiki page shows how to use my helm chart for AKS Permissions. \\
**Date**: 8 February 2026 \\
{{tag>helm kubernetes azure}}

This is the wiki page on how the helm chart [[https://github.com/getshifting/getshifting/tree/main/helm/charts/aks-permissions |aks-permissions]] was created. This helm chart is used to create roles and assign these roles, as well as the standard roles to groups or persons on kubernetes. As this is for AKS, the identities are from Entra ID.

## The chart

The chart itself is available on my public Github. On top of that, I've also created two examples of values files, and their generated manifests:

  * The chart is [[https://github.com/getshifting/getshifting/tree/main/helm/charts/aks-permissions |on Github]]
  * The first example is for a DEV environment. Most of the groups simply get clusterAdmin permissions:
    * The values file is [[https://github.com/getshifting/getshifting/tree/main/helm/values/aks-permissions-dev.yaml |here on Github]]
    * The generated manifest is [[https://github.com/getshifting/getshifting/tree/main/helm/generatedHelmChartsExamples/aks-permissions-dev.yaml |here on Github]]
  * The second example is for a PRD environmentit has more fine-grained permissions using the custom roles:
    * The values file is [[https://github.com/getshifting/getshifting/tree/main/helm/values/aks-permissions-prd.yaml |here on Github]]
    * The generated manifest is [[https://github.com/getshifting/getshifting/tree/main/helm/generatedHelmChartsExamples/aks-permissions-prd.yaml |here on Github]]

## Adding CRD Permissions

As CustomResourceDefinitions (CRDs) are cluster scoped objects, you need to define and assign permissions separately for groups that only get permissions in namespaces. As each application could bring their own CRDs, you can add them to the [[https://github.com/getshifting/getshifting/tree/main/helm/charts/aks-permissions/templates/roles.yaml |roles]] if required and host them in your own [[helmchartsecretprovider#creating_a_helm_repository_in_azure |helm registry]]. To check the CRDs on your own cluster use:

<code bash>
kubectl get crd -o jsonpath='{range .items[*]}{.spec.group}{"\n"}{end}' | sort | uniq
</code>

## Other Permissions

Also, for checking your available resources and their respective verbs you can use these commands:

<code bash>
# Get all the possible k8s resources including their verbs
kubectl api-resources -o wide
# Get all k8s resources that are namespaced by name
kubectl api-resources --namespaced -o name
</code>

//This wiki has been made possible by://

<HTML>
<script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-8613096447910897"
     crossorigin="anonymous"></script>
<!-- Wiki End of Page -->
<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-8613096447910897"
     data-ad-slot="6221699236"
     data-ad-format="auto"
     data-full-width-responsive="true"></ins>
<script>
     (adsbygoogle = window.adsbygoogle || []).push({});
</script>
</HTML>