A Helm Chart for AKS Permissions

Summary: This wiki page shows how to use my helm chart for AKS Permissions.
Date: 8 February 2026

This is the wiki page on how the helm chart aks-permissions was created. This helm chart is used to create roles and assign these roles, as well as the standard roles to groups or persons on kubernetes. As this is for AKS, the identities are from Entra ID.

The chart itself is available on my public Github. On top of that, I've also created two examples of values files, and their generated manifests:

• The chart is on Github
• The first example is for a DEV environment. Most of the groups simply get clusterAdmin permissions:
  • The values file is here on Github
  • The generated manifest is here on Github
• The second example is for a PRD environmentit has more fine-grained permissions using the custom roles:
  • The values file is here on Github
  • The generated manifest is here on Github

As CustomResourceDefinitions (CRDs) are cluster scoped objects, you need to define and assign permissions separately for groups that only get permissions in namespaces. As each application could bring their own CRDs, you can add them to the roles if required and host them in your own helm registry. To check the CRDs on your own cluster use:

kubectl get crd -o jsonpath='{range .items[*]}{.spec.group}{"\n"}{end}' | sort | uniq

Also, for checking your available resources and their respective verbs you can use these commands:

# Get all the possible k8s resources including their verbs
kubectl api-resources -o wide
# Get all k8s resources that are namespaced by name
kubectl api-resources --namespaced -o name

This wiki has been made possible by: