Microsoft Azure Container Service

Microsoft Azure

Overview

The Azure Container Service connector integrates with Microsoft Azure and synchronizes Azure Kubernetes Service (AKS) managed clusters using the Azure Resource Manager APIs (via the Azure SDK for Java). For each configured subscription it lists all managed clusters and maps each to a Cloud Resource connector object.

Each cluster carries the facts that determine its internet exposure and blast radius: whether its API server is public or private and which IP ranges may reach it, whether its node pools are given public IPs, the subnets those pools run in, the network plugin and policy governing pod traffic, and the identities — both the cluster's own and its kubelet's — whose RBAC grants define what a compromised cluster could reach.

When no subscription is configured the connector enumerates every subscription accessible to the configured Azure AD application; otherwise it processes only the comma-separated subscriptions provided. Subscriptions and clusters are processed in parallel, and a subscription the service principal cannot read is logged and skipped rather than failing the whole sync.

---

Data retrieved from Microsoft Azure Container Service

Connector Object	Required	Maps to Data Model
Managed Cluster	Yes	Cloud Resource

Model relationships

note

For detailed steps on how to view the data retrieved from Microsoft Azure Container Service in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Microsoft Azure Container Service from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Client ID	Yes	—	The service principal client ID. The client ID is generated during service principal registration.
Client secret	Yes	—	The service principal client secret or password.
Tenant ID	Yes	—	The tenant or domain the credential is authorized for. The tenant ID is generated during service principal registration.
Subscription ID	No	—	(Optional) Comma-separated list of Subscription IDs. If none is specified, the connector will automatically discover all subscriptions for the tenant.

Authentication

Method

Azure Active Directory OAuth 2.0 Client Credentials (client ID + client secret + tenant ID), performed by the Azure SDK for Java (ClientSecretCredential) against the Azure public-cloud Active Directory endpoint.

Endpoint

Method	URL
POST	https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token

The token request is issued internally by the Azure Identity library when an AzureResourceManager client is authenticated; the connector does not call the token endpoint directly.

Request Body (form-urlencoded)

Parameter	Value
grant_type	client_credentials
client_id	{clientId}
client_secret	{clientSecret}
scope	https://management.azure.com/.default

Sample Response

{
  "token_type": "Bearer",
  "expires_in": 3599,
  "ext_expires_in": 3599,
  "access_token": "<access_token>"
}

Response Fields

Field	Type	Description
token_type	String	Authorization scheme prefix (Bearer)
expires_in	Integer	Token lifetime in seconds
ext_expires_in	Integer	Extended token lifetime in seconds
access_token	String	Bearer token applied to subsequent Azure Resource Manager requests

Usage

The Azure SDK attaches the bearer token to every Azure Resource Manager request and refreshes it automatically:

Authorization: Bearer <access_token>

The credential is built once and reused per subscription, scoped via withSubscription({subscriptionId}).

Required Permissions

The built-in Reader role at subscription scope is sufficient — it grants the Microsoft.ContainerService/managedClusters/read operation the cluster list requires. No custom role is needed, and the connector never writes to Azure.

---

Sync Behavior

The connector performs a full sync on every run. Azure Resource Manager does not provide an incremental change filter for the managed-cluster list, so each sync enumerates all clusters across the configured subscriptions (or all accessible subscriptions when none is configured). Incremental (delta) syncs are not supported.

---

How to obtain Microsoft Azure Container Service credentials

Obtain the required credentials (clientId, clientSecret, tenantId) from your Microsoft Azure Container Service administrator or the Microsoft Azure Container Service admin console, then enter them in the connection settings above.

note

Reader returns the cluster's Azure Resource Manager representation only. The connector does not read cluster credentials and never connects to the Kubernetes API server, so no listClusterUserCredential/listClusterAdminCredential permission is required and no in-cluster objects (pods, services, secrets) are synchronized.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Managed Cluster

Source Field Name	SDM Attribute
:---	:---
:---	:---
:---	:---
:---	:---
Boolean	enablePrivateCluster
Boolean	enablePrivateClusterPublicFqdn
Boolean	enableNodePublicIp
Integer	count
KubernetesCluster.fqdn	FQDN
KubernetesCluster.id	UID
KubernetesCluster.id	RESOURCE_ID
KubernetesCluster.name	NAME
KubernetesCluster.networkProfile	NETWORK_PROFILE
KubernetesCluster.regionName	REGION
KubernetesCluster.resourceGroupName	RESOURCE_GROUP
KubernetesCluster.tags	TAGS
KubernetesCluster.version	KUBERNETES_VERSION
List	authorizedIpRanges
List	nodeLabels
List	nodeTaints
ManagedCluster.agentPoolProfiles	AGENT_POOL_PROFILES
ManagedCluster.apiServerAccessProfile	API_SERVER_ACCESS_PROFILE
ManagedCluster.identity.principalId	MANAGED_IDENTITY_PRINCIPAL_ID
ManagedCluster.identity.userAssignedIdentities (map keys)	USER_ASSIGNED_IDENTITY_IDS
ManagedCluster.identityProfile.kubeletidentity	IDENTITY_PROFILE
String	networkPlugin
String	networkPolicy
String	podCidr
String	serviceCidr
String	loadBalancerSku
String	privateDnsZone
String	name
String	vnetSubnetId
String	vmSize
String	osType
String	mode
String	orchestratorVersion
String	kubeletIdentityResourceId
String	kubeletIdentityClientId
String	kubeletIdentityObjectId
Subscription being synced	SUBSCRIPTION_ID
Type	Field
Type	Field
Type	Field
Type	Field

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Managed Cluster

Operation options

Option	Type	Default	Description
parallelismLevel	Integer	8	Parallelism used when iterating subscriptions and clusters

Delta sync

Not supported. The connector performs a full sync of Managed Cluster on every run and applies no incremental date filter.

API

• Type: REST — Azure Resource Manager, accessed through the Azure SDK for Java (AzureResourceManager). The connector does not call raw REST paths; the SDK issues the underlying https://management.azure.com requests. · Endpoint: azure.kubernetesClusters().list()

note

• A cluster has two distinct identities and they grant different things. MANAGED_IDENTITY_PRINCIPAL_ID is the cluster's own system-assigned identity — the one the control plane acts as. The kubelet identity, reported separately under IDENTITY_PROFILE, is what the nodes act as, typically to pull images. Blast-radius analysis must treat them as separate principals: joining either one to a role assignment answers a different question.
• A node pool that Azure returns with none of the mapped fields populated is omitted from AGENT_POOL_PROFILES rather than emitted as an empty object, so an empty entry never reads as "collected, and empty" when nothing was in fact collected.
• Only the resource-manager view of the cluster is synchronized. In-cluster Kubernetes objects — pods, services, secrets, RBAC bindings inside the cluster — are out of scope for this connector.

---

Changelog

Changelog

The Microsoft Azure Container Service connector has undergone the following changes:

Version	Description	Migration Steps
3.6.1	No changes in this release.	N/A
3.6.0	Overview The Azure Container Service connector integrates with Microsoft Azure to synchronize the Azure Kubernetes Service clusters in a subscription, together with the facts that decide how each cluster can be reached and what it can do. A cluster's API server access profile records whether the control plane is private and which source ranges are permitted to reach it, so a cluster whose API server is published to the internet with no address restriction is visible as such rather than inferred. Its node pools record whether nodes are given public IP addresses, and the subnet each pool runs in, so node-level exposure can be followed into the surrounding network topology collected by the Azure Network connector. Clusters run as two distinct identities and both are collected: the cluster's own control-plane managed identity, and the kubelet identity the worker nodes use. They confer different permissions, and separating them is what distinguishes the reach of a compromised control plane from the reach of a compromised container. Both are published as principal IDs that resolve against the role assignments collected by the Azure Identity connector, and any user-assigned identities attached to the cluster are published by resource ID. Like the other Azure connectors, it authenticates with a service principal and collects every subscription available to that principal unless a specific list is configured. The built-in Reader role at subscription scope already grants every read this connector performs — no additional permission grant is required. Category: Microsoft Azure Models	N/A