title: Azure AKS: Full access to new RBAC cluster with get-credentials without admin
body: <p>If I create a brand-new AKS RBAC cluster from the Azure portal, in a resource group where I have <em>Contributor</em> role, and then run <code>az aks get-credentials</code> <em>without admin flag</em>, I am able to create and delete pods and namespaces, read cluster-wide secrets, and so on, using kubectl. This is <em>without</em> first logging in with <code>--admin</code> and creating any RBAC roles and bindings.</p>
  
  <p>What is it that gives me these permissions? Based on <a href="https://github.com/Azure/AKS/issues/505#issuecomment-403170563" rel="nofollow noreferrer">discussions</a> I <a href="https://docs.microsoft.com/bs-latn-ba/azure/aks/control-kubeconfig-access" rel="nofollow noreferrer">found</a> <a href="https://medium.com/@weinong/azure-kubernetes-service-built-in-roles-8083b90e7ba" rel="nofollow noreferrer">online</a>, the non-admin version of <code>get-credentials</code> downloads kubeconfig settings for a <em>cluster user</em> role, which should allow me to login but not much else, out of the box.</p>