Create documentation for AKS that states RBAC is necessary

[DarqueWarrior]

I created a K8s cluster that did not have RBAC enabled and the dapr-sidecar-injector was in an infinite (CrashLoopBackOff) loop. The documentation states Dapr will work in any cluster. That is not accurate. Not sure if the answer is to simply update the docs to make it clear that RBAC is required or make Dapr work in any cluster.

[yaron2]

Moving to docs

[AaronCrawfis]

@yaron2 is the guidance to create documentation that states RBAC is a pre-requisite for an AKS cluster?

[AaronCrawfis]

@yaron2 why is RBAC a requirement? Seems like this is a bug unless RBAC is required

[thinkbigdatanalytics]

I have the same issues, my AKS cluster doesn't have RBAC enable and the sidecar injects fails with error:

Unable to get SA deployment-controller UID (serviceaccounts \"deployment-controller\" not found)" "Unable to get SA cronjob-controller UID (serviceaccounts \"cronjob-controller\" not found)" "Unable to get SA job-controller UID (serviceaccounts \"job-controller\" not found)" "Unable to get SA statefulset-controller UID (serviceaccounts \"statefulset-controller\" not found)",

Any recommendation to solve this issue ?

[yaron2]

RBAC is required for Dapr. The reason is due to a security issue with the Kubernetes API server not authorizing itself with the sidecar injector in a non-RBAC cluster, opening the door to malicious actors in the cluster potentially injecting Dapr sidecars.

[hhunter-ms]

This is specified in the Azure docs, will add as a pre-req to Dapr docs