0

I need to grant a process (build pipeline) RBAC access to AKS API for deployment purposes. But the target AKS cluster has AAD integration active (as described here)

I was expecting to be able to access the AKS API's with a simple Service Principal, but I'm redirected to a devicelogin page:

$ az login --service-principal  --username [REDACTED]-XXXX-XXXX-XXXX-XXXXXXXXXXXX --password [REDACTED]XXxxXXxxXXxxxXXXxxXXxxXXxx= --tenant [REDACTED]-XXXX-XXXX-XXXX-XXXXXXXXXXXX

$ az aks get-credentials -n oli-aksdemo01 -g oli-aksdemo01
Merged "oli-aksdemo01" as current context in /home/olivier/.kube/config

$ kubectl get nodes
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code C2NP77EGR to authenticate.

:-(

Is there a way to avoid the devicelogin page when authenticating a Service Principal on an AAD-integrated AKS cluster on Azure ?

1

TL;DR : It is not possible, yet.
I asked the very same question to Azure support and here is their answer:

When the AKS cluster integrated with AAD it will require redirecting to the device login page when authenticating to access to the cluster.

Access cluster with Azure AD - https://docs.microsoft.com/en-us/azure/aks/aad-integration#access-cluster-with-azure-ad

Unfortunately this is currently by design and there is no other way to avoid this process at the moment but we would love to hear your voice.

Would you please provide your feedback through the links below so we may plan in the future.

https://feedback.azure.com/forums/914020-azure-kubernetes-service-aks

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.