Quick tip: How to get your Kubernetes cluster service principal and use it to access other Azure services?
Tags: kubernetes, azure, productivity, showdev
Published: 2019-09-11 16:03:36

So, you have a [Kubernetes cluster on Azure (AKS)](https://docs.microsoft.com/azure/aks/?WT.mc_id=devto-blog-abhishgu) which needs to access other Azure services like [Azure Container Registry (ACR)](https://azure.microsoft.com/services/container-registry/?WT.mc_id=devto-blog-abhishgu)? You can use your AKS cluster service principal for this. 

All you need to do is delegate access to the required Azure resources to the service principal. Simply create a role assignment using [`az role assignment create`](https://docs.microsoft.com/cli/azure/role/assignment?view=azure-cli-latest&WT.mc_id=devto-blog-abhishgu) to do the following: 

- specify the particular scope, such as a resource group 
- then assign a role that defines what permissions the service principal has on the resource

It looks something like this:

    az role assignment create --assignee $AKS_SERVICE_PRINCIPAL_APPID --scope $ACR_RESOURCE_ID --role $SERVICE_ROLE

> Notice that the `--assignee` here is nothing but the service principal and you're going to need it.


When you [create an AKS cluster in the Azure portal](https://docs.microsoft.com/azure/aks/kubernetes-walkthrough-portal?view=azure-cli-latest&WT.mc_id=devto-blog-abhishgu) or using the [`az aks create`](https://docs.microsoft.com/cli/azure/aks?view=azure-cli-latest&WT.mc_id=devto-blog-abhishgu#az-aks-create) command from [the Azure CLI](https://docs.microsoft.com/cli/azure/install-azure-cli?view=azure-cli-latest&WT.mc_id=devto-blog-abhishgu), Azure can automatically generate a service principal. Alternatively, you can create one your self using [`az ad sp create-for-rbac --skip-assignment`](https://docs.microsoft.com/cli/azure/ad/sp?view=azure-cli-latest&WT.mc_id=devto-blog-abhishgu#az-ad-sp-create-for-rbac) and then use the service principal `appId` in `--service-principal` and `--client-secret` (password) parameters in the `az aks create` command.

You can use a handy little query in the [`az aks show`](https://docs.microsoft.com/cli/azure/aks?view=azure-cli-latest&WT.mc_id=devto-blog-abhishgu#az-aks-show) command to locate the service principal quickly!


    az aks show --name $AKS_CLUSTER_NAME --resource-group $AKS_CLUSTER_RESOURCE_GROUP --query servicePrincipalProfile.clientId -o tsv

This will the service principal `appId`! You can use it to grant permissions. For e.g. if you want to allow AKS to work with ACR, you can grant the `acrpull` role:

    az role assignment create --assignee $AKS_SERVICE_PRINCIPAL_APPID --scope $ACR_RESOURCE_ID --role acrpull

### Here is the list of commands for your reference:

- [`az aks create`](https://docs.microsoft.com/cli/azure/aks?view=azure-cli-latest&WT.mc_id=devto-blog-abhishgu#az-aks-create) to create an AKS cluster
- [`az role assignment create`](https://docs.microsoft.com/cli/azure/role/assignment?view=azure-cli-latest&WT.mc_id=devto-blog-abhishgu) to assign service specific roles to a service principal
- [`az aks show`](https://docs.microsoft.com/cli/azure/aks?view=azure-cli-latest&WT.mc_id=devto-blog-abhishgu#az-aks-show) to get info about your AKS cluster

If you found this article helpful, please like and follow! Happy to get feedback via [@abhi_tweeter](https://twitter.com/abhi_tweeter) or just drop a comment :-)