How to create AKS cluster in customer's account using oauth client credentials flow

Question

We want to create AKS cluster in our customer's account via API using token obtained via client credentials oauth flow.

E.g. client.com has Azure account.

ourcompany.com wants to create AKS cluster in client.com's Azure account using API without human interaction.

How would the oauth setup look like in this case?

Thanks,

Meersa

Answer 1

Hi @Meersa,
You can try the following:

1. Get the token of your customer:

TOKEN=$(az account get-access-token --query 'accessToken' -o tsv)

2. Set the configurations of the AKS cluster, you can refer to this link for more details:

cat << EOF > body.json
{
	"location": "eastus",
	 "identity": {
    "type": "SystemAssigned"
 },
	"properties": {
	   "kubernetesVersion": "",
       "dnsPrefix": "dnsprefix1",
	    "agentPoolProfiles": [
      {
        "name": "nodepool1",
        "count": 1,
        "vmSize": "Standard_DS2_v2",
        "osType": "Linux",
        "type": "VirtualMachineScaleSets",
        "mode": "System"
      }
	 ],
	
    "servicePrincipalProfile": {
      "clientId": "msi"
     }
	}
}
EOF

3. Create the AKS cluster using curl command with the generated token:
   curl -d @body.json -H "Content-Type: application/json" -H "Authorization: Bearer ${TOKEN}" -X PUT 'https://management.azure.com/subscriptions/<subID>/resourceGroups/<ResourceGroupName>/providers/Microsoft.ContainerService/managedClusters/<AKSClusterName>?api-version=2023-05-01'

Note: Make sure to create the resource group.

Hope this helps, and please "Accept as Answer" if it helped, so that it can help others in the community looking for help on similar topics.