How can I pass a client secret of a service principal when executing the az aks create --client-secret command in bash script

Question

I'm experimenting with AKS and Azure CLI. So my first idea was use Azure CLI commands to setup an AKS cluster, what went pretty well. The next step is to bundle all those different commands into a single bash script. By using variables int the script I was hoping to make my life easier and at the beginning it did. This was until I reached the az aks create command, where I'm trying to pass the --client-secret $AKS_SP_SECRET and the --service-principal $AKS_SP_APP_ID. Those 2 variables are set by 2 previous Azure CLI commands (see script)

This always results in an error telling me that an "Invalid client secret is provided". I have already checked the value of the variables by doing an echo of the $AKS_SP_SECRET variable, who contained a password value.

This is the script that I'm trying to run at the moment and that always results in an error telling me that the provided client secret is invalid.

#!/bin/bash

LOCATION="westeurope"
RESOURCEGROUP_NAME="MyResourcegroup"
AKS_NAME="MyCluster"
AKS_SP_NAME='AksServicePrincipal'

# Create a service principal
az ad sp create-for-rbac \
    --name http://$AKS_SP_NAME \
    --skip-assignment

# Retrieve Service principal APPID and Client Secret
AKS_SP_APP_ID=$(az ad app list --display-name $AKS_SP_NAME --query "[].appId" -o tsv)
AKS_SP_SECRET=$(az ad sp credential reset --name http://$AKS_SP_NAME --query "password" -o tsv)

# Create Azure Kubernetes Cluster
az aks create --resource-group $RESOURCEGROUP_NAME \
    --name $AKS_NAME \    
    --client-secret $AKS_SP_SECRET \
    --service-principal $AKS_SP_APP_ID \
    --generate-ssh-keys \
    --location $LOCATION \
    --kubernetes-version 1.13.11 \

If I split the above script in 2 different scripts and I set the value of the AKS_SP_SECRET variable in the second script like this AKS_SP_PASSWORD=99173ccb-5f2a-4eab-b367-3257fd9627ac then I don't get an error and everything works as expected.

Does anyone see what I'm doing wrong? And is it possible to pass the secret through a variable in a bash script?

Kind regards.

Hi @Charles, I tried it but I still get an error saying that the Service Principal was not found in Active Directory tenant. But if I check the portal the principal exists and clientId and TenantID are correct. — Chouffie, Nov 09 '19 at 09:50
Do you try the script in my answer? I got the same error in the test, but solve it without using the `--query` in it. — Charles Xu, Nov 11 '19 at 02:34
Which step do you stay in? I did not see any update for the question, do you still want to solve the problem? — Charles Xu, Nov 13 '19 at 02:46

score 1 · Answer 1 · answered Nov 04 '19 at 08:23

According to the experience I have, the most commands are right, but some of them you'd better make some changes, so finally, the script will like below:

#!/bin/bash

LOCATION="westeurope"
RESOURCEGROUP_NAME="MyResourcegroup"
AKS_NAME="MyCluster"
AKS_SP_NAME='AksServicePrincipal'

# Create a service principal
AKS_SP_APP_ID=$(az ad sp create-for-rbac --name $AKS_SP_NAME --skip-assignment --query appId)

# Retrieve Service principal APPID and Client Secret
AKS_SP_SECRET=$(az ad sp credential reset --name $AKS_SP_NAME --query "password")

# Create Azure Kubernetes Cluster
az aks create --resource-group $RESOURCEGROUP_NAME \
    --name $AKS_NAME \
    --client-secret $AKS_SP_SECRET \
    --service-principal $AKS_SP_APP_ID \
    --generate-ssh-keys \
    --location $LOCATION \
    --kubernetes-version 1.13.11

How can I pass a client secret of a service principal when executing the az aks create --client-secret command in bash script

1 Answers1