Azure Credentials

Store an Azure service principal in Ankra to provision and manage Azure Kubernetes Service (AKS). Currently in development - available for early access.

Azure support is in development. The Azure tile in the credentials dialog is not yet enabled for self-service - contact support if you want early access for your organisation.

Azure credentials store an Azure service principal used to provision and manage Azure Kubernetes Service (AKS). Azure is managed-Kubernetes only - Ankra does not provision plain Azure VMs.

Unlike other providers, an Azure credential is not validated when it is stored: the service principal is checked when Ankra first authenticates with it (an OAuth client-credentials exchange against login.microsoftonline.com), and its permissions are exercised when a cluster is created.

What Ankra Accesses

Ankra calls the Azure Resource Manager API with the service principal:

Resource	Operations	Why it’s used
Resource groups	create, read	Ensure the resource group for the cluster exists
AKS managed clusters	create, read, delete	AKS cluster lifecycle
Agent pools	create, read, update, delete	Scale and manage the cluster’s node pools
Cluster admin credential	read	Connect Ankra’s agent to the cluster (listClusterAdminCredential)
Cluster power state	start, stop	Stop and start the cluster from Ankra
Kubernetes versions, VM sizes	read	Available versions and node sizes in the wizard

Node pricing shown in Ankra comes from the public Azure Retail Prices API, which needs no credential.

Preparing an Azure Credential

1. Create a service principal

   Create a service principal with the Contributor role on the target subscription, for example with the Azure CLI:

   az ad sp create-for-rbac \
     --name ankra-aks \
     --role Contributor \
     --scopes /subscriptions/<subscription-id>
   

   Note the appId (client ID), password (client secret), and tenant (tenant ID).

   Contributor on the subscription covers everything in the table above. To scope tighter, the service principal needs at least the ability to create resource groups plus Azure Kubernetes Service Contributor and Azure Kubernetes Service Cluster Admin on the resource groups Ankra will use.

2. Share it with Ankra (early access)

   An Azure credential consists of four values: subscription ID, tenant ID, client ID, and client secret. During early access, contact support to have the credential set up for your organisation - the self-service dialog and ankra credentials CLI do not cover Azure yet.