azureazure-aksazure-service-principalgitopsfluxcd

How to configure FluxCD in AKS to use service principal to pull from AzureDevops repo?

During the setup of a AKS cluster (with terraform, but I don't think it's relevant in this context) I want to enable and configure the flux extension.

Flux should, of course, pull the yaml-files from some Azure DevOps Repo. In my case, I am trying to use a Service Principal to authenticate against Devops. I gave already the Reader rights (I tried also Contributor) on the Repo. I created a client secret and as the username I used the appliation (client) ID of the service principal.

enter image description here

enter image description here

In the flux configuration I tried to add this values as HTTPS User and HTTPS Key.

enter image description here

I tried also to add these credentials as secrets in Kubernetes and configured flux to use this secret, but unsuccessful.

kubectl create secret generic spsecret --namespace=fluxtest --from-literal=username=<CLIENT_ID> --from-literal=password=<SECRET>

enter image description here

This is the message I am getting.

enter image description here

Does anybody see what am I missing here? Did I misunderstood the whole concept? If you need more information, please ask.

Solution

  • It's unfortunately not possible to do it with a service principal. I realized it with a technical AD user (service account). Once a provision the AKS with Flux, I copy the public key created by flux and paste it into the SSH keys in Azure Devops.