Service Connection guidance for AKS customers using Kubernetes tasks
Apr 13, 2023Eric van Wijk

Summary
This post introduces and details the use of Azure Resource Manager (ARM) Service Connections for Azure DevOps Kubernetes tasks (AzureFunctionOnKubernetes, KubernetesManifest, HelmDeploy, Kubernetes) when targeting Azure Kubernetes Service (AKS). It explains the limitations of the Kubernetes Service Connection type for private clusters or clusters with local accounts disabled, particularly due to Kubernetes' move away from long-lived tokens. The ARM Service Connection approach defers connectivity to pipeline runtime, allowing for short-lived tokens and better integration with private clusters and Azure AD RBAC via `kubelogin`.
More from the Azure DevOps Workload Identity Federation with Terraform trail
- Retirement of Azure DevOps issuer in Workload identity federation service connections
- Introducing Azure DevOps ID Token Refresh and Terraform Task Version 5
- Workload identity federation for Azure deployments is now generally available
- Managed identity and service principal support for Azure DevOps now in General Availability (GA)
- Introduction to Azure DevOps Workload identity federation (OIDC) with Terraform