title: Interact With Azure AKS Cluster Master Node REST API
body: <p>My requirement here is very simple, I provisioned an AKS cluster and I would like to deploy services to this cluster dynamically through the master NODE's REST API uses a bearer token generated with a service principles credentials.</p>
  
  <p>I cannot seem to find any example of this. All the tutorials end at the kubectl level which is useless for what I need.</p>
  
  <p>This in theory should be doable, any help is welcomed.</p>
  
  <p>NOTE: The application I would like to provision from is running python and also is running outside of the cluster.</p>
  
  <p>Service Principal:</p>
  
  <pre><code>{
    "appId": "0c6f1e71-b6fe-4187-8de6-3f84a419c0db",
    "displayName": "deployer",
    "name": "http://deployer",
    "password": "xxxxxxxx-xxx-xxxx-xxxx-xxxxxxxxxxxx",
    "tenant": "xxxxxxxx-xxx-xxxx-xxxx-xxxxxxxxxxxx"
  }
  </code></pre>
  
  <p>Service Account:</p>
  
  <pre><code>kind: Role
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: alice-cluster-admin
    namespace: default
  rules:
  - apiGroups: [""]
    resources: ["*"]
    verbs: ["*"]
  ---
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: alice-cluster-admin
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: cluster-admin
  subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: 2210df5a-94d5-489f-9c6f-0d9d71bef61a
  </code></pre>
  
  <p>Python Request For Token:</p>
  
  <pre><code>import requests 
  
  print( 
  requests.get( 
   url="https://login.microsoftonline.com/sometenantname.onmicrosoft.com/oauth2/token", 
  data={ 
  'grant_type':'client_credentials', 
  'client_id':'2210df5a-94d5-489f-9c6f-0d9d71bef61a', 
  'client_secret':'xxxxxxxx-xxx-xxxx-xxxx-xxxxxxxxxxxx', 
  'resource':'https://graph.microsoft.com' 
  } 
  ).content 
  )  
  </code></pre>
  
  <p>The returned token produces a 401 error on the Kube API when requests are made </p>
  
  <pre><code>{
      "kind": "Status",
      "apiVersion": "v1",
      "metadata": {},
      "status": "Failure",
      "message": "Unauthorized",
      "reason": "Unauthorized",
      "code": 401
  }
  </code></pre>