Azure DevOps Pipeline Fails with Device Login Prompt During Helm Deployment to AKS

Question

I'm trying to deploy a Helm application to an AKS cluster using an Azure DevOps pipeline. However, the pipeline fails with a device login prompt. Here's the relevant section of my pipeline YAML file:

pool:
  name: '*'  

variables:
  AKS_RESOURCE_GROUP: '*' 
  AKS_CLUSTER_NAME: '*' 
  KUBECONFIG: $(Build.SourcesDirectory)/kubeconfig
  HELM_RELEASE_NAME: '*'  
  HELM_CHART_PATH: '*'  
  HELM_NAMESPACE: '*' 

stages:
- stage: Deploy
  jobs:
  - job: DeployToAKS
    steps:
    - task: AzureCLI@2
      inputs:
        azureSubscription: '*'
        scriptType: 'bash'
        scriptLocation: 'inlineScript'
        inlineScript: |
          # Get AKS credentials and configure kubectl context
          az aks get-credentials --resource-group $(AKS_RESOURCE_GROUP) --name $(AKS_CLUSTER_NAME) --file $(KUBECONFIG)

          # Set KUBECONFIG environment variable
          export KUBECONFIG=$(KUBECONFIG)

          # Upgrade the existing Helm release or install if it doesn't exist
          helm upgrade --install $(HELM_RELEASE_NAME) $(HELM_CHART_PATH) --namespace $(HELM_NAMESPACE) --kubeconfig $(KUBECONFIG) --values $(HELM_CHART_PATH)/values.yaml

          # (Optional) Verify the deployment by checking the Helm release status
          helm status $(HELM_RELEASE_NAME) --namespace $(HELM_NAMESPACE) --kubeconfig $(KUBECONFIG)
      displayName: 'Deploy Helm Application to AKS'

However, when I run this pipeline, it fails with the following error:

[Error] The operation was canceled.
WARNING: Merged "my cluster name" as current context in /home/myazureuser/myagent/_work/8/s/kubeconfig
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code C5D7UEJAFF to authenticate.

I Verified that the service principal of the service connection has the necessary permissions to access the AKS cluster.

How can I modify my Azure DevOps pipeline or the service principal configuration to avoid the device login prompt and allow the pipeline to run non-interactively? Any help or suggestions would be greatly appreciated!

Answer 1

You can use Kubernetes@1 task with login command to authenticate to AKS.

Sample code yaml:

pool:
 name: wadepool

variables:
  ServiceConnection: ARMConn1
  AKSCluster: wadeAKS1
  ResourceGroup: YourResourceGroup
  HELM_RELEASE_NAME: 'clamav'  
  HELM_CHART_PATH: './charts/clamav/'
  HELM_NAMESPACE: 'nmsw-dev' 

steps:
- task: Kubernetes@1
  inputs:
    connectionType: 'Azure Resource Manager'
    azureSubscriptionEndpoint: '$(ServiceConnection)'
    azureResourceGroup: '$(ResourceGroup)'
    kubernetesCluster: '$(AKSCluster)'
    useClusterAdmin: true
    command: 'login'

- task: HelmInstaller@1
  inputs:
    helmVersionToInstall: 'latest'

- task: AzureCLI@2
  inputs:
    azureSubscription: $(ServiceConnection)
    scriptType: bash
    scriptLocation: inlineScript
    inlineScript: |
      echo "Setting up AKS credentials"
      az aks get-credentials --resource-group $(ResourceGroup) --name $(AKSCluster) --overwrite-existing
      kubectl config use-context $(AKSCluster)

      # Upgrade the existing Helm release or install if it doesn't exist
      helm upgrade --install $(HELM_RELEASE_NAME) $(HELM_CHART_PATH) --namespace $(HELM_NAMESPACE) --values $(HELM_CHART_PATH)/values.yaml

      # (Optional) Verify the deployment by checking the Helm release status
      helm status $(HELM_RELEASE_NAME) --namespace $(HELM_NAMESPACE)
  displayName: 'Set up AKS Credentials and Test Connection'

The pipeline works, i didn't specify $(KUBECONFIG) on my side: