<p>I have a azure function app in powershell, dedicated to kubernetes functions.</p>
<p>There are multiple functions but on each of them, the first thing we do is something like this.</p>
<pre><code> az login --service-principal -u $usr -p $pwd --tenant $tenant
 
 $config = $HOME + &quot;/.kube/$tenant&quot;;
 
 az account set --subscription $subscription
 az aks get-credentials --overwrite-existing --name $cluster --resource-group $rg --admin --file $config
 kubectl config set-context --current --namespace=$tenant
</code></pre>
<p>This sets the contexts we will be working with on our next kubectl commands.</p>
<p>We do it, because we have multiple clusters on multiple regions, so everytime we get a call on the function app, we need to connect to the given cluster to work on it.</p>
<p>The problem with this is when we get 2 requests at exactly the same time for 2 different clusters and the earliest call will get its context overriden and be executing kubectl commands on the incorrect cluster.
Is there a way to isolate each call or a solution to this?</p>

<p>You should be able to just use kubectl's global <code>--context</code> parameter (and <code>--kubeconfig</code> if needed), example:</p>
<pre class="lang-bash prettyprint-override"><code>az aks get-credentials -n $cluster -g $rg
kubectl get pod -n $tenant --context $cluster
</code></pre>
<p>In case you have two different clusters that are named the same, you can use <code>az aks get-credentials</code> own <code>--context</code> command param, and just pick a discriminator for your concurrent script executions:</p>
<pre class="lang-bash prettyprint-override"><code>$id = &quot;$(new-guid)&quot;
$contextName = &quot;$cluster-$id&quot;
az aks get-credentials -n $cluster -g $rg --context $contextName
kubectl get pod -n $tenant --context $contextName
</code></pre>
<p>Note that adding <code>--admin</code> command param when fetching credentials will also append <code>-admin</code> to the names in the kubeconfig; thus forcing you to add &quot;-admin&quot; to the <code>$contextName</code>:</p>
<pre class="lang-bash prettyprint-override"><code>$contextName = &quot;$cluster-$id-admin&quot;
</code></pre>
<p>There is a limitation to this, in that <code>az aks get-credentials</code> doesn't allow us to override the parameter <code>name</code> for the generated <code>user</code> object (at least not to my knowledge, <a href="https://learn.microsoft.com/en-us/cli/azure/aks?view=azure-cli-latest#az-aks-get-credentials" rel="nofollow noreferrer">nor is it mentioned in the docs</a>). Its format is &quot;static&quot; and will always be <code>clusterUser_{resourceGroupName}_{clusterName}</code> or <code>clusterAdmin_{resourceGroupName}_{clusterName}</code> if using <code>--admin</code>.</p>
<p>This is really only a concern if you have 2 different clusters that have the exact same name and resource group name (I'd question why this would ever be the case, but alas).</p>
<p>You'd most likely see 2 different outcomes here:</p>
<ul>
<li>&quot;An object of same name already exist&quot;-ish error, or</li>
<li>The 2nd invocation of <code>az aks get-credentials</code> will override the existing object with the new values <em>if</em> you use <code>--overwrite-existing</code> command param, causing all API calls to the 1st invocation's cluster to fail with either 401 or 403 related errors (is my guess at least)</li>
</ul>
<p>To counter this you can write to a specific kubeconfig file, again unique to the script's current context/execution, and then use kubectl's global <code>--kubeconfig</code> command param:</p>
<pre class="lang-bash prettyprint-override"><code>$id = &quot;$(new-guid)&quot;
$contextName = $kubeconfig = &quot;$cluster-$id&quot;
az aks get-credentials -n $cluster -g $rg --context $contextName --file $kubeconfig
kubectl get pod -n $tenant --context $contextName --kubeconfig $kubeconfig
</code></pre>
<p>Remember to add &quot;-admin&quot; to your <code>$contextName</code>, if you use <code>--admin</code> (and separate the <code>$contextName</code> and <code>$kubeconfig</code> assignments, obviously).</p>
