<p>I am using <code>kubectl</code> to control Kubernetes Service on Azure (scaling, getting pod status). Is it safe to call kubectl automatically in a script on production and not worry that the credentials will expire?</p>

<p>This is what I did once on the production server (required manual login via web page) (os is Windows Server 2016):</p>

<pre><code>az login
az account set --subscription="S"
az aks get-credentials --resource-group R --name C
</code></pre>

<p>This is what is being run in a script/application:</p>

<pre><code>kubectl get pods
</code></pre>

<p>Can I be sure the last call will just work from now on (and will not require manual login on a sunday night)?</p>

<p>To control the Azure Kubernetes service, you need permission to perform the actions. So the core of safety is permission. You can use the service principal with the right permission you need without interaction. So the <code>az login</code> could be changed into this:</p>

<pre><code>az login --service-principal -u service_principal_app_id -p service_principal_secret
</code></pre>

<p>To get the credentials to access the cluster, there two permission:</p>

<p><strong>Azure Kubernetes Service Cluster Admin Role</strong> or <strong>Azure Kubernetes Service Cluster User Role</strong></p>

<p>You can get more details <a href="https://learn.microsoft.com/en-us/azure/aks/control-kubeconfig-access#available-cluster-roles-permissions" rel="nofollow noreferrer">here</a> and decide which to use. You can set the expiry date for the service principal, take a look at another <a href="https://stackoverflow.com/questions/53748591/aks-created-service-principal-password-expiry">issue</a>.</p>
