<p>I've acquired one of the <a href="https://learn.microsoft.com/en-us/azure/architecture/example-scenario/apps/devops-with-aks" rel="nofollow noreferrer">Microsoft templates for CI/CD</a> using: <strong>Jenkins, Docker (ACS), Kubernetes (AKS)</strong>. This template comes with a pipeline example, but when trying to start it I present the following error trying to do the integration with Azure Kubernetes (AKS):</p>

<pre><code>Starting Azure Container Service / Kubernetes Service Deployment
Delete Kubernetes management config file 
/var/lib/jenkins/workspace/hello-world/kubeconfig-7112538207763465492
ERROR: ERROR: Status code 403, {"error": 
{"code":"AuthorizationFailed","message":"The client '7912b768-a178-4996- 
b6e6-38912a9b90da' with object id '7912b768-a178-4996-b6e6-38912a9b90da' 
does not have authorization to perform action 
'Microsoft.ContainerService/managedClusters/accessProfiles
/listCredential/action' over scope '/subscriptions/4e601d44-4d18-4e49- 
95001793e668f9e0/resourcegroups/SystemBackend_Resource/
providers/Microsoft.ContainerService/managedClusters/aksa5ru5sgbdaum2/
accessProfiles/clusterAdmin'."}}
</code></pre>

<p>Any idea?</p>

Marluan Espiritusanto Guerrero
<p>the error says it all, the client (credentials) you are using to access the AKS cluster does not have permissions to use the listCredentials action over that cluster. You need to grant that client those permissions. Easiest way grant contributor rights to <code>7912b768-a178-4996-b6e6-38912a9b90da</code> to the <code>SystemBackend_Resource</code> resource group.</p>

<pre><code>New-AzureRmRoleAssignment -ObjectId 7912b768-a178-4996-b6e6-38912a9b90da `
  -RoleDefinitionName "Contributor" `
  -Scope '/subscriptions/4e601d44-4d18-4e49-95001793e668f9e0/resourcegroups/SystemBackend_Resource/'
</code></pre>

<p>you can obviously grant only that permission to that entity using custom roles, but this is just an example</p>
