Skip to main content

atmos azure aks token

Generate a short-lived AKS bearer token for kubectl authentication. This command is designed as a kubectl exec credential plugin and is automatically configured in kubeconfig files generated by atmos azure aks update-kubeconfig.

atmos azure aks token --help

Usage​

atmos azure aks token --cluster-name <name> --resource-group <resource_group> [flags]

Examples​

# Generate token for a cluster (typically called by kubectl automatically)
atmos azure aks token --cluster-name my-cluster --resource-group my-rg

# Generate token using a specific identity
atmos azure aks token --cluster-name my-cluster --resource-group my-rg --identity azure-dev

# Test token generation manually
atmos azure aks token --cluster-name dev-cluster --resource-group dev-rg | jq .

Arguments​

n/a
No positional arguments.

Flags​

--cluster-name (required)

The name of the AKS cluster to generate a token for.

--resource-group (required)

The Azure resource group containing the AKS cluster.

--subscription-id (optional)

Azure subscription ID, used for logging/diagnostics. Not required for token generation itself.

--identity (alias -i)

Identity name to authenticate with for token generation. If omitted, Atmos uses the default identity (single identity auto-selected) or the ATMOS_IDENTITY environment variable.

How It Works​

This command outputs an already-acquired AAD access token as a Kubernetes ExecCredential JSON object — no external tool (kubelogin, az) is required:

  1. Atmos authenticates the specified identity.
  2. Azure AD access tokens are scope-bound at issuance (unlike AWS SigV4 signing), so the identity's provider (device-code, OIDC, or Azure CLI) acquires an additional token scoped to the AKS-managed AAD server application at authentication time, alongside the identity's primary ARM token.
  3. This command reads that already-acquired, AKS-scoped token from the credential and returns it.

ExecCredential Output​

{
  "apiVersion": "client.authentication.k8s.io/v1beta1",
  "kind": "ExecCredential",
  "status": {
    "expirationTimestamp": "2026-01-15T12:15:00Z",
    "token": "eyJ0eXAiOiJKV1Qi..."
  }
}

Kubeconfig Integration​

When you run atmos azure aks update-kubeconfig, Atmos automatically generates a kubeconfig entry that uses this command as an exec credential plugin:

users:
  - name: atmos-aks-dev-cluster-dev-rg
    user:
      exec:
        apiVersion: client.authentication.k8s.io/v1beta1
        command: atmos
        args:
          - azure
          - aks
          - token
          - --cluster-name
          - dev-cluster
          - --resource-group
          - dev-rg
          - --identity=azure-dev

This means kubectl automatically calls atmos azure aks token whenever it needs a fresh token, providing seamless authentication without manual token management.

Notes​

  • This command is designed to be called by kubectl, not manually.
  • The command suppresses usage errors since kubectl invokes it automatically.
  • Only clusters using AKS-managed AAD (the modern default) are supported. Clusters that expect a non-default AAD server application log a warning during update-kubeconfig since the token may not be accepted.

See Also​