Create a client certificate

Note: The legacy AzureClient method of authenticating to Azure requires you to manage secrets and upload them manually. We recommend that you use workload identity federation instead.

GKE on Azure authenticates to Azure with an AzureClient resource. When you create a client, Google generates a key pair. You upload the public key to Azure Active Directory (Azure AD). The GKE Multi-Cloud API uses the AzureClient to authenticate as the application's service principal.

You can use the same AzureClient to create multiple clusters in the same Google Cloud project. If you already have an AzureClient, skip to Create an SSH key pair .

To create an AzureClient, run the following commands:

1. Set environment variables with your Azure tenant and application IDs:

     export 
     
    SUBSCRIPTION_ID 
    = 
    $( 
   az  
   account  
   show  
   --query  
    "id" 
     
   --output  
   tsv ) 
    export 
     
    TENANT_ID 
    = 
    $( 
   az  
   account  
   list  
    \ 
     
   --query  
    "[?id==' 
    ${ 
    SUBSCRIPTION_ID 
    } 
    '].{tenantId:tenantId}" 
     
   --output  
   tsv ) 
    export 
     
    APPLICATION_ID 
    = 
    $( 
   az  
   ad  
   app  
   list  
   --all  
    \ 
     
   --query  
    "[?displayName==' APPLICATION_NAME 
   '].appId" 
     
   --output  
   tsv ) 
    
   

   Replace APPLICATION_NAME with the Azure AD application name that you used when completing the prerequisites .

2. Create the client:

    gcloud  
   container  
   azure  
   clients  
   create  
    CLIENT_NAME 
     
    \ 
     
   --location = 
    GOOGLE_CLOUD_LOCATION 
     
    \ 
     
   --tenant-id = 
    " 
    ${ 
    TENANT_ID 
    } 
    " 
     
    \ 
     
   --application-id = 
    " 
    ${ 
    APPLICATION_ID 
    } 
    " 
    
   

   Replace the following:

   • CLIENT_NAME : the name of your AzureClient
   • GOOGLE_CLOUD_LOCATION : the supported Google Cloud region that manages your cluster—for example, us-west1

3. Get the certificate from an AzureClient and save it to an environment variable:

      
    CERT 
    = 
    $( 
   gcloud  
   container  
   azure  
   clients  
   get-public-cert  
   --location = 
    GOOGLE_CLOUD_LOCATION 
     
    \ 
     
    CLIENT_NAME 
    ) 
    
   

   Replace the following:

   • GOOGLE_CLOUD_LOCATION
   • CLIENT_NAME

4. Upload the certificate to your application on Azure AD:

      
   az  
   ad  
   app  
   credential  
   reset  
   --id  
    " 
    ${ 
    APPLICATION_ID 
    } 
    " 
     
   --cert  
    " 
    ${ 
    CERT 
    } 
    " 
     
   --append 
   

5. After the certificate uploads and before you create a cluster, wait at least one minute for the certificate to be ready to use. If the command fails, you can try again.

What's next

• Create an SSH key pair