microsoft/aspire · error

az aks get-credentials failed

Error message

az aks get-credentials failed (exit code {result.ExitCode}): {result.StandardError}

What it means

The pipeline runs `az aks get-credentials` (via BuildGetCredentialsArguments) to fetch raw kubeconfig content for the AKS cluster. A non-zero exit code means the az CLI could not retrieve or generate the credentials, so Aspire throws with the exit code and stderr. This is the credential-acquisition step used for cluster-scoped destroy (e.g. Helm release cleanup).

Solutions

1. Grant the current identity the 'Azure Kubernetes Service Cluster Admin Role' (or Cluster User) on the cluster/RG.
2. Re-run `az login` and confirm `az account show` targets the subscription from [520].
3. Manually run `az aks get-credentials -g <rg> -n <cluster>` with the printed arguments to see the underlying error.
4. Confirm the cluster still exists (`az aks show`); if deleted, clear deployment state instead of forcing destroy.

Example fix

// before
# identity lacks Cluster Admin
destroy fails: az aks get-credentials failed (exit code 1)

// after
az role assignment create \
  --assignee <principal-id> \
  --role "Azure Kubernetes Service Cluster Admin Role" \
  --scope /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ContainerService/managedClusters/<cluster>

var show = Process.Start("az", $"aks show -g {rg} -n {cluster} -o none");
show.WaitForExit();
// non-zero => missing cluster or missing permission; resolve before credential fetch

try { await DestroyAsync(); }
catch (InvalidOperationException ex) when (ex.Message.Contains("az aks get-credentials failed"))
{
    // check RBAC role assignment / re-authenticate / verify cluster exists
}

When it happens

Trigger: kubeConfigContent property queried when `az aks get-credentials` fails: caller lacks Azure Kubernetes Service Cluster Admin/User role, the cluster or RG no longer exists, subscription mismatch, or az CLI/extension problems (e.g. kubernetes extension failures).

Common situations: RBAC removed the account's Cluster Admin role after provisioning; cluster deleted between state save and destroy; expired az credentials; concurrent runs conflicting on ~/.kube/config writes (the CLI writes kubeconfig even with -f output target when fetching).

Related errors

• az resource list failed
• az resource list failed while checking AKS cluster existence
• Cannot apply AGC ApplicationLoadBalancer CR for
• ADC request ' ' failed with HTTP ( ).
• Azure destroy step for environment

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/ceef1c0df5669a86. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.Kubernetes/AzureKubernetesEnvironmentResource.AksPipeline.cs:960

    /// </summary>
    /// <remarks>
    /// <paramref name="runAzCommandAsync"/> is injected so tests can verify that the credential
    /// fetch is scoped to the deployment subscription without invoking the real az CLI.
    /// </remarks>
    internal static async Task<string> FetchKubeConfigAsync(
        string azPath,
        string subscriptionId,
        string resourceGroup,
        string clusterName,
        Func<string, string, Task<AzCommandResult>> runAzCommandAsync)
    {
        var result = await runAzCommandAsync(
            azPath,
            BuildGetCredentialsArguments(subscriptionId, resourceGroup, clusterName)).ConfigureAwait(false);

        if (result.ExitCode != 0)
        {
            throw new InvalidOperationException(
                $"az aks get-credentials failed (exit code {result.ExitCode}): {result.StandardError}");
        }

        return result.StandardOutput;
    }

    internal static async Task<bool> AksResourceExistsAsync(
        string azPath,
        string subscriptionId,
        string resourceGroup,
        string clusterName,
        Func<string, string, Task<AzCommandResult>> runAzCommandAsync)
    {
        var result = await runAzCommandAsync(
            azPath,
            BuildAksResourceExistsArguments(subscriptionId, resourceGroup, clusterName)).ConfigureAwait(false);

        if (result.ExitCode != 0)

View on GitHub (pinned to 25830f84bd)