Azure AKS AAD auth

main.go

package main

import (
	"context"
	"fmt"

	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v2"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/client-go/kubernetes"
	"k8s.io/client-go/tools/clientcmd"
	k8s_api "k8s.io/client-go/tools/clientcmd/api"
)

func main() {
	// get azure client
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		panic(err)
	}

	// get container service client
	containerserviceClientFactory, err := armcontainerservice.NewClientFactory(
		"<subscription-id>", cred, nil)
	if err != nil {
		panic(err)
	}
	client := containerserviceClientFactory.NewManagedClustersClient()

	// get cluster kubeconfigs
	ctx := context.Background()
	res, err := client.ListClusterUserCredentials(ctx, "<resource-group", "<cluster>",
		&armcontainerservice.ManagedClustersClientListClusterUserCredentialsOptions{},
	)
	if err != nil {
		panic(err)
	}

	// get a bearer token
	token, err := cred.GetToken(ctx, policy.TokenRequestOptions{
		Scopes: []string{"6dae42f8-4368-4678-94ff-3960e28e3630"}})
	if err != nil {
		panic(err)
	}

	// replace exec plugin with token
	kubeconfig, err := clientcmd.Load(res.Kubeconfigs[0].Value)
	authInfo := k8s_api.NewAuthInfo()
	authInfo.Token = token.Token
	kubeconfig.AuthInfos[kubeconfig.Contexts[kubeconfig.CurrentContext].AuthInfo] = authInfo

	// get a k8s client
	buf, err := clientcmd.Write(*kubeconfig)
	restConfig, err := clientcmd.RESTConfigFromKubeConfig(buf)
	if err != nil {
		panic(err)
	}
	clientset, err := kubernetes.NewForConfig(restConfig)
	if err != nil {
		panic(err)
	}

	// list namespaces
	ns, err := clientset.CoreV1().Namespaces().List(ctx, metav1.ListOptions{})
	if err != nil {
		panic(err)
	}
	for _, n := range ns.Items {
		fmt.Printf("%s\n", n.Name)
	}
}