Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Buat sertifikat klien
GKE on Azure melakukan autentikasi ke Azure dengan resource AzureClient. Saat Anda membuat klien, Google akan membuat pasangan kunci. Anda mengupload
kunci publik ke Azure Active Directory (Azure AD). GKE Multi-Cloud API menggunakan
AzureClient untuk mengautentikasi sebagai akun utama layanan aplikasi.
Anda dapat menggunakan AzureClient yang sama untuk membuat beberapa cluster dalam project Google Cloud yang sama. Jika Anda sudah memiliki AzureClient, lanjutkan ke
Membuat pasangan kunci SSH.
Untuk membuat AzureClient, jalankan perintah berikut:
Tetapkan variabel lingkungan dengan ID aplikasi dan tenant Azure Anda:
Setelah sertifikat diupload dan sebelum Anda membuat cluster, tunggu setidaknya
satu menit agar sertifikat siap digunakan. Jika perintah gagal, Anda dapat mencobanya lagi.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-07-31 UTC."],[],[],null,["# Create a client certificate\n===========================\n\n\u003cbr /\u003e\n\n| **Note:** The legacy *AzureClient* method of\n| authenticating to Azure requires you to manage secrets and upload them\n| manually. We recommend that you use [workload identity federation](/kubernetes-engine/multi-cloud/docs/azure/how-to/create-azure-ad-application#workload-identity-federation)\n| instead.\n\n\u003cbr /\u003e\n\nGKE on Azure authenticates to Azure with an *AzureClient*\nresource. When you create a client, Google generates a key pair. You upload the\npublic key to Azure Active Directory (Azure AD). The GKE Multi-Cloud API uses the\nAzureClient to authenticate as the application's service principal.\n\nYou can use the same AzureClient to create multiple clusters in the same\nGoogle Cloud project. If you already have an AzureClient, skip to\n[Create an SSH key pair](/kubernetes-engine/multi-cloud/docs/azure/how-to/create-ssh-keypair).\n\nTo create an AzureClient, run the following commands:\n\n1. Set environment variables with your Azure tenant and application IDs:\n\n export SUBSCRIPTION_ID=$(az account show --query \"id\" --output tsv)\n export TENANT_ID=$(az account list \\\n --query \"[?id=='${SUBSCRIPTION_ID}'].{tenantId:tenantId}\" --output tsv)\n export APPLICATION_ID=$(az ad app list --all \\\n --query \"[?displayName=='\u003cvar translate=\"no\"\u003eAPPLICATION_NAME\u003c/var\u003e'].appId\" --output tsv)\n\n Replace \u003cvar translate=\"no\"\u003eAPPLICATION_NAME\u003c/var\u003e with the Azure AD\n application name that you used when completing the\n [prerequisites](/kubernetes-engine/multi-cloud/docs/azure/how-to/create-azure-ad-application).\n2. Create the client:\n\n gcloud container azure clients create \u003cvar translate=\"no\"\u003eCLIENT_NAME\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e \\\n --tenant-id=\"${TENANT_ID}\" \\\n --application-id=\"${APPLICATION_ID}\"\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCLIENT_NAME\u003c/var\u003e: the name of your AzureClient\n - \u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e: the [supported Google Cloud region](/kubernetes-engine/multi-cloud/docs/azure/reference/supported-regions) that manages your cluster---for example, `us-west1`\n3. Get the certificate from an AzureClient and save it to an environment\n variable:\n\n CERT=$(gcloud container azure clients get-public-cert --location=\u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e \\\n \u003cvar translate=\"no\"\u003eCLIENT_NAME\u003c/var\u003e)\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e\n - \u003cvar translate=\"no\"\u003eCLIENT_NAME\u003c/var\u003e\n4. Upload the certificate to your application on Azure AD:\n\n az ad app credential reset --id \"${APPLICATION_ID}\" --cert \"${CERT}\" --append\n\n5. After the certificate uploads and before you create a cluster, wait at least\n one minute for the certificate to be ready to use. If the command fails, you\n can try again.\n\n | **Note:** If the preceding command fails with the\n | following message, save the certificate to a file and upload it to your\n | application's page on the Azure portal: \n |\n | ```\n | Update to existing credential with KeyId 'XXXXXXX-XXXXX-XXX-XXXX-XXXXXXXXXXXX' is not allowed.\n | ```\n |\n |\n | To get a link to your application's page, replace\n | \u003cvar translate=\"no\"\u003eAPPLICATION_ID\u003c/var\u003e in the following URL with your application's ID: \n |\n | ```\n | https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/Credentials/appId/APPLICATION_ID\n | ```\n\nWhat's next\n-----------\n\n- [Create an SSH key pair](/kubernetes-engine/multi-cloud/docs/azure/how-to/create-ssh-keypair)"]]
