Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Criar um certificado de cliente
O GKE no Azure autentica-se no Azure com um recurso AzureClient . Quando você cria um cliente, o Google gera um par de chaves. Você carrega a chave pública no Azure Active Directory (Azure AD). A API Multi-Cloud do GKE usa o AzureClient para autenticar como a entidade de serviço do aplicativo.
Você pode usar o mesmo AzureClient para criar vários clusters no mesmo projeto do Google Cloud. Se você já possui um AzureClient, pule para Criar um par de chaves SSH .
Para criar um AzureClient, execute os seguintes comandos:
Defina variáveis de ambiente com seus IDs de locatário e aplicativo do Azure:
Após o upload do certificado e antes de criar um cluster, aguarde pelo menos um minuto para que o certificado esteja pronto para uso. Se o comando falhar, você pode tentar novamente.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-06-12 UTC."],[],[],null,["# Create a client certificate\n===========================\n\n\u003cbr /\u003e\n\n| **Note:** The legacy *AzureClient* method of\n| authenticating to Azure requires you to manage secrets and upload them\n| manually. We recommend that you use [workload identity federation](/kubernetes-engine/multi-cloud/docs/azure/how-to/create-azure-ad-application#workload-identity-federation)\n| instead.\n\n\u003cbr /\u003e\n\nGKE on Azure authenticates to Azure with an *AzureClient*\nresource. When you create a client, Google generates a key pair. You upload the\npublic key to Azure Active Directory (Azure AD). The GKE Multi-Cloud API uses the\nAzureClient to authenticate as the application's service principal.\n\nYou can use the same AzureClient to create multiple clusters in the same\nGoogle Cloud project. If you already have an AzureClient, skip to\n[Create an SSH key pair](/kubernetes-engine/multi-cloud/docs/azure/how-to/create-ssh-keypair).\n\nTo create an AzureClient, run the following commands:\n\n1. Set environment variables with your Azure tenant and application IDs:\n\n export SUBSCRIPTION_ID=$(az account show --query \"id\" --output tsv)\n export TENANT_ID=$(az account list \\\n --query \"[?id=='${SUBSCRIPTION_ID}'].{tenantId:tenantId}\" --output tsv)\n export APPLICATION_ID=$(az ad app list --all \\\n --query \"[?displayName=='\u003cvar translate=\"no\"\u003eAPPLICATION_NAME\u003c/var\u003e'].appId\" --output tsv)\n\n Replace \u003cvar translate=\"no\"\u003eAPPLICATION_NAME\u003c/var\u003e with the Azure AD\n application name that you used when completing the\n [prerequisites](/kubernetes-engine/multi-cloud/docs/azure/how-to/create-azure-ad-application).\n2. Create the client:\n\n gcloud container azure clients create \u003cvar translate=\"no\"\u003eCLIENT_NAME\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e \\\n --tenant-id=\"${TENANT_ID}\" \\\n --application-id=\"${APPLICATION_ID}\"\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCLIENT_NAME\u003c/var\u003e: the name of your AzureClient\n - \u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e: the [supported Google Cloud region](/kubernetes-engine/multi-cloud/docs/azure/reference/supported-regions) that manages your cluster---for example, `us-west1`\n3. Get the certificate from an AzureClient and save it to an environment\n variable:\n\n CERT=$(gcloud container azure clients get-public-cert --location=\u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e \\\n \u003cvar translate=\"no\"\u003eCLIENT_NAME\u003c/var\u003e)\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e\n - \u003cvar translate=\"no\"\u003eCLIENT_NAME\u003c/var\u003e\n4. Upload the certificate to your application on Azure AD:\n\n az ad app credential reset --id \"${APPLICATION_ID}\" --cert \"${CERT}\" --append\n\n5. After the certificate uploads and before you create a cluster, wait at least\n one minute for the certificate to be ready to use. If the command fails, you\n can try again.\n\n | **Note:** If the preceding command fails with the\n | following message, save the certificate to a file and upload it to your\n | application's page on the Azure portal: \n |\n | ```\n | Update to existing credential with KeyId 'XXXXXXX-XXXXX-XXX-XXXX-XXXXXXXXXXXX' is not allowed.\n | ```\n |\n |\n | To get a link to your application's page, replace\n | \u003cvar translate=\"no\"\u003eAPPLICATION_ID\u003c/var\u003e in the following URL with your application's ID: \n |\n | ```\n | https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/Credentials/appId/APPLICATION_ID\n | ```\n\nWhat's next\n-----------\n\n- [Create an SSH key pair](/kubernetes-engine/multi-cloud/docs/azure/how-to/create-ssh-keypair)"]]
