Will kubernetes service connections in azure devops work with an AKS cluster that is bound to AAD via openidconnect?

Unfortunately to say, no, this does not support until now.

According to your description, what you want to connect with in Azure Devops Kubernetes service connection is Azure Kubernetes service. This means you would select Azure Subscription in Choose authentication. BUT, this connection method is using Service Principal Authentication (SPA) to authenticate, which does not yet supported for the AKS that is bound with AAD auth.

If you connect your AKS cluster as part of your CI/CD deployment in Azure Devops, and attempt to get the cluster credentials. You would get a warning response which inform you to log in since the service principal cannot handle it:

WARNING: To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code *** to authenticate.

You should familiar with this message, it needs you open a browser to login in to complete the device code authentication manually. But this could not be achieve in Azure Devops.

There has a such feature request raised on our forum which request us expand this feature to Support non-interactive login for AAD-integrated clusters. You can vote and comment there to advance the priority of this suggestion ticket. Then it could be considered into the develop plan by our Product Manager as soon as possible.

Though it could not be achieved directly. But there has 2 work around can for you refer now.

• The first work around is change the Azure DevOps authenticate itself from AAD client to the server client.

Use az aks get-credentials command and specify the parameter --admin with it. This can help with bypassing the Azure AD auth since it can let you connect and retrieve the admin credentials which can work without Azure AD.

But, I do not recommend this method because subjectively, this method is ignoring the authentication rules set in AAD for security. If you want a quick method to achieve what you want and not too worry about the security, you can try with this.

• The second one is using Kubernetes service accounts

You can follow this doc to create a service account. Then in Azure Devops, we could use this service account to communicate with AKS API. Here you also need to consider about the authorized IP address ranges in AKS.

After the service account created successfully, choose Service account in the service connection of Azure Devops:

Server URL: Get it from the AKS instance(API server address) in Azure portal, then do not forget append the https:// before it while you input it into this service connection.

Secret: Generate it by using command:

kubectl get secret -n <name of secret> -o yaml -n service-accounts

See this doc: Deploy Vault on Azure Kubernetes Service (AKS).

Then you can use this service connection in Azure Devops tasks.