My requirement here is very simple, I provisioned an AKS cluster and I would like to deploy services to this cluster dynamically through the master NODE's REST API uses a bearer token generated with a service principles credentials.

I cannot seem to find any example of this. All the tutorials end at the kubectl level which is useless for what I need.

This in theory should be doable, any help is welcomed.

NOTE: The application I would like to provision from is running python and also is running outside of the cluster.

Service Principal:

{
  "appId": "0c6f1e71-b6fe-4187-8de6-3f84a419c0db",
  "displayName": "deployer",
  "name": "http://deployer",
  "password": "xxxxxxxx-xxx-xxxx-xxxx-xxxxxxxxxxxx",
  "tenant": "xxxxxxxx-xxx-xxxx-xxxx-xxxxxxxxxxxx"
}

Service Account:

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: alice-cluster-admin
  namespace: default
rules:
- apiGroups: [""]
  resources: ["*"]
  verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: alice-cluster-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: 2210df5a-94d5-489f-9c6f-0d9d71bef61a

Python Request For Token:

import requests 

print( 
requests.get( 
 url="https://login.microsoftonline.com/sometenantname.onmicrosoft.com/oauth2/token", 
data={ 
'grant_type':'client_credentials', 
'client_id':'2210df5a-94d5-489f-9c6f-0d9d71bef61a', 
'client_secret':'xxxxxxxx-xxx-xxxx-xxxx-xxxxxxxxxxxx', 
'resource':'https://graph.microsoft.com' 
} 
).content 
)  

The returned token produces a 401 error on the Kube API when requests are made

{
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Failure",
    "message": "Unauthorized",
    "reason": "Unauthorized",
    "code": 401
}