Use --service-principal in az aks create about myakscluster

[mathieu-benoit]

az role assignment list --assignee $spId --all -o table

Before az aks create:

Principal            Role         Scope
-------------------  -----------  ----------------------------------------------------------------------------------------------------------------
http://$rg          Contributor        /subscriptions/$subscriptionId

After az aks create:

Principal            Role         Scope
-------------------  -----------  ----------------------------------------------------------------------------------------------------------------
http://$rg          Contributor        /subscriptions/$subscriptionId
http://$rg          Contributor        /subscriptions/$subscriptionId/resourceGroups/MC_$rg_$aks_$location

[mathieu-benoit]

Not working yet with a dedicated SP per AKS cluster, with least privilege and scoped to that AKS resource.

Need to take into account this on the "master" SP:

If you're authenticating using a Service Principal then it must have permissions to both Read and write all applications and Sign in and read user profile within the Windows Azure Active Directory API.

Taken from this: https://www.terraform.io/docs/providers/azurerm/r/azuread_service_principal_password.html

hashicorp/terraform-provider-azuread#35

I can't do that with the Microsoft's AAD.