This project is archived and no longer maintained. These docs stay available as a reference. The code stays available under its original license.

What I build now:

Kubmin — per-workload cost, efficiency, and SCI/SEI intelligence for Kubernetes
infai — a terminal control plane for local LLM inference: one profile shape for llama.cpp and vLLM, many models at once, live tokens/sec plus CPU/RAM/VRAM telemetry, hardware fit checks before launch
infaiw — a daemon-based agent harness: sessions keep running after you close the terminal, sidecar loops must pass an acceptance check before reporting back, every event lands on a durable branchable timeline, and approvals wait for you

Want to take over maintenance of kli? If you still depend on it and would like to become the maintainer, reach out on Discord or open an issue.

Azure

Azure Cloud Provider

Azure Credential Requirements

Subscription ID

Your Azure subscription identifier can be found in your subscription details.

azure-subscription

Tenant ID

Located in the Azure Dashboard, which provides access to all required credentials.

azure-dashboard

To locate your Tenant ID:

Client ID (Application ID)

Represents the identifier of your registered application.

Steps to create:

Navigate to App Registrations

Register a new application
Obtain the Client ID

Client Secret

Authentication key for your registered application.

Steps to generate:

Access secret creation
Configure secret settings
Save the generated secret

Role Assignment

Configure application permissions:

Navigate to Subscriptions > Access Control (IAM)
Select “Role Assignment”
Click “Add > Add Role Assignment”
Create new role and specify the application name
Configure desired permissions

role-assign-app

You can create a custom Role and then attach to this app if you want fine grained permission Beta

{
    "properties": {
        "roleName": "Ksctl",
        "description": "Kubmin.ksctl.com",
        "assignableScopes": [
            "/subscriptions/<subscription_id>"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.ContainerService/register/action",
                    "Microsoft.ContainerService/unregister/action",
                    "Microsoft.ContainerService/operations/*",
                    "Microsoft.ContainerService/managedClusters/*",
                    "Microsoft.ContainerService/managedclustersnapshots/*",
                    "Microsoft.ContainerService/containerServices/*",
                    "Microsoft.ContainerService/deploymentSafeguards/*",
                    "Microsoft.ContainerService/locations/*",
                    "Microsoft.ContainerService/snapshots/*",

                    "Microsoft.Network/register/action",
                    "Microsoft.Network/unregister/action",
                    "Microsoft.Network/checkTrafficManagerNameAvailability/action",
                    "Microsoft.Network/internalNotify/action",
                    "Microsoft.Network/getDnsResourceReference/action",
                    "Microsoft.Network/queryExpressRoutePortsBandwidth/action",
                    "Microsoft.Network/checkFrontDoorNameAvailability/action",
                    "Microsoft.Network/privateDnsZonesInternal/action",
                    "Microsoft.Network/adminNetworkSecurityGroups/*",
                    "Microsoft.Network/applicationGateways/*",
                    "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/*",
                    "Microsoft.Network/applicationGatewayAvailableRequestHeaders/*",
                    "Microsoft.Network/applicationGatewayAvailableResponseHeaders/*",
                    "Microsoft.Network/applicationGatewayAvailableServerVariables/*",
                    "Microsoft.Network/applicationGatewayAvailableSslOptions/*",
                    "Microsoft.Network/applicationGatewayAvailableWafRuleSets/read",
                    "Microsoft.Network/applicationSecurityGroups/*",
                    "Microsoft.Network/operations/*",
                    "Microsoft.Network/azurefirewalls/*",
                    "Microsoft.Network/azureFirewallFqdnTags/read",
                    "Microsoft.Network/dnsResolvers/*",
                    "Microsoft.Network/dnszones/*",
                    "Microsoft.Network/dnsoperationresults/*",
                    "Microsoft.Network/firewallPolicies/*",
                    "Microsoft.Network/gatewayLoadBalancerAliases/*",
                    "Microsoft.Network/ipAllocations/*",
                    "Microsoft.Network/ipGroups/*",
                    "Microsoft.Network/loadBalancers/*",
                    "Microsoft.Network/natGateways/*",
                    "Microsoft.Network/networkInterfaces/*",
                    "Microsoft.Network/virtualNetworks/*",
                    "Microsoft.Network/virtualNetworkGateways/read",
                    "Microsoft.Network/virtualNetworkGateways/write",
                    "Microsoft.Network/virtualNetworkGateways/delete",
                    "microsoft.network/virtualnetworkgateways/*",
                    "Microsoft.Network/virtualRouters/*",

                    "Microsoft.Resources/checkResourceName/action",
                    "Microsoft.Resources/changes/*",
                    "Microsoft.Resources/deployments/*",
                    "Microsoft.Resources/deploymentScripts/*",
                    "Microsoft.Resources/deploymentStacks/*",
                    "Microsoft.Resources/locations/*",
                    "Microsoft.Resources/providers/*",
                    "Microsoft.Resources/links/*",
                    "Microsoft.Resources/resources/*",
                    "Microsoft.Resources/subscriptions/*",
                    "Microsoft.Resources/subscriptions/locations/*",
                    "Microsoft.Resources/subscriptions/resourceGroups/*",
                    "Microsoft.Resources/subscriptions/providers/*",
                    "Microsoft.Resources/subscriptions/operationresults/*",
                    "Microsoft.Resources/subscriptions/resources/*",
                    "Microsoft.Resources/subscriptions/tagNames/*",
                    "Microsoft.Resources/subscriptionRegistrations/*",
                    "Microsoft.Resources/tags/*",
                    "Microsoft.Resources/templateSpecs/*",
                    "Microsoft.Resources/templateSpecs/versions/*",
                    "Microsoft.Resources/tenants/*",

                    "Microsoft.ManagedIdentity/register/*",
                    "Microsoft.ManagedIdentity/operations/*",
                    "Microsoft.ManagedIdentity/identities/*",
                    "Microsoft.ManagedIdentity/userAssignedIdentities/*"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}

Authentication Methods

Command Line Interface

ksctl configure cloud

Available Cluster Types

Self-Managed Clusters

Self-managed clusters with the following components:

Distributed etcd database instances
HAProxy load balancer for control plane high availability
Multiple control plane nodes
Worker nodes

Bootstrap options:

k3s (lightweight Kubernetes distribution)
kubeadm (official Kubernetes bootstrap tool)

Azure Kubernetes Service (AKS)

Fully managed Kubernetes service by Azure.

Cluster Management Features

Cluster Operations

Managed Clusters (AKS)

Create and delete operations
Cluster switching
Infrastructure updates currently not supported

High Availability Clusters

Worker node scaling (add/remove)
Secure SSH access to all components:
- Database nodes
- Load balancer
- Control plane nodes
- Worker nodes
Protected by SSH key authentication
Public access enabled

Looking for CLI Commands?

All CLI commands mentioned in this documentation have detailed explanations in our command reference guide.

CLI Reference

👉 Check out our comprehensive CLI Commands Reference for:

Detailed command syntax
Usage examples
Available options and flags
Common use cases

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.

Last modified November 5, 2025: Document custom role creation in Azure (876aea5)