azaks-conn

Fetch AKS kubeconfig and merge into ~/.kube/config by alias

Install

pip install azaks-conn

The package installs two console scripts that point at the same Typer app:

Command Use when
azaks-conn Long form, friendly for scripts
aksc Short alias for interactive shell use

Installing with pipx drops the scripts in ~/.local/bin. If that directory isn't on your PATH, run pipx ensurepath and restart your shell. aksc prints a one-line reminder to stderr if it detects this situation.

Usage

aksc --help
aksc --version

Four commands cover the alias lifecycle:

Command Purpose
aksc connect CLUSTER [--alias NAME] [--resource-group RG] [--subscription SUB] [--admin] [--overwrite] Fetch AKS credentials and merge into ~/.kube/config under the given alias.
aksc refresh ALIAS Re-fetch credentials for an existing alias using its recorded cluster / RG / subscription / admin flag. Useful after CA rotation or kubelogin cache expiry.
aksc list Rich-table inventory of aksc-managed aliases (with provenance metadata). Add --json for machine-readable output, or --no-truncate to keep full column values (auto-enabled when piped).
aksc verify ALIAS [--timeout N] Probe the alias's API server via kubectl cluster-info.
aksc rm ALIAS [--force] Remove the alias from ~/.kube/config, the snapshot directory, and the state file.

State lives in two places under ~/.kube/azaks-conn/:

  • <alias> — a single-context kubeconfig snapshot for each managed alias (mode 0600).
  • .aliases.json — JSON metadata (cluster, RG, subscription, admin flag, timestamp), used by list and verify.

Security model

aksc connect shells out to az aks get-credentials. By default this fetches an Entra ID (AAD) integrated kubeconfig: actual authentication still flows through kubelogin and your Azure identity, and cluster RBAC applies.

The --admin flag passes through to az aks get-credentials --admin, which returns a cluster-admin certificate in the kubeconfig. This bypasses Entra ID and RBAC entirely — anyone with the file is cluster-admin until the certificate expires (typically months).

aksc makes admin contexts visually obvious so they aren't accidentally shared, committed, or left lying around:

  • aksc connect --admin prints a yellow warning: line citing the bypass.
  • aksc list flags the alias with a red ADMIN marker in the Admin column.
  • aksc verify <admin-alias> reprints the warning after each probe.
  • Both the merged entry in ~/.kube/config and the per-alias snapshot under ~/.kube/azaks-conn/ are written with mode 0600.

Guidance:

  • Prefer the default (AAD) flow whenever possible.
  • Only use --admin for cluster bootstrap / break-glass work.
  • Treat any --admin kubeconfig as a high-privilege secret — do not check it into source control, share it over chat, or copy it to shared hosts.
  • aksc rm <admin-alias> is the fastest way to revoke local access; for full revocation, rotate the cluster admin credentials in Azure.

Development

git clone https://github.com/NaeemH/azaks-conn.git
cd azaks-conn
python -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
pre-commit install

# Run the standard checks
ruff check . && ruff format --check .
mypy src
pytest -q

Release

Releases are tag-driven. Bump src/azaks_conn/__about__.py, commit, then:

git tag v0.3.2
git push origin v0.3.2

.github/workflows/release.yml builds the sdist + wheel and publishes to PyPI via Trusted Publishers (OIDC) — no API tokens involved.

License

MIT

Project links

Data verified by PyPI on Jun 26, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for HackerNemo from gravatar.com HackerNemo

Credits

Author: Naeem Hossain

GitHub Statistics

Data verified by PyPI on Jun 26, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

MIT License (MIT License)

Requires

Python >=3.10

Provides Extra

dev

Tags

azure cli devops

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

azaks_conn-0.3.2.tar.gz (24.6 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

azaks_conn-0.3.2-py3-none-any.whl (17.5 kB view details)

Uploaded Python 3

File details

Details for the file azaks_conn-0.3.2.tar.gz.

File metadata

  • Download URL: azaks_conn-0.3.2.tar.gz
  • Upload date:
  • Size: 24.6 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for azaks_conn-0.3.2.tar.gz
Algorithm Hash digest
SHA256 238f34a62b6e02881cc2b6abe0e31d35f9e2df9552feab5a5435115a4dff4871
MD5 c562a1a50aca7c098e7049d41a367583
BLAKE2b-256 eeeaec9bee8bca6b907722e87668d2fbe6ebcfca87f18e0285e8957936a53c8a

See more details on using hashes here.

Provenance

The following attestation bundles were made for azaks_conn-0.3.2.tar.gz:

Publisher: release.yml on NaeemH/azaks-conn

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file azaks_conn-0.3.2-py3-none-any.whl.

File metadata

  • Download URL: azaks_conn-0.3.2-py3-none-any.whl
  • Upload date:
  • Size: 17.5 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for azaks_conn-0.3.2-py3-none-any.whl
Algorithm Hash digest
SHA256 0bd797fa2a8133162bbd9aa8daf97a33fd5400b64a240f36b305e0ec1d4586a6
MD5 953f7d1412fd55db3d5e90125c2e7f6d
BLAKE2b-256 1e17271b58a978fea749b32b9205012d16fc0f2eb96b43059cede21435a6dc23

See more details on using hashes here.

Provenance

The following attestation bundles were made for azaks_conn-0.3.2-py3-none-any.whl:

Publisher: release.yml on NaeemH/azaks-conn

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page