Skip to content
VeraDocs
Back to main site

Azure Kubernetes Service (AKS)

Create AKS cluster records with an agent pool and network profile, read them back and inspect the credentials the emulator generates.

Plan: Pro69 of 69 operations implemented across its API2Known differences

Clusters are management records: no Kubernetes API answered, so the generated kubeconfig doesn't give you a cluster to use.

Example checked on Vera 1.2.2, 8 November 2026. Each coverage note names its own evidence and date.

Connect

Section titled “Connect”

Start Vera as in Get started, with your license key activated and the emulator started by the Vera launcher (Activate Pro). Then open Bash in a terminal of its own (on macOS, whose terminal starts zsh, type bash first), go to an empty scratch directory and run this; it needs curl and Python 3. It fetches the emulator's own certificate, so every request checks TLS, and defines arm, which this page's commands use. The bearer token vera-local is a dummy local credential, not your license key.

Terminal window
export VERA_CA_CERT="$PWD/vera-ca.pem"
curl --fail --silent --show-error --noproxy '*' --insecure \
  https://localhost:8543/_vera/ca.pem --output "$VERA_CA_CERT"
curl --fail --silent --show-error --noproxy '*' \
  --cacert "$VERA_CA_CERT" https://localhost:8543/_vera/health; echo


export AZ_BASE='https://localhost:8543'
export SUB='00000000-0000-0000-0000-000000000001'
export TENANT='00000000-0000-0000-0000-0000000000a1'
export TOKEN='vera-local'


62 more lines: show the full setup
# arm METHOD /path API_VERSION [body.json]
# Prints the response body once any operation it started has finished, or,
# if that response had no body, the finished operation's response, such as
# a RunCommand result. A finished operation can hold a failed result: read it.
arm() (
  set -eu
  method=$1; path=$2; version=$3
  work=$(mktemp -d)
  trap 'rm -rf "$work"' EXIT
  case "$path" in /*) ;; *) printf 'Expected a relative /path\n' >&2; exit 1;; esac
  case "$AZ_BASE" in https://localhost:8543|https://127.0.0.1:8543) ;; *) printf 'This recipe requires the local emulator\n' >&2; exit 1;; esac
  args=(--fail-with-body --silent --show-error --noproxy '*' --max-time 20
        --cacert "$VERA_CA_CERT" -H "Authorization: Bearer $TOKEN"
        -H 'Content-Type: application/json')
  body=()
  if [ "$#" -ge 4 ]; then body=(--data-binary "@$4"); fi
  code=$(curl "${args[@]}" -X "$method" ${body[@]+"${body[@]}"} -D "$work/headers" \
    -o "$work/body" -w '%{http_code}' "$AZ_BASE$path?api-version=$version") || {
      cat "$work/body" >&2; exit 1;
    }
  poll_url=$(python3 - "$work/headers" "$AZ_BASE" <<'PY'
import sys,urllib.parse
headers={}
for line in open(sys.argv[1]):
    if ':' in line:
        key,value=line.split(':',1); headers[key.lower()]=value.strip()
url=headers.get('azure-asyncoperation') or headers.get('operation-location') or headers.get('location') or ''
if url:
    url=urllib.parse.urljoin(sys.argv[2],url); p=urllib.parse.urlsplit(url)
    if p.scheme!='https' or p.hostname not in ('localhost','127.0.0.1') or p.port!=8543:
        raise SystemExit('Refusing a non-local operation URL')
print(url)
PY
  ) || exit 1
  if [ -n "$poll_url" ] && [ "$method" != GET ] && [ "$method" != HEAD ]; then
    done_ok=false
    for attempt in $(seq 1 30); do
      code=$(curl "${args[@]}" -D "$work/poll-headers" -o "$work/poll-body" -w '%{http_code}' "$poll_url") || {
        cat "$work/poll-body" >&2; exit 1;
      }
      state=$(python3 - "$work/poll-body" "$code" <<'PY'
import sys,json
raw=open(sys.argv[1]).read(); code=int(sys.argv[2]); value=json.loads(raw) if raw.strip() else {}
status=str(value.get('status') or value.get('properties',{}).get('provisioningState') or '').lower()
if status in ('failed','canceled','cancelled') or value.get('error'):
    print(raw,file=sys.stderr);raise SystemExit('Operation failed')
if status in ('succeeded','completed') or (not status and code in (200,204)):
    print('done')
else: print('pending')
PY
      ) || exit 1
      if [ "$state" = done ]; then done_ok=true; break; fi
      sleep 1
    done
    if [ "$done_ok" != true ]; then printf 'Operation polling timed out\n' >&2; exit 1; fi
    if [ -s "$work/poll-body" ] && ! grep -q '[^[:space:]]' "$work/body" 2>/dev/null; then
      cp "$work/poll-body" "$work/body"
    fi
  fi
  cat "$work/body"
  printf '\n'
)

The health check answers {"cloud": "azure", "generation_status": "generated", "status": "ok"}. Requests go only to the emulator at https://localhost:8543: the helper refuses any other address, including the Azure-looking URLs some responses hold. When you've finished, close the terminal and delete the scratch directory; that removes only these local files, not what you created in the emulator.

The examples use the AKS API (Microsoft.ContainerService) at 2026-08-01, the version tested with this build, and 2025-04-01 for the resource group.

Example

Section titled “Example”

Create a resource group and a cluster with a system-assigned identity, one Linux system pool of one node and the kubenet network plugin, then read the cluster back:

Terminal window
RG="docs-azure-kubernetes-service"
RGID="/subscriptions/$SUB/resourceGroups/$RG"
cat > resource-group.json <<'JSON'
{"location":"eastus"}
JSON
arm PUT "$RGID" 2025-04-01 resource-group.json
cat > managedclusters-createorupdate.json <<JSON
{
  "location": "eastus",
  "identity": {
    "type": "SystemAssigned"
  },
  "properties": {
    "dnsPrefix": "docs-aks",
    "agentPoolProfiles": [
      {
        "name": "systempool",
        "count": 1,
        "vmSize": "Standard_B2s",
        "osType": "Linux",
        "mode": "System"
      }
    ],
    "networkProfile": {
      "networkPlugin": "kubenet"
    }
  }
}
JSON
arm PUT "$RGID/providers/Microsoft.ContainerService/managedClusters/docs-aks" 2026-08-01 managedclusters-createorupdate.json
arm GET "$RGID/providers/Microsoft.ContainerService/managedClusters/docs-aks" 2026-08-01

The create answers 201, and arm polls its operation until it has Succeeded. The cluster reads back with its pool and network configuration. Selected fields:

Output (selected fields)
{
  "properties": {
    "agentPoolProfiles": [
      {
        "name": "systempool",
        "count": 1,
        "vmSize": "Standard_B2s",
        "osType": "Linux",
        "mode": "System"
      }
    ],
    "networkProfile": {
      "networkPlugin": "kubenet"
    }
  }
}

Ask for the cluster’s user credentials, and decode the kubeconfig in the response to read it. The command prints it and writes no file:

Terminal window
arm POST "$RGID/providers/Microsoft.ContainerService/managedClusters/docs-aks/listClusterUserCredential" 2026-08-01 |
  python3 -c 'import base64,json,sys; print(base64.b64decode(json.load(sys.stdin)["kubeconfigs"][0]["value"]).decode())'

The request answers 200 with an entry in kubeconfigs: a kubeconfig in JSON, encoded in base64. Its server is an Azure-style azmk8s.io address, and it sets insecure-skip-tls-verify: true. It’s a generated record: don’t add it to your kubeconfig or use it with kubectl, since no Kubernetes API answered behind it in testing (see Limitations).

To clean up, delete the cluster:

Terminal window
arm DELETE "$RGID/providers/Microsoft.ContainerService/managedClusters/docs-aks" 2026-08-01

The delete answers 202, and arm polls its operation to the end. The resource group docs-azure-kubernetes-service stays, since deleting a resource group fails in Vera 1.2.2; a fresh emulator starts without it.

Supported features

Section titled “Supported features”
  • Managed clusters: a cluster with a system-assigned identity, one Linux system pool of one Standard_B2s node and the kubenet plugin, created, read and deleted.
  • Generated user credentials: listClusterUserCredential answers 200 with a kubeconfig, as a record to inspect.

Limitations

Section titled “Limitations”

The main limits are below. A few more apply to every service, and the API coverage notes cover smaller differences.

  • No Kubernetes API answered. On Vera 1.2.0-rc.3, requests for /version, /api and /api/v1/namespaces, sent to the emulator with the kubeconfig’s server as the hostname, answered 400 MissingApiVersionParameter: an Azure management error, not a Kubernetes response. Pod scheduling, Kubernetes objects, nodes, RBAC and cluster networking weren’t established. The cluster, agent pool and credential operations in the API coverage manage records; they don’t establish a Kubernetes API or a workload scheduler.
  • RunCommand uses a fixed interpreter. ManagedClusters_RunCommand handles echo, pwd, ls, cat and a few kubectl commands over the emulator’s recorded namespaces and nodes; no Kubernetes workload engine runs them. In tests against Vera 1.2.0’s source, echo and namespace creation were accepted, while kubectl create deployment failed with exit status 2 and curl with exit status 127.
  • Don’t use the kubeconfig. It points at an Azure-style server and turns off TLS verification. Don’t install it or copy its insecure-skip-tls-verify setting.
  • Versions are metadata. Kubernetes versions and node image identifiers in responses don’t mean a cluster is running that version.

API coverage

Section titled “API coverage”

Every operation of the API on this page, from its pinned public definition, and whether Vera 1.2.0 implements it. Only the API surfaces in this release are listed, and each operation once. Implementation availability was reviewed against the Vera 1.2.0 source on 6 November 2026. Source inspection identifies a local implementation and its known limits; it doesn't mean every operation or API version was tested with a request. Each note names its evidence: a Local observation without a build or date is from Vera 1.2.0 preview, on 5 November 2026, and one from a later build, such as Vera 1.2.0-rc.3 or Vera 1.2.2, names that build and its date. No response was compared with Azure's. What the statuses mean

AgentPools

9 of 9 implemented
OperationStatusNotes
AgentPools_AbortLatestOperationImplementedSource inspection: Runs as a local action; an external engine running it isn't established. Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
AgentPools_CreateOrUpdateImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
AgentPools_DeleteImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
AgentPools_DeleteMachinesImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
AgentPools_GetImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
AgentPools_GetAvailableAgentPoolVersionsImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
AgentPools_GetUpgradeProfileImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
AgentPools_ListImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
AgentPools_UpgradeNodeImageVersionImplementedSource inspection: Runs as a local action; an external engine running it isn't established. Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.

IdentityBindings

4 of 4 implemented
OperationStatusNotes
IdentityBindings_CreateOrUpdateImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
IdentityBindings_DeleteImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
IdentityBindings_GetImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
IdentityBindings_ListByManagedClusterImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.

Machines

2 of 2 implemented
OperationStatusNotes
Machines_GetImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
Machines_ListImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.

MaintenanceConfigurations

4 of 4 implemented
OperationStatusNotes
MaintenanceConfigurations_CreateOrUpdateImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
MaintenanceConfigurations_DeleteImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
MaintenanceConfigurations_GetImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
MaintenanceConfigurations_ListByManagedClusterImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.

ManagedClusters

26 of 26 implemented · 2 known differences
OperationStatusNotes
ManagedClusters_AbortLatestOperationImplementedSource inspection: Runs as a local action; an external engine running it isn't established. Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedClusters_CreateOrUpdateImplementedLocal observation: Creating a cluster with a system-assigned identity, one Linux system pool and the kubenet plugin answered HTTP 201, and its operation finished as Succeeded.
ManagedClusters_DeleteImplementedLocal observation: Answered HTTP 202, and its operation was polled to a final status.
ManagedClusters_GetImplementedLocal observation: Answered HTTP 200 with the cluster's agent pool and network configuration.
ManagedClusters_GetAccessProfileImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedClusters_GetCommandResultImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedClusters_GetMeshRevisionProfileImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedClusters_GetMeshUpgradeProfileImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedClusters_GetUpgradeProfileImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedClusters_ListImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedClusters_ListByResourceGroupImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedClusters_ListClusterAdminCredentialsImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedClusters_ListClusterMonitoringUserCredentialsImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedClusters_ListClusterUserCredentialsKnown differenceLocal observation: Answered HTTP 200 with a base64-encoded JSON kubeconfig whose server is an Azure-style azmk8s.io address and which sets insecure-skip-tls-verify: true. Requests for /version, /api and /api/v1/namespaces, sent to the emulator with that server as the hostname, answered 400 MissingApiVersionParameter, not a Kubernetes response, so the kubeconfig can't be used with kubectl.
ManagedClusters_ListKubernetesVersionsImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedClusters_ListMeshRevisionProfilesImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedClusters_ListMeshUpgradeProfilesImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedClusters_ListOutboundNetworkDependenciesEndpointsImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedClusters_ResetAADProfileImplementedSource inspection: Runs as a local action; an external engine running it isn't established. Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedClusters_ResetServicePrincipalProfileImplementedSource inspection: Runs as a local action; an external engine running it isn't established. Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedClusters_RotateClusterCertificatesImplementedSource inspection: Runs as a local action; an external engine running it isn't established. Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedClusters_RotateServiceAccountSigningKeysImplementedSource inspection: Runs as a local action; an external engine running it isn't established. Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedClusters_RunCommandKnown differenceSource inspection: Runs commands through a fixed local interpreter: echo, pwd, ls, cat and a few kubectl commands over recorded namespaces and nodes. No Kubernetes workload runs. Tests against the reviewed source accepted echo and namespace creation, but kubectl create deployment failed with exit status 2 and curl with exit status 127.
ManagedClusters_StartImplementedSource inspection: Runs as a local action; an external engine running it isn't established. Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedClusters_StopImplementedSource inspection: Runs as a local action; an external engine running it isn't established. Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedClusters_UpdateTagsImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.

ManagedNamespaces

6 of 6 implemented
OperationStatusNotes
ManagedNamespaces_CreateOrUpdateImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedNamespaces_DeleteImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedNamespaces_GetImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedNamespaces_ListByManagedClusterImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedNamespaces_ListCredentialImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
ManagedNamespaces_UpdateImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.

Operations

1 of 1 implemented
OperationStatusNotes
Operations_ListImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.

PrivateEndpointConnections

4 of 4 implemented
OperationStatusNotes
PrivateEndpointConnections_DeleteImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
PrivateEndpointConnections_GetImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
PrivateEndpointConnections_ListImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
PrivateEndpointConnections_UpdateImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.

PrivateLinkResources

1 of 1 implemented
OperationStatusNotes
PrivateLinkResources_ListImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.

ResolvePrivateLinkServiceId

1 of 1 implemented
OperationStatusNotes
ResolvePrivateLinkServiceId_POSTImplementedSource inspection: Runs as a local action; an external engine running it isn't established. Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.

Snapshots

6 of 6 implemented
OperationStatusNotes
Snapshots_CreateOrUpdateImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
Snapshots_DeleteImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
Snapshots_GetImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
Snapshots_ListImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
Snapshots_ListByResourceGroupImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
Snapshots_UpdateTagsImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.

TrustedAccessRoleBindings

4 of 4 implemented
OperationStatusNotes
TrustedAccessRoleBindings_CreateOrUpdateImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
TrustedAccessRoleBindings_DeleteImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
TrustedAccessRoleBindings_GetImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.
TrustedAccessRoleBindings_ListImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.

TrustedAccessRoles

1 of 1 implemented
OperationStatusNotes
TrustedAccessRoles_ListImplementedSource inspection: Local cluster, pool and credential records; a Kubernetes API server and workload scheduling aren't established.