Unable to initialize kubernetes provider with listClusterAdminCredential()

[mjlshen]

Bicep version

❯ az bicep version
Bicep CLI version 0.27.1 (4b41cb6d4b)

Describe the bug
I am attempting to create an AKS cluster and initialize the Bicep extensibility Kubernetes provider and am unable to do so, running az deployment group create I get the following error:

InvalidTemplate - Deployment template language expression evaluation failed: 'The template function 'listClusterAdminCredential' is not expected at this location. Please see https://aka.ms/arm-functions for usage details.'. Please see https://aka.ms/arm-functions for usage details.

To Reproduce
Steps to reproduce the behavior:

1. Reference an existing AKS cluster or create a new one, then try to retrieve its kubeconfig and use it

resource aks 'Microsoft.ContainerService/managedClusters@2024-02-01' existing = {
  name: 'aks'
}

provider kubernetes with {
  kubeConfig: aks.listClusterAdminCredential().kubeconfigs[0].value
  namespace: 'default'
}

2. Attempt to deploy it, e.g.

az deployment group create --name "test" --resource-group "test" --template-file "test.bicep" --confirm-with-what-if

Additional context

• Trying to follow the documentation in https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/bicep-extensibility-kubernetes-provider
• I was able to find a similar report in Can I use import multiple times or setup some dependencies? bicep-extensibility#134 (comment) if that's a better place for this

[shenglol]

Hi @mjlshen, this is by design due to a limitation of the ARM template evaluation engine. The provider config values must be deploy-time constants. If you need to use listClusterAdminCredential, it must be specified via a module parameter:

// main.bicep
resource aks 'Microsoft.ContainerService/managedClusters@2022-05-02-preview' existing = {
  name: 'demoAKSCluster'
}

module kubernetesDeploy './kubernetes.bicep' = {
  name: 'kubernetesDeploy'
  params: {
    kubeConfig: aks.listClusterAdminCredential().kubeconfigs[0].value
  }
}

// kubernetes.bicep
provider kubernetes with {
  kubeConfig: kubeConfig
  namespace: 'default'
}

param kubeConfig secureString

We will improve the Bicep compiler to make sure the error is captured at compile time.