### Install Upbound Up CLI

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Configuration.md

Installs the Upbound Up command-line tool, used for managing UXP and interacting with the Upbound Marketplace.

```shell
curl -sL "https://cli.upbound.io" | sh
```

--------------------------------

### Install provider-azure-management

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Configuration.md

Installs the Upbound official Azure provider-family. The first provider installed also installs a provider-family Provider to manage ProviderConfigs.

```yaml
apiVersion: pkg.crossplane.io/v1
kind: Provider
metadata:
  name: provider-azure-management
spec:
  package: xpkg.upbound.io/upbound/provider-azure-management:<version>
```

--------------------------------

### Verify Provider Installation

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Configuration.md

Verifies that the provider-azure-management and the provider-family-azure have been successfully installed and are healthy.

```shell
$ kubectl get providers
NAME                            INSTALLED   HEALTHY   PACKAGE                                                     AGE
provider-azure-management       True        True      xpkg.upbound.io/upbound/provider-azure-management:v0.36.0   101s
upbound-provider-family-azure   True        True      xpkg.upbound.io/upbound/provider-family-azure:v0.36.0       93s
```

--------------------------------

### Install Upbound CLI

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Quickstart.md

Download and install the Upbound `up` command-line tool. Ensure your version is v0.13.0 or later for official provider support.

```shell
curl -sL "https://cli.upbound.io" | sh
mv up /usr/local/bin/
```

```shell
$ up --version
```

```shell
v0.19.1
```

--------------------------------

### Install Upbound Universal Crossplane (UXP)

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Configuration.md

Installs UXP into your Kubernetes cluster using the Up command-line. UXP is required for official providers.

```shell
up uxp install
```

--------------------------------

### Install Universal Crossplane (UXP)

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Quickstart.md

Install Upbound Universal Crossplane using the `up` command-line tool. Official provider-families require Crossplane version 1.12.1 or UXP version 1.12.1-up.1 or later.

```shell
$ up uxp install
```

```shell
UXP 1.13.2-up.2 installed
```

--------------------------------

### Verify Azure Provider Installation

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Quickstart.md

Check the status of installed providers, including `provider-azure-management` and `upbound-provider-family-azure`. It may take up to 5 minutes for providers to report as `HEALTHY`.

```shell
NAME                            INSTALLED   HEALTHY   PACKAGE                                                     AGE
provider-azure-management       True        True      xpkg.upbound.io/upbound/provider-azure-management:v0.36.0   101s
upbound-provider-family-azure   True        True      xpkg.upbound.io/upbound/provider-family-azure:v0.36.0       93s
```

--------------------------------

### Verify Managed Resource Creation

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Quickstart.md

Use `kubectl get managed` to check the status of your deployed managed resources. `READY` and `SYNCED` should be `True` for successful creation.

```shell
$ kubectl get managed
NAME                                                         READY   SYNCED   EXTERNAL-NAME    AGE
managementgroup.management.azure.upbound.io/example-parent   True    True     example-parent   116s
```

--------------------------------

### Example Azure Service Principal Credentials

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Configuration.md

An example of the JSON output generated by `az ad sp create-for-rbac` containing authentication details for Azure.

```json
{
  "clientId": "00000000-0000-0000-0000-000000000000",
  "clientSecret": "XXX",
  "subscriptionId": "00000000-0000-0000-0000-000000000000",
  "tenantId": "00000000-0000-0000-0000-000000000000",
  "activeDirectoryEndpointUrl": "https://login.microsoftonline.com",
  "resourceManagerEndpointUrl": "https://management.azure.com/",
  "activeDirectoryGraphResourceId": "https://graph.windows.net/",
  "sqlManagementEndpointUrl": "https://management.core.windows.net:8443/",
  "galleryEndpointUrl": "https://gallery.azure.com/",
  "managementEndpointUrl": "https://management.core.windows.net/"
}
```

--------------------------------

### Log in to Azure CLI

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Configuration.md

Logs you into the Azure command-line interface. Ensure you have the Azure CLI installed.

```shell
az login
```

--------------------------------

### Get ProviderConfig

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Quickstart.md

Use kubectl to get the ProviderConfig resource. This helps verify that your configuration is recognized by the system.

```shell
$ kubectl get providerconfig
NAME                                        AGE
providerconfig.azure.upbound.io/dev   89s
```

--------------------------------

### Verify ProviderConfig

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Quickstart.md

Use `kubectl describe providerconfigs` to verify that the `ProviderConfig` has been successfully created and is referencing the correct secret.

```shell
$ kubectl describe providerconfigs
Name:         default
Namespace:
API Version:  azure.upbound.io/v1beta1
Kind:         ProviderConfig
# Output truncated
Spec:
  Credentials:
    Secret Ref:
      Key:        creds
      Name:       azure-secret
      Namespace:  upbound-system
    Source:       Secret
```

--------------------------------

### Troubleshoot ManagementGroup Creation Failure

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Quickstart.md

If a managed resource fails to create, use `kubectl describe` to diagnose the issue. Common problems include mismatches between `ProviderConfig` and the managed resource's `providerConfigRef`.

```shell
$ kubectl describe managementgroup
Name:         example-parent
Namespace:
Labels:       testing.upbound.io/example-name=example_parent
Annotations:  crossplane.io/external-create-succeeded: 2023-09-26T13:45:18Z
              crossplane.io/external-name: example-parent
              meta.upbound.io/example-id: management/v1beta1/managementgroup
              upjet.crossplane.io/provider-meta:
                {"e2bfb730-ecaa-11e6-8f88-34363bc7c4c0":{"create":1800000000000,"delete":1800000000000,"read":300000000000,"update":1800000000000}}
API Version:  management.azure.upbound.io/v1beta1
Kind:         ManagementGroup
```

--------------------------------

### Verify UXP Pods

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Quickstart.md

Check if the Universal Crossplane pods are running in the `upbound-system` namespace.

```shell
$ kubectl get pods -n upbound-system
```

```shell
NAME                                       READY   STATUS    RESTARTS   AGE
crossplane-77ff754998-5j9rm                1/1     Running   0          49s
crossplane-rbac-manager-79b8bdd6d8-nwmb9   1/1     Running   0          49s
```

--------------------------------

### Create Azure Service Principal

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Configuration.md

Creates an Azure service principal with Owner role for the specified subscription and outputs the credentials to a JSON file. Replace <Subscription ID> with your actual Subscription ID.

```shell
# Replace <Subscription ID> with your subscription ID.
az ad sp create-for-rbac --sdk-auth --role Owner --scopes /subscriptions/<Subscription ID> \
  > azure.json
```

--------------------------------

### View Kubernetes Secret Details

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Quickstart.md

Inspect the created Kubernetes secret to verify its contents and size. This helps confirm the credentials were loaded correctly.

```shell
$ kubectl describe secret azure-secret -n upbound-system
Name:         azure-secret
Namespace:    upbound-system
Labels:       <none>
Annotations:  <none>

Type:  Opaque

Data
====
creds:  629 bytes
```

--------------------------------

### Service Principal Credentials Document (Client Certificate)

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/AUTHENTICATION.md

This JSON document configures service principal authentication using a client certificate instead of a client secret. The certificate must be in PKCS12 format, base64-encoded, and optionally protected by a password.

```json
{
  "clientId": "<client ID of the service principal>",
  "clientCertificate": "<base64-encoded pkcs12 client certificate of the service principal>",
  "clientCertificatePassword": "<password for the client certificate, can be omitted>",
  "subscriptionId": "<subscription ID containing the service principal>",
  "tenantId": "<tenant ID of the service principal>",
  "activeDirectoryEndpointUrl": "https://login.microsoftonline.com",
  "resourceManagerEndpointUrl": "https://management.azure.com/",
  "activeDirectoryGraphResourceId": "https://graph.windows.net/",
  "sqlManagementEndpointUrl": "https://management.core.windows.net:8443/",
  "galleryEndpointUrl": "https://gallery.azure.com/",
  "managementEndpointUrl": "https://management.core.windows.net/"
}
```

--------------------------------

### Create ProviderConfig for Azure

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Quickstart.md

Define a `ProviderConfig` Kubernetes resource to link your Azure credentials secret to the `provider-azure-management`. The `spec.secretRef` must match the secret's name and key.

```yaml
apiVersion: azure.upbound.io/v1beta1
metadata:
  name: default
kind: ProviderConfig
spec:
  credentials:
    source: Secret
    secretRef:
      namespace: upbound-system
      name: azure-secret
      key: creds
```

--------------------------------

### Verify Resource Removal

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Quickstart.md

Verify that the managed resource has been successfully removed by listing all ManagementGroup resources. If no resources are found, the deletion was successful.

```shell
$ kubectl get managementgroup
No resources found
```

--------------------------------

### Create Azure Service Principal

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Quickstart.md

Generate an Azure service principal and authentication file using the Azure CLI. This requires your Azure Subscription ID and creates a JSON output with credentials.

```command
az login
```

```command
az ad sp create-for-rbac --sdk-auth --role Owner --scopes /subscriptions/<Subscription ID>
```

```json
{
  "clientId": "5d73973c-1933-4621-9f6a-9642db949768",
  "clientSecret": "24O8Q~db2DFJ123MBpB25hdESvV3Zy8bfeGYGcSd",
  "subscriptionId": "c02e2b27-21ef-48e3-96b9-a91305e9e010",
  "tenantId": "7060afec-1db7-4b6f-a44f-82c9c6d8762a",
  "activeDirectoryEndpointUrl": "https://login.microsoftonline.com",
  "resourceManagerEndpointUrl": "https://management.azure.com/",
  "activeDirectoryGraphResourceId": "https://graph.windows.net/",
  "sqlManagementEndpointUrl": "https://management.core.windows.net:8443/",
  "galleryEndpointUrl": "https://gallery.azure.com/",
  "managementEndpointUrl": "https://management.core.windows.net/"
}
```

--------------------------------

### Create ProviderConfig for Azure

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Configuration.md

Defines a ProviderConfig object named 'default' that references the Kubernetes secret 'azure-secret' for Azure authentication. Ensure the secret name matches the one created in the previous step.

```yaml
apiVersion: azure.upbound.io/v1beta1
kind: ProviderConfig
metadata:
  name: default
spec:
  credentials:
    source: Secret
    secretRef:
      namespace: upbound-system
      name: azure-secret
      key: creds
```

--------------------------------

### Configure Service Principal Credentials with Secret

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/AUTHENTICATION.md

Use this to configure authentication with long-term service principal credentials stored in a Kubernetes Secret. Ensure the secret contains the base64-encoded service principal credentials document.

```yaml
apiVersion: v1
kind: Secret
metadata:
  name: example-azure-creds
  namespace: upbound-system
type: Opaque
data:
  creds: <base64-encoded service principal credentials document>
---
apiVersion: azure.upbound.io/v1beta1
kind: ProviderConfig
metadata:
  name: default
spec:
  credentials:
    source: Secret
    secretRef:
      name: example-azure-creds
      namespace: upbound-system
      key: creds
```

--------------------------------

### Create Azure ManagementGroup Managed Resource

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Quickstart.md

Deploy a managed resource, such as an Azure ManagementGroup, to test the `provider-azure-management`. Ensure `spec.providerConfigRef.name` matches your `ProviderConfig`.

```yaml
apiVersion: management.azure.upbound.io/v1beta1
kind: ManagementGroup
metadata:
  annotations:
    meta.upbound.io/example-id: management/v1beta1/managementgroup
  labels:
    testing.upbound.io/example-name: example_parent
  name: example-parent
spec:
  forProvider:
    displayName: ParentGroup
  providerConfigRef:
    name: default
```

--------------------------------

### Service Principal Credentials Document (Secret)

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/AUTHENTICATION.md

This JSON document contains the long-term service principal credentials required for authentication. It includes client ID, client secret, subscription ID, and tenant ID.

```json
{
  "clientId": "<client ID of the service principal>",
  "clientSecret": "<client secret of the service principal>",
  "subscriptionId": "<subscription ID containing the service principal>",
  "tenantId": "<tenant ID of the service principal>",
  "activeDirectoryEndpointUrl": "https://login.microsoftonline.com",
  "resourceManagerEndpointUrl": "https://management.azure.com/",
  "activeDirectoryGraphResourceId": "https://graph.windows.net/",
  "sqlManagementEndpointUrl": "https://management.core.windows.net:8443/",
  "galleryEndpointUrl": "https://gallery.azure.com/",
  "managementEndpointUrl": "https://management.core.windows.net/"
}
```

--------------------------------

### Create Kubernetes Secret for Azure Credentials

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Quickstart.md

Use `kubectl create secret` to generate a Kubernetes secret object containing your Azure credentials. Ensure the secret is created in the `upbound-system` namespace.

```shell
kubectl create secret generic azure-secret -n upbound-system --from-file=creds=./azure-credentials.json
```

--------------------------------

### User-Assigned Managed Identity Authentication

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/AUTHENTICATION.md

This method is suitable for AKS clusters using a user-assigned managed identity as its kubelet identity. It also eliminates the need for long-term service principal credentials.

```yaml
apiVersion: azure.upbound.io/v1beta1
kind: ProviderConfig
metadata:
  name: default
spec:
  credentials:
    source: UserAssignedManagedIdentity
  clientID: <clientId of the user-assigned managed identity used as the kubelet identity>
  subscriptionID: <subscription ID>
  tenantID: <tenant ID>
```

--------------------------------

### Generate Kubernetes Secret for Azure Credentials

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Configuration.md

Creates a Kubernetes secret named 'azure-secret' from the generated 'azure.json' file, which contains the Azure service principal credentials.

```shell
kubectl create secret generic azure-secret --from-file=creds=./azure.json
```

--------------------------------

### System-Assigned Managed Identity Authentication

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/AUTHENTICATION.md

Use this configuration when the provider-azure is running on an AKS cluster with system-assigned managed identities enabled. No explicit credentials are required in the ProviderConfig.

```yaml
apiVersion: azure.upbound.io/v1beta1
kind: ProviderConfig
metadata:
  name: default
spec:
  credentials:
    source: SystemAssignedManagedIdentity
  subscriptionID: <subscription ID>
  tenantID: <tenant ID>
```

--------------------------------

### Delete Managed Resource

Source: https://github.com/crossplane-contrib/provider-upjet-azure/blob/main/docs/family/Quickstart.md

Delete a managed resource using kubectl delete. This command removes the specified resource from your Kubernetes cluster and deprovisions the corresponding cloud resource.

```shell
$ kubectl delete -f <your-managementgroup-object-file>
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.