Cloud integrations (Azure)

The first step in building out a self-hosted cluster in Azure.

To connect Release to your Microsoft Azure account, you need to create a service principal and configure credentials. You will then use these credentials to authenticate with Release and create a cloud integration.

You can set up the service principal using either the Azure Portal (recommended for beginners) or the Azure CLI (faster for experienced users).

Option 1: Set up a service principal in the Azure Portal

Log in to the Azure Portal and navigate to Microsoft Entra ID (formerly Azure Active Directory).

Create an App Registration

1. In the left sidebar, select App registrations and click New registration

2. Under application details:

   • Give the application a name, such as "Release Service Principal"

   • Under Supported account types, select "Accounts in this organizational directory only (Default Directory only - Single tenant)"

   • Leave the Redirect URI blank (optional)

3. Click Register to create the app registration

Screenshot: Create app registration

After registration, you'll see the application overview page. Take note of the following values as you'll need them later:

• Application (client) ID

• Directory (tenant) ID

Create a Client Secret

1. In the left sidebar of your app registration, select Certificates & secrets

2. Under Client secrets, click New client secret

3. Add a description (e.g., "Release Integration") and select an expiration period

4. Click Add

5. Important: Copy the Value immediately. This is your client_secret and will only be shown once. If you lose it, you'll need to create a new secret.

Screenshot: Create client secret

After clicking Add, the secret will be created and displayed. Copy the Value immediately:

Screenshot: Client secret created

Assign Subscription Role

To allow Release to manage resources in your subscription, you need to assign the service principal the appropriate role:

1. Navigate to Subscriptions in the Azure Portal (search for "Subscriptions" in the top search bar)

2. Select the subscription you want to use with Release

3. Take note of your Subscription ID - you'll need this for the credentials file

4. In the left sidebar, select Access control (IAM)

5. Click Add > Add role assignment

6. Under the Role tab, select Contributor (or a more restrictive custom role based on your security requirements)

7. Click Next to go to the Members tab

8. Under Assign access to, select User, group, or service principal

9. Click Select members and search for your application name (e.g., "Release Service Principal")

10. Select your application and click Select

11. Click Review + assign to complete the role assignment

Screenshot: Select role

After selecting the Contributor role, click Next to select the members. Click Select members and search for your service principal:

Screenshot: Select members

After selecting your service principal, click Select and then Review + assign:

Screenshot: Member selected

Create Credentials JSON File

Create a JSON file with the credentials you collected. The file should have the following format:

{
  "subscription_id": "your-subscription-id",
  "tenant_id": "your-tenant-id",
  "client_id": "your-application-client-id",
  "client_secret": "your-client-secret-value"
}

Replace the placeholder values with the actual values from your Azure setup:

• subscription_id: The Subscription ID from your Azure subscription

• tenant_id: The Directory (tenant) ID from your app registration overview

• client_id: The Application (client) ID from your app registration overview

• client_secret: The secret value you copied when creating the client secret

Save this file locally as azure-credentials.json or similar.

Option 2: Set up a service principal using Azure CLI

If you have the Azure CLI installed, you can create the service principal with a single command.

Prerequisites

1. Install the Azure CLI

2. Log in to your Azure account:

   az login

Create Service Principal with Role Assignment

Run the following command to create a service principal with the Contributor role on your subscription:

az ad sp create-for-rbac \
  --name "Release Service Principal" \
  --role Contributor \
  --scopes /subscriptions/YOUR_SUBSCRIPTION_ID

Replace YOUR_SUBSCRIPTION_ID with your actual subscription ID. You can find your subscription ID by running:

az account show --query id --output tsv

Save the Output

The create-for-rbac command will output JSON credentials similar to this:

{
  "appId": "12345678-1234-1234-1234-123456789abc",
  "displayName": "Release Service Principal",
  "password": "your-client-secret-here",
  "tenant": "87654321-4321-4321-4321-cba987654321"
}

Important: Save this output immediately - the password (client secret) cannot be retrieved later.

Format Credentials for Release

Convert the Azure CLI output to the format Release expects by creating a JSON file with the following structure:

{
  "subscription_id": "YOUR_SUBSCRIPTION_ID",
  "tenant_id": "87654321-4321-4321-4321-cba987654321",
  "client_id": "12345678-1234-1234-1234-123456789abc",
  "client_secret": "your-client-secret-here"
}

Map the values as follows:

• subscription_id: Your Azure subscription ID (from az account show)

• tenant_id: The tenant value from the CLI output

• client_id: The appId value from the CLI output

• client_secret: The password value from the CLI output

Save this file as azure-credentials.json.

Create a Release integration with Azure

First, navigate to the Account Settings screen by clicking the Account Settings icon in the upper right corner of the window.

On the Configuration screen, select the Cloud Integrations tab and click the Create Cloud Integration button:

Choose "Microsoft" or "Microsoft Azure" from the dropdown list of providers and give it a name based on what you plan to use it for (for example, "Production Azure"). Click Choose File to upload the JSON credentials file that you created.

Click Create Cloud Integration to save your settings.

Verifying the Integration

After creating the integration, Release will validate your credentials by:

• Verifying access to the Azure subscription

• Checking that required resource providers are available

If validation fails, double-check that:

• All four credential values are correct in your JSON file

• The service principal has been assigned the Contributor role on your subscription

• The client secret hasn't expired

Next Steps

Once your Azure cloud integration is configured, you can:

• Connect existing AKS (Azure Kubernetes Service) clusters to Release

• Use Azure Container Registry (ACR) for container images

• Deploy applications to your Azure infrastructure

For more information about using Azure with Release, see the main integrations documentation.