diff --git a/docs/recipes/k8s/cloud/aks.md b/docs/recipes/k8s/cloud/aks.md
index 57da650..d18ea70 100644
--- a/docs/recipes/k8s/cloud/aks.md
+++ b/docs/recipes/k8s/cloud/aks.md
@@ -24,11 +24,6 @@ export PIPELINE_INPUT_RECIPE="docs/recipes/k8s/cloud/deploy-tp-aks.yaml"
 
 We now have a new AKS to be ready to deploy TIBCO Platform.
 
-For Azure, the pipeline needs to set a special account name as environment variable. So that the pipeline knows to try Azure.
-```bash
-export ACCOUNT="azure-"
-```
-
 Environment variables that need to set in the recipe:
 ```yaml
 meta:
@@ -58,10 +53,16 @@ Environment variables that need to set in the recipe:
 ```yaml
 meta:
   globalEnvVariable:
+    # add new variables
+    ACCOUNT: "azure-" # Azure account prefix to trigger authenticating with Azure
+    AZURE_RESOURCE_GROUP: ""
+
+    # change existing variables
     CP_PROVIDER: "azure"
     CP_CLUSTER_NAME: ""
     CP_DNS_DOMAIN: ""
-    CP_STORAGE_CLASS: ""
+    CP_STORAGE_CLASS: "" # eg: azure-files-sc
+    TP_CERTIFICATE_CLUSTER_ISSUER: "cic-cert-subscription-scope-production-main"
 
     # container registry
     CP_CONTAINER_REGISTRY: "" # use jFrog for CP production deployment
diff --git a/docs/recipes/k8s/cloud/deploy-tp-aks.yaml b/docs/recipes/k8s/cloud/deploy-tp-aks.yaml
index 2b6dce2..0fae727 100644
--- a/docs/recipes/k8s/cloud/deploy-tp-aks.yaml
+++ b/docs/recipes/k8s/cloud/deploy-tp-aks.yaml
@@ -18,10 +18,10 @@ meta:
     TP_CHART_REPO: https://tibcosoftware.github.io/tp-helm-charts
     # cluster
     TP_CLUSTER_NAME: ${GUI_TP_CLUSTER_NAME}
-    CLUSTER_NAME: ${TP_CLUSTER_NAME} # pipeline aks internal variable
     TP_CLUSTER_VERSION: ${GUI_TP_CLUSTER_VERSION:-1.29}
     TP_AZURE_REGION: ${GUI_TP_AZURE_REGION:-"westus2"} # the default region for the azure account
     # Azure env
+    ACCOUNT: "azure-" # Azure account prefix to trigger authenticating with Azure
     TP_RESOURCE_GROUP: ${GUI_TP_RESOURCE_GROUP} # Azure resource group name
     AZURE_RESOURCE_GROUP: ${TP_RESOURCE_GROUP} # provisioner pipeline assume role needed
     TP_AUTHORIZED_IP: ${GUI_TP_AUTHORIZED_IP} # your ip x.x.x.x/32
@@ -66,7 +66,6 @@ meta:
     TP_DEPLOY_SECONDARY_INGRESS: $([[ "$TP_ENABLE_SECONDARY_KONG" == "true" ]] && echo "true" || echo "false")
     TP_SKIP_GENERATE_MAIN_INGRESS_CERTIFICATE: false
     TP_SKIP_GENERATE_SECONDARY_INGRESS_CERTIFICATE: false
-
   tools:
     yq: "4.40"
     helm: "3.13"