Aad-pod-identity: Add VMSS support

[ritazh]

When using a cluster with vmss agent pools created by acs-engine, getting the following error from nmi logs:

adal: Refresh request failed. Status Code = '400'. Response body: {\"error\":\"invalid_request\",\"error_description\":\"Identity not found\"}" req.method=GET req.path=/host/token/ req.remote=127.0.0.1

and this from the mic logs:

E0718 00:40:42.975094       1 mic.go:385] compute.VirtualMachinesClient#Get: Failure responding to request: StatusCode=404 -- Original Error: autorest/azure: Service returned an error. Status=404 Code="ResourceNotFound" Message="The Resource 'Microsoft.Compute/virtualMachines/k8s-agentpool-32078657-vmss000000' under resource group 'xxxx' was not found."

[kkmsft]

Currently the User assigned MSI is only applicable at scale set level. Individual node assignments (of the identities) cannot be performed because of this limitation.

[kkmsft]

We can add limited support for VMSS by adding the identity to the entire scale set than individual vms.

[rrudduck]

Any updates on this? We've started deploying all of our clusters that aren't using AKS with VMSS for the agent pools.

[pjbgf]

Does this also affect clusters that are not using MSI?

[kyschouv]

Is this on the schedule to land any time soon? We'd like to get away from manually-managed identities wherever possible.

[omerlh]

I'm experiencing exactly the same issue. Hope to see updates soon.

[kkmsft]

We have reprioritized this work and now spending focussed cycles on getting the VMSS support. The ETA is not known yet, but this is the top most item we are working on currently.

/cc @cpuguy83

[cpuguy83]

PR open here: https://github.com/Azure/aad-pod-identity/pull/120