Aad-pod-identity: Deleting an identity breaks all binding forever

[oliverholliday]

Describe the bug

We have a simple setup where each pod has an associated userAssignedIdentity and the selector is set to that identity's name. After deleting a pod and its associated azure identity the MIC pod won't assign any other identities and writes a huge amount of logs which refer to not having permissions to change the identity which no longer exists.

Steps To Reproduce

Create an identity and bind it to a pod. Delete the identity. Create another identity and bind it to another pod.

Expected behavior

Pod identity binding works.

AAD Pod Identity version

We were using 1.3/1,4 but after experiencing this bug we upgraded to 1.5.1. The errors are just the same.

Kubernetes version

1.13.8

E0814 10:23:00.612145       1 mic.go:756] Applying binding edge-ui-virtual-terminal-weq7ibfl node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-ip262zey-7d57fcfbcb-wn6vf-edge-edge-ui-virtual-terminal-hpx1n2bu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:00.612200       1 mic.go:756] Applying binding edge-ui-virtual-reader-hhdpd2ag node aks-aksagentpool-93648681-1 for pod ui-virtual-reader-5k1rlvxg-85d58bb647-2s7rn-edge-edge-ui-virtual-reader-yufhb7b4 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:00.612351       1 mic.go:756] Applying binding gf2-integration-demo-6xzubk9k node aks-aksagentpool-93648681-1 for pod integration-demo-109ftake-556886948-lzbjh-gf2-gf2-integration-demo-itaiivhu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:00.612456       1 mic.go:756] Applying binding gf2-merchant-s6fuxpz4 node aks-aksagentpool-93648681-1 for pod merchant-cfddi17e-589d95948d-kdnnm-gf2-gf2-merchant-uvblsift resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' 
has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:00.612501       1 mic.go:317] Found 29 pods, 29 ids, 29 bindings
I0814 10:23:00.612511       1 stats.go:65] ** Stats collected **
I0814 10:23:00.612515       1 stats.go:61] Pod listing: 79.301µs
I0814 10:23:00.612523       1 stats.go:61] ID listing: 32.513842ms
I0814 10:23:00.612526       1 stats.go:61] Binding listing: 17.251728ms
I0814 10:23:00.612530       1 stats.go:61] Assigned ID listing: 19.737547ms
I0814 10:23:00.612534       1 stats.go:61] System: 69.601618ms
I0814 10:23:00.612538       1 stats.go:61] Cloud provider get: 167.352646ms
I0814 10:23:00.612541       1 stats.go:61] Cloud provider put: 0s
I0814 10:23:00.612545       1 stats.go:61] Assigned ID addition: 0s
I0814 10:23:00.612548       1 stats.go:61] Assigned ID deletion: 0s
I0814 10:23:00.612552       1 stats.go:61] Find assigned ids to create: 37µs
I0814 10:23:00.612555       1 stats.go:61] Find assigned ids to delete: 33.301µs
I0814 10:23:00.612583       1 stats.go:61] Total time to assign or remove IDs: 225.913882ms
I0814 10:23:00.612588       1 stats.go:61] Event recording: 0s
I0814 10:23:00.612591       1 stats.go:61] Total: 295.909103ms
I0814 10:23:00.612595       1 stats.go:87] *********************
I0814 10:23:00.612855       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-ui-virtual-terminal-mxcnmlxi", UID:"9d6e4eda-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16409921", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-ui-virtual-terminal-mxcnmlxi node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-1fdzunms-6554cffbb8-hlmmk-gf2-gf2-ui-virtual-terminal-wamyemau resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:00.612992       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-integration-demo-trf7to5v", UID:"56cdfb28-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405529", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-integration-demo-trf7to5v node aks-aksagentpool-93648681-1 for pod ui-integration-demo-kuch22sa-5588495ccc-8t772-edge-edge-ui-integration-demo-mt9e1n64 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."    
I0814 10:23:00.613063       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-virtual-terminal-weq7ibfl", UID:"556e0935-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405510", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-virtual-terminal-weq7ibfl node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-ip262zey-7d57fcfbcb-wn6vf-edge-edge-ui-virtual-terminal-hpx1n2bu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."    
I0814 10:23:00.613157       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-virtual-reader-hhdpd2ag", UID:"55589fbb-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405508", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-virtual-reader-hhdpd2ag node aks-aksagentpool-93648681-1 for pod ui-virtual-reader-5k1rlvxg-85d58bb647-2s7rn-edge-edge-ui-virtual-reader-yufhb7b4 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:00.613367       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-integration-demo-6xzubk9k", UID:"9f75273e-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16410055", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-integration-demo-6xzubk9k node aks-aksagentpool-93648681-1 for pod integration-demo-109ftake-556886948-lzbjh-gf2-gf2-integration-demo-itaiivhu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:00.617149       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-merchant-s6fuxpz4", UID:"9ebdd790-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16410000", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-merchant-s6fuxpz4 node aks-aksagentpool-93648681-1 for pod merchant-cfddi17e-589d95948d-kdnnm-gf2-gf2-merchant-uvblsift resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:00.716175       1 cloudprovider.go:199] Updating user assigned MSIs on aks-aksagentpool-93648681-1
E0814 10:23:00.774415       1 vm.go:48] compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:00.774479       1 mic.go:739] Updating msis on node aks-aksagentpool-93648681-1, add [6], del [0] failed with error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original 
Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:00.984506       1 mic.go:756] Applying binding edge-ui-virtual-reader-hhdpd2ag node aks-aksagentpool-93648681-1 for pod ui-virtual-reader-5k1rlvxg-85d58bb647-2s7rn-edge-edge-ui-virtual-reader-yufhb7b4 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:00.984801       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-virtual-reader-hhdpd2ag", UID:"55589fbb-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405508", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-virtual-reader-hhdpd2ag node aks-aksagentpool-93648681-1 for pod ui-virtual-reader-5k1rlvxg-85d58bb647-2s7rn-edge-edge-ui-virtual-reader-yufhb7b4 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:00.984857       1 mic.go:756] Applying binding gf2-integration-demo-6xzubk9k node aks-aksagentpool-93648681-1 for pod integration-demo-109ftake-556886948-lzbjh-gf2-gf2-integration-demo-itaiivhu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:00.984894       1 mic.go:756] Applying binding gf2-merchant-s6fuxpz4 node aks-aksagentpool-93648681-1 for pod merchant-cfddi17e-589d95948d-kdnnm-gf2-gf2-merchant-uvblsift resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' 
has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:00.984938       1 mic.go:756] Applying binding gf2-ui-virtual-terminal-mxcnmlxi node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-1fdzunms-6554cffbb8-hlmmk-gf2-gf2-ui-virtual-terminal-wamyemau resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:00.984973       1 mic.go:756] Applying binding edge-ui-virtual-terminal-weq7ibfl node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-ip262zey-7d57fcfbcb-wn6vf-edge-edge-ui-virtual-terminal-hpx1n2bu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:00.985006       1 mic.go:756] Applying binding edge-ui-integration-demo-trf7to5v node aks-aksagentpool-93648681-1 for pod ui-integration-demo-kuch22sa-5588495ccc-8t772-edge-edge-ui-integration-demo-mt9e1n64 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:00.985022       1 mic.go:317] Found 29 pods, 29 ids, 29 bindings
I0814 10:23:00.985031       1 stats.go:65] ** Stats collected **
I0814 10:23:00.985035       1 stats.go:61] Pod listing: 85.6µs
I0814 10:23:00.985041       1 stats.go:61] ID listing: 12.989297ms
I0814 10:23:00.985045       1 stats.go:61] Binding listing: 14.450808ms
I0814 10:23:00.985048       1 stats.go:61] Assigned ID listing: 49.149066ms
I0814 10:23:00.985051       1 stats.go:61] System: 76.695471ms
I0814 10:23:00.985055       1 stats.go:61] Cloud provider get: 235.088051ms
I0814 10:23:00.985058       1 stats.go:61] Cloud provider put: 0s
I0814 10:23:00.985061       1 stats.go:61] Assigned ID addition: 0s
I0814 10:23:00.985064       1 stats.go:61] Assigned ID deletion: 0s
I0814 10:23:00.985068       1 stats.go:61] Find assigned ids to create: 57.4µs
I0814 10:23:00.985071       1 stats.go:61] Find assigned ids to delete: 29.1µs
I0814 10:23:00.985074       1 stats.go:61] Total time to assign or remove IDs: 294.388591ms
I0814 10:23:00.985078       1 stats.go:61] Event recording: 0s
I0814 10:23:00.985081       1 stats.go:61] Total: 372.429572ms
I0814 10:23:00.985084       1 stats.go:87] *********************
I0814 10:23:00.986062       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-integration-demo-6xzubk9k", UID:"9f75273e-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16410055", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-integration-demo-6xzubk9k node aks-aksagentpool-93648681-1 for pod integration-demo-109ftake-556886948-lzbjh-gf2-gf2-integration-demo-itaiivhu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:00.986085       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-merchant-s6fuxpz4", UID:"9ebdd790-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16410000", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-merchant-s6fuxpz4 node aks-aksagentpool-93648681-1 for pod merchant-cfddi17e-589d95948d-kdnnm-gf2-gf2-merchant-uvblsift resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:00.986113       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-ui-virtual-terminal-mxcnmlxi", UID:"9d6e4eda-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16409921", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-ui-virtual-terminal-mxcnmlxi node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-1fdzunms-6554cffbb8-hlmmk-gf2-gf2-ui-virtual-terminal-wamyemau resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:00.986125       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-virtual-terminal-weq7ibfl", UID:"556e0935-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405510", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-virtual-terminal-weq7ibfl node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-ip262zey-7d57fcfbcb-wn6vf-edge-edge-ui-virtual-terminal-hpx1n2bu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."    
I0814 10:23:00.986133       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-integration-demo-trf7to5v", UID:"56cdfb28-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405529", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-integration-demo-trf7to5v node aks-aksagentpool-93648681-1 for pod ui-integration-demo-kuch22sa-5588495ccc-8t772-edge-edge-ui-integration-demo-mt9e1n64 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."    
I0814 10:23:01.089403       1 cloudprovider.go:199] Updating user assigned MSIs on aks-aksagentpool-93648681-1
E0814 10:23:01.150767       1 vm.go:48] compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:01.150825       1 mic.go:739] Updating msis on node aks-aksagentpool-93648681-1, add [6], del [0] failed with error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original 
Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:01.325886       1 mic.go:756] Applying binding gf2-ui-virtual-terminal-mxcnmlxi node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-1fdzunms-6554cffbb8-hlmmk-gf2-gf2-ui-virtual-terminal-wamyemau resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:01.325979       1 mic.go:756] Applying binding edge-ui-integration-demo-trf7to5v node aks-aksagentpool-93648681-1 for pod ui-integration-demo-kuch22sa-5588495ccc-8t772-edge-edge-ui-integration-demo-mt9e1n64 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:01.326017       1 mic.go:756] Applying binding edge-ui-virtual-terminal-weq7ibfl node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-ip262zey-7d57fcfbcb-wn6vf-edge-edge-ui-virtual-terminal-hpx1n2bu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:01.326054       1 mic.go:756] Applying binding edge-ui-virtual-reader-hhdpd2ag node aks-aksagentpool-93648681-1 for pod ui-virtual-reader-5k1rlvxg-85d58bb647-2s7rn-edge-edge-ui-virtual-reader-yufhb7b4 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:01.326087       1 mic.go:756] Applying binding gf2-integration-demo-6xzubk9k node aks-aksagentpool-93648681-1 for pod integration-demo-109ftake-556886948-lzbjh-gf2-gf2-integration-demo-itaiivhu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:01.326118       1 mic.go:756] Applying binding gf2-merchant-s6fuxpz4 node aks-aksagentpool-93648681-1 for pod merchant-cfddi17e-589d95948d-kdnnm-gf2-gf2-merchant-uvblsift resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' 
has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:01.326159       1 mic.go:317] Found 29 pods, 29 ids, 29 bindings
I0814 10:23:01.326166       1 stats.go:65] ** Stats collected **
I0814 10:23:01.326170       1 stats.go:61] Pod listing: 51.2µs
I0814 10:23:01.326177       1 stats.go:61] ID listing: 13.894003ms
I0814 10:23:01.326181       1 stats.go:61] Binding listing: 41.470209ms
I0814 10:23:01.326184       1 stats.go:61] Assigned ID listing: 23.176773ms
I0814 10:23:01.326188       1 stats.go:61] System: 78.611085ms
I0814 10:23:01.326191       1 stats.go:61] Cloud provider get: 199.600885ms
I0814 10:23:01.326194       1 stats.go:61] Cloud provider put: 0s
I0814 10:23:01.326276       1 stats.go:61] Assigned ID addition: 0s
I0814 10:23:01.326282       1 stats.go:61] Assigned ID deletion: 0s
I0814 10:23:01.326191       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-ui-virtual-terminal-mxcnmlxi", UID:"9d6e4eda-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16409921", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-ui-virtual-terminal-mxcnmlxi node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-1fdzunms-6554cffbb8-hlmmk-gf2-gf2-ui-virtual-terminal-wamyemau resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:01.326298       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-integration-demo-trf7to5v", UID:"56cdfb28-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405529", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-integration-demo-trf7to5v node aks-aksagentpool-93648681-1 for pod ui-integration-demo-kuch22sa-5588495ccc-8t772-edge-edge-ui-integration-demo-mt9e1n64 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."    
I0814 10:23:01.326286       1 stats.go:61] Find assigned ids to create: 38µs
I0814 10:23:01.326315       1 stats.go:61] Find assigned ids to delete: 32.1µs
I0814 10:23:01.326321       1 stats.go:61] Total time to assign or remove IDs: 262.123052ms
I0814 10:23:01.326325       1 stats.go:61] Event recording: 0s
I0814 10:23:01.326328       1 stats.go:61] Total: 341.075639ms
I0814 10:23:01.326332       1 stats.go:87] *********************
I0814 10:23:01.326531       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-virtual-terminal-weq7ibfl", UID:"556e0935-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405510", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-virtual-terminal-weq7ibfl node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-ip262zey-7d57fcfbcb-wn6vf-edge-edge-ui-virtual-terminal-hpx1n2bu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."    
I0814 10:23:01.326546       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-integration-demo-6xzubk9k", UID:"9f75273e-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16410055", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-integration-demo-6xzubk9k node aks-aksagentpool-93648681-1 for pod integration-demo-109ftake-556886948-lzbjh-gf2-gf2-integration-demo-itaiivhu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:01.326556       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-virtual-reader-hhdpd2ag", UID:"55589fbb-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405508", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-virtual-reader-hhdpd2ag node aks-aksagentpool-93648681-1 for pod ui-virtual-reader-5k1rlvxg-85d58bb647-2s7rn-edge-edge-ui-virtual-reader-yufhb7b4 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:01.326565       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-merchant-s6fuxpz4", UID:"9ebdd790-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16410000", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-merchant-s6fuxpz4 node aks-aksagentpool-93648681-1 for pod merchant-cfddi17e-589d95948d-kdnnm-gf2-gf2-merchant-uvblsift resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:01.448391       1 cloudprovider.go:199] Updating user assigned MSIs on aks-aksagentpool-93648681-1
E0814 10:23:01.508368       1 vm.go:48] compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:01.508433       1 mic.go:739] Updating msis on node aks-aksagentpool-93648681-1, add [6], del [0] failed with error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original 
Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:01.673181       1 mic.go:756] Applying binding gf2-ui-virtual-terminal-mxcnmlxi node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-1fdzunms-6554cffbb8-hlmmk-gf2-gf2-ui-virtual-terminal-wamyemau resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:01.673280       1 mic.go:756] Applying binding edge-ui-virtual-terminal-weq7ibfl node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-ip262zey-7d57fcfbcb-wn6vf-edge-edge-ui-virtual-terminal-hpx1n2bu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:01.673323       1 mic.go:756] Applying binding edge-ui-integration-demo-trf7to5v node aks-aksagentpool-93648681-1 for pod ui-integration-demo-kuch22sa-5588495ccc-8t772-edge-edge-ui-integration-demo-mt9e1n64 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:01.673364       1 mic.go:756] Applying binding edge-ui-virtual-reader-hhdpd2ag node aks-aksagentpool-93648681-1 for pod ui-virtual-reader-5k1rlvxg-85d58bb647-2s7rn-edge-edge-ui-virtual-reader-yufhb7b4 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:01.673403       1 mic.go:756] Applying binding gf2-integration-demo-6xzubk9k node aks-aksagentpool-93648681-1 for pod integration-demo-109ftake-556886948-lzbjh-gf2-gf2-integration-demo-itaiivhu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:01.673442       1 mic.go:756] Applying binding gf2-merchant-s6fuxpz4 node aks-aksagentpool-93648681-1 for pod merchant-cfddi17e-589d95948d-kdnnm-gf2-gf2-merchant-uvblsift resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' 
has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:01.673461       1 mic.go:317] Found 29 pods, 29 ids, 29 bindings
I0814 10:23:01.673470       1 stats.go:65] ** Stats collected **
I0814 10:23:01.673475       1 stats.go:61] Pod listing: 52.101µs
I0814 10:23:01.673484       1 stats.go:61] ID listing: 13.482301ms
I0814 10:23:01.673488       1 stats.go:61] Binding listing: 11.350584ms
I0814 10:23:01.673492       1 stats.go:61] Assigned ID listing: 60.569651ms
I0814 10:23:01.673496       1 stats.go:61] System: 85.476137ms
I0814 10:23:01.673499       1 stats.go:61] Cloud provider get: 200.735594ms
I0814 10:23:01.673503       1 stats.go:61] Cloud provider put: 0s
I0814 10:23:01.673507       1 stats.go:61] Assigned ID addition: 0s
I0814 10:23:01.673510       1 stats.go:61] Assigned ID deletion: 0s
I0814 10:23:01.673514       1 stats.go:61] Find assigned ids to create: 31.701µs
I0814 10:23:01.673518       1 stats.go:61] Find assigned ids to delete: 27.2µs
I0814 10:23:01.673521       1 stats.go:61] Total time to assign or remove IDs: 261.313045ms
I0814 10:23:01.673525       1 stats.go:61] Event recording: 0s
I0814 10:23:01.673528       1 stats.go:61] Total: 347.130785ms
I0814 10:23:01.673532       1 stats.go:87] *********************
I0814 10:23:01.674579       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-ui-virtual-terminal-mxcnmlxi", UID:"9d6e4eda-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16409921", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-ui-virtual-terminal-mxcnmlxi node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-1fdzunms-6554cffbb8-hlmmk-gf2-gf2-ui-virtual-terminal-wamyemau resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:01.674600       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-virtual-terminal-weq7ibfl", UID:"556e0935-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405510", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-virtual-terminal-weq7ibfl node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-ip262zey-7d57fcfbcb-wn6vf-edge-edge-ui-virtual-terminal-hpx1n2bu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."    
I0814 10:23:01.674630       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-integration-demo-trf7to5v", UID:"56cdfb28-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405529", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-integration-demo-trf7to5v node aks-aksagentpool-93648681-1 for pod ui-integration-demo-kuch22sa-5588495ccc-8t772-edge-edge-ui-integration-demo-mt9e1n64 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."    
I0814 10:23:01.674643       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-virtual-reader-hhdpd2ag", UID:"55589fbb-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405508", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-virtual-reader-hhdpd2ag node aks-aksagentpool-93648681-1 for pod ui-virtual-reader-5k1rlvxg-85d58bb647-2s7rn-edge-edge-ui-virtual-reader-yufhb7b4 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:01.674667       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-integration-demo-6xzubk9k", UID:"9f75273e-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16410055", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-integration-demo-6xzubk9k node aks-aksagentpool-93648681-1 for pod integration-demo-109ftake-556886948-lzbjh-gf2-gf2-integration-demo-itaiivhu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:01.674676       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-merchant-s6fuxpz4", UID:"9ebdd790-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16410000", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-merchant-s6fuxpz4 node aks-aksagentpool-93648681-1 for pod merchant-cfddi17e-589d95948d-kdnnm-gf2-gf2-merchant-uvblsift resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:02.055149       1 cloudprovider.go:199] Updating user assigned MSIs on aks-aksagentpool-93648681-1
E0814 10:23:02.114152       1 vm.go:48] compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:02.114263       1 mic.go:739] Updating msis on node aks-aksagentpool-93648681-1, add [6], del [0] failed with error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original 
Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:02.172534       1 mic.go:756] Applying binding gf2-ui-virtual-terminal-mxcnmlxi node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-1fdzunms-6554cffbb8-hlmmk-gf2-gf2-ui-virtual-terminal-wamyemau resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:02.172585       1 mic.go:756] Applying binding edge-ui-integration-demo-trf7to5v node aks-aksagentpool-93648681-1 for pod ui-integration-demo-kuch22sa-5588495ccc-8t772-edge-edge-ui-integration-demo-mt9e1n64 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:02.173628       1 mic.go:756] Applying binding edge-ui-virtual-terminal-weq7ibfl node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-ip262zey-7d57fcfbcb-wn6vf-edge-edge-ui-virtual-terminal-hpx1n2bu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:02.174109       1 mic.go:756] Applying binding edge-ui-virtual-reader-hhdpd2ag node aks-aksagentpool-93648681-1 for pod ui-virtual-reader-5k1rlvxg-85d58bb647-2s7rn-edge-edge-ui-virtual-reader-yufhb7b4 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:02.174582       1 mic.go:756] Applying binding gf2-integration-demo-6xzubk9k node aks-aksagentpool-93648681-1 for pod integration-demo-109ftake-556886948-lzbjh-gf2-gf2-integration-demo-itaiivhu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:02.175027       1 mic.go:756] Applying binding gf2-merchant-s6fuxpz4 node aks-aksagentpool-93648681-1 for pod merchant-cfddi17e-589d95948d-kdnnm-gf2-gf2-merchant-uvblsift resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' 
has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:02.175085       1 mic.go:317] Found 29 pods, 29 ids, 29 bindings
I0814 10:23:02.175128       1 stats.go:65] ** Stats collected **
I0814 10:23:02.176067       1 stats.go:61] Pod listing: 55.801µs
I0814 10:23:02.176112       1 stats.go:61] ID listing: 102.188661ms
I0814 10:23:02.176127       1 stats.go:61] Binding listing: 18.378936ms
I0814 10:23:02.176138       1 stats.go:61] Assigned ID listing: 203.996119ms
I0814 10:23:02.176149       1 stats.go:61] System: 324.638517ms
I0814 10:23:02.176184       1 stats.go:61] Cloud provider get: 113.612447ms
I0814 10:23:02.176205       1 stats.go:61] Cloud provider put: 0s
I0814 10:23:02.176388       1 stats.go:61] Assigned ID addition: 0s
I0814 10:23:02.177194       1 stats.go:61] Assigned ID deletion: 0s
I0814 10:23:02.177310       1 stats.go:61] Find assigned ids to create: 71.9µs
I0814 10:23:02.177340       1 stats.go:61] Find assigned ids to delete: 83.601µs
I0814 10:23:02.177355       1 stats.go:61] Total time to assign or remove IDs: 176.291212ms
I0814 10:23:02.177388       1 stats.go:61] Event recording: 0s
I0814 10:23:02.177412       1 stats.go:61] Total: 501.587934ms
I0814 10:23:02.177427       1 stats.go:87] *********************
I0814 10:23:02.178506       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-ui-virtual-terminal-mxcnmlxi", UID:"9d6e4eda-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16409921", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-ui-virtual-terminal-mxcnmlxi node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-1fdzunms-6554cffbb8-hlmmk-gf2-gf2-ui-virtual-terminal-wamyemau resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:02.178573       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-integration-demo-trf7to5v", UID:"56cdfb28-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405529", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-integration-demo-trf7to5v node aks-aksagentpool-93648681-1 for pod ui-integration-demo-kuch22sa-5588495ccc-8t772-edge-edge-ui-integration-demo-mt9e1n64 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."    
I0814 10:23:02.178603       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-virtual-terminal-weq7ibfl", UID:"556e0935-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405510", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-virtual-terminal-weq7ibfl node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-ip262zey-7d57fcfbcb-wn6vf-edge-edge-ui-virtual-terminal-hpx1n2bu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."    
I0814 10:23:02.178667       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-virtual-reader-hhdpd2ag", UID:"55589fbb-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405508", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-virtual-reader-hhdpd2ag node aks-aksagentpool-93648681-1 for pod ui-virtual-reader-5k1rlvxg-85d58bb647-2s7rn-edge-edge-ui-virtual-reader-yufhb7b4 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:02.178740       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-integration-demo-6xzubk9k", UID:"9f75273e-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16410055", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-integration-demo-6xzubk9k node aks-aksagentpool-93648681-1 for pod integration-demo-109ftake-556886948-lzbjh-gf2-gf2-integration-demo-itaiivhu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:02.178768       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-merchant-s6fuxpz4", UID:"9ebdd790-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16410000", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-merchant-s6fuxpz4 node aks-aksagentpool-93648681-1 for pod merchant-cfddi17e-589d95948d-kdnnm-gf2-gf2-merchant-uvblsift resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:02.658206       1 cloudprovider.go:199] Updating user assigned MSIs on aks-aksagentpool-93648681-1
E0814 10:23:02.680765       1 vm.go:48] compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:02.680827       1 mic.go:739] Updating msis on node aks-aksagentpool-93648681-1, add [6], del [0] failed with error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original 
Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:02.920189       1 mic.go:756] Applying binding edge-ui-integration-demo-trf7to5v node aks-aksagentpool-93648681-1 for pod ui-integration-demo-kuch22sa-5588495ccc-8t772-edge-edge-ui-integration-demo-mt9e1n64 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:02.920293       1 mic.go:756] Applying binding edge-ui-virtual-terminal-weq7ibfl node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-ip262zey-7d57fcfbcb-wn6vf-edge-edge-ui-virtual-terminal-hpx1n2bu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:02.920329       1 mic.go:756] Applying binding edge-ui-virtual-reader-hhdpd2ag node aks-aksagentpool-93648681-1 for pod ui-virtual-reader-5k1rlvxg-85d58bb647-2s7rn-edge-edge-ui-virtual-reader-yufhb7b4 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:02.920437       1 mic.go:756] Applying binding gf2-integration-demo-6xzubk9k node aks-aksagentpool-93648681-1 for pod integration-demo-109ftake-556886948-lzbjh-gf2-gf2-integration-demo-itaiivhu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:02.920494       1 mic.go:756] Applying binding gf2-merchant-s6fuxpz4 node aks-aksagentpool-93648681-1 for pod merchant-cfddi17e-589d95948d-kdnnm-gf2-gf2-merchant-uvblsift resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' 
has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:02.920530       1 mic.go:756] Applying binding gf2-ui-virtual-terminal-mxcnmlxi node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-1fdzunms-6554cffbb8-hlmmk-gf2-gf2-ui-virtual-terminal-wamyemau resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:02.920543       1 mic.go:317] Found 29 pods, 29 ids, 29 bindings
I0814 10:23:02.920550       1 stats.go:65] ** Stats collected **
I0814 10:23:02.920554       1 stats.go:61] Pod listing: 74.5µs
I0814 10:23:02.920565       1 stats.go:61] ID listing: 214.456696ms
I0814 10:23:02.920569       1 stats.go:61] Binding listing: 22.922971ms
I0814 10:23:02.920573       1 stats.go:61] Assigned ID listing: 196.069259ms
I0814 10:23:02.920576       1 stats.go:61] System: 433.542427ms
I0814 10:23:02.920580       1 stats.go:61] Cloud provider get: 285.958629ms
I0814 10:23:02.920583       1 stats.go:61] Cloud provider put: 0s
I0814 10:23:02.920587       1 stats.go:61] Assigned ID addition: 0s
I0814 10:23:02.920590       1 stats.go:61] Assigned ID deletion: 0s
I0814 10:23:02.920594       1 stats.go:61] Find assigned ids to create: 29.001µs
I0814 10:23:02.920598       1 stats.go:61] Find assigned ids to delete: 24.1µs
I0814 10:23:02.920602       1 stats.go:61] Total time to assign or remove IDs: 309.314103ms
I0814 10:23:02.920606       1 stats.go:61] Event recording: 0s
I0814 10:23:02.920610       1 stats.go:61] Total: 743.105332ms
I0814 10:23:02.920614       1 stats.go:87] *********************
I0814 10:23:02.922402       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-integration-demo-trf7to5v", UID:"56cdfb28-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405529", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-integration-demo-trf7to5v node aks-aksagentpool-93648681-1 for pod ui-integration-demo-kuch22sa-5588495ccc-8t772-edge-edge-ui-integration-demo-mt9e1n64 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."    
I0814 10:23:02.922557       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-virtual-terminal-weq7ibfl", UID:"556e0935-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405510", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-virtual-terminal-weq7ibfl node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-ip262zey-7d57fcfbcb-wn6vf-edge-edge-ui-virtual-terminal-hpx1n2bu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."    
I0814 10:23:02.922772       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-virtual-reader-hhdpd2ag", UID:"55589fbb-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405508", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-virtual-reader-hhdpd2ag node aks-aksagentpool-93648681-1 for pod ui-virtual-reader-5k1rlvxg-85d58bb647-2s7rn-edge-edge-ui-virtual-reader-yufhb7b4 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:02.922916       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-integration-demo-6xzubk9k", UID:"9f75273e-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16410055", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-integration-demo-6xzubk9k node aks-aksagentpool-93648681-1 for pod integration-demo-109ftake-556886948-lzbjh-gf2-gf2-integration-demo-itaiivhu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:02.923025       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-merchant-s6fuxpz4", UID:"9ebdd790-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16410000", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-merchant-s6fuxpz4 node aks-aksagentpool-93648681-1 for pod merchant-cfddi17e-589d95948d-kdnnm-gf2-gf2-merchant-uvblsift resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:02.926239       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-ui-virtual-terminal-mxcnmlxi", UID:"9d6e4eda-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16409921", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-ui-virtual-terminal-mxcnmlxi node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-1fdzunms-6554cffbb8-hlmmk-gf2-gf2-ui-virtual-terminal-wamyemau resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:03.228589       1 cloudprovider.go:199] Updating user assigned MSIs on aks-aksagentpool-93648681-1
E0814 10:23:03.292631       1 vm.go:48] compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:03.292720       1 mic.go:739] Updating msis on node aks-aksagentpool-93648681-1, add [6], del [0] failed with error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original 
Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:03.430509       1 mic.go:756] Applying binding gf2-ui-virtual-terminal-mxcnmlxi node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-1fdzunms-6554cffbb8-hlmmk-gf2-gf2-ui-virtual-terminal-wamyemau resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:03.430643       1 mic.go:756] Applying binding edge-ui-virtual-terminal-weq7ibfl node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-ip262zey-7d57fcfbcb-wn6vf-edge-edge-ui-virtual-terminal-hpx1n2bu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:03.431844       1 mic.go:756] Applying binding edge-ui-integration-demo-trf7to5v node aks-aksagentpool-93648681-1 for pod ui-integration-demo-kuch22sa-5588495ccc-8t772-edge-edge-ui-integration-demo-mt9e1n64 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:03.431904       1 mic.go:756] Applying binding edge-ui-virtual-reader-hhdpd2ag node aks-aksagentpool-93648681-1 for pod ui-virtual-reader-5k1rlvxg-85d58bb647-2s7rn-edge-edge-ui-virtual-reader-yufhb7b4 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:03.431938       1 mic.go:756] Applying binding gf2-integration-demo-6xzubk9k node aks-aksagentpool-93648681-1 for pod integration-demo-109ftake-556886948-lzbjh-gf2-gf2-integration-demo-itaiivhu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:03.431990       1 mic.go:756] Applying binding gf2-merchant-s6fuxpz4 node aks-aksagentpool-93648681-1 for pod merchant-cfddi17e-589d95948d-kdnnm-gf2-gf2-merchant-uvblsift resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' 
has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:03.432005       1 mic.go:317] Found 29 pods, 29 ids, 29 bindings
I0814 10:23:03.432012       1 stats.go:65] ** Stats collected **
I0814 10:23:03.432016       1 stats.go:61] Pod listing: 162.501µs
I0814 10:23:03.432250       1 stats.go:61] ID listing: 54.924709ms
I0814 10:23:03.432386       1 stats.go:61] Binding listing: 12.394192ms
I0814 10:23:03.432390       1 stats.go:61] Assigned ID listing: 211.649676ms
I0814 10:23:03.432394       1 stats.go:61] System: 279.151078ms
I0814 10:23:03.432397       1 stats.go:61] Cloud provider get: 163.803719ms
I0814 10:23:03.432401       1 stats.go:61] Cloud provider put: 0s
I0814 10:23:03.432404       1 stats.go:61] Assigned ID addition: 0s
I0814 10:23:03.432408       1 stats.go:61] Assigned ID deletion: 0s
I0814 10:23:03.432411       1 stats.go:61] Find assigned ids to create: 34.4µs
I0814 10:23:03.432415       1 stats.go:61] Find assigned ids to delete: 46.701µs
I0814 10:23:03.432419       1 stats.go:61] Total time to assign or remove IDs: 231.919827ms
I0814 10:23:03.432422       1 stats.go:61] Event recording: 0s
I0814 10:23:03.432426       1 stats.go:61] Total: 511.391007ms
I0814 10:23:03.432429       1 stats.go:87] *********************
I0814 10:23:03.432728       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-ui-virtual-terminal-mxcnmlxi", UID:"9d6e4eda-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16409921", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-ui-virtual-terminal-mxcnmlxi node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-1fdzunms-6554cffbb8-hlmmk-gf2-gf2-ui-virtual-terminal-wamyemau resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:03.432749       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-virtual-terminal-weq7ibfl", UID:"556e0935-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405510", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-virtual-terminal-weq7ibfl node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-ip262zey-7d57fcfbcb-wn6vf-edge-edge-ui-virtual-terminal-hpx1n2bu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."    
I0814 10:23:03.433068       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-integration-demo-trf7to5v", UID:"56cdfb28-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405529", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-integration-demo-trf7to5v node aks-aksagentpool-93648681-1 for pod ui-integration-demo-kuch22sa-5588495ccc-8t772-edge-edge-ui-integration-demo-mt9e1n64 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."    
I0814 10:23:03.433088       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-virtual-reader-hhdpd2ag", UID:"55589fbb-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405508", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-virtual-reader-hhdpd2ag node aks-aksagentpool-93648681-1 for pod ui-virtual-reader-5k1rlvxg-85d58bb647-2s7rn-edge-edge-ui-virtual-reader-yufhb7b4 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:03.433098       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-integration-demo-6xzubk9k", UID:"9f75273e-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16410055", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-integration-demo-6xzubk9k node aks-aksagentpool-93648681-1 for pod integration-demo-109ftake-556886948-lzbjh-gf2-gf2-integration-demo-itaiivhu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:03.433109       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-merchant-s6fuxpz4", UID:"9ebdd790-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16410000", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-merchant-s6fuxpz4 node aks-aksagentpool-93648681-1 for pod merchant-cfddi17e-589d95948d-kdnnm-gf2-gf2-merchant-uvblsift resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:03.836582       1 cloudprovider.go:199] Updating user assigned MSIs on aks-aksagentpool-93648681-1
E0814 10:23:03.897646       1 vm.go:48] compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:03.897704       1 mic.go:739] Updating msis on node aks-aksagentpool-93648681-1, add [6], del [0] failed with error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original 
Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:04.037913       1 mic.go:756] Applying binding edge-ui-virtual-terminal-weq7ibfl node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-ip262zey-7d57fcfbcb-wn6vf-edge-edge-ui-virtual-terminal-hpx1n2bu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:04.037968       1 mic.go:756] Applying binding edge-ui-integration-demo-trf7to5v node aks-aksagentpool-93648681-1 for pod ui-integration-demo-kuch22sa-5588495ccc-8t772-edge-edge-ui-integration-demo-mt9e1n64 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:04.038006       1 mic.go:756] Applying binding edge-ui-virtual-reader-hhdpd2ag node aks-aksagentpool-93648681-1 for pod ui-virtual-reader-5k1rlvxg-85d58bb647-2s7rn-edge-edge-ui-virtual-reader-yufhb7b4 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:04.038056       1 mic.go:756] Applying binding gf2-integration-demo-6xzubk9k node aks-aksagentpool-93648681-1 for pod integration-demo-109ftake-556886948-lzbjh-gf2-gf2-integration-demo-itaiivhu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:04.038092       1 mic.go:756] Applying binding gf2-merchant-s6fuxpz4 node aks-aksagentpool-93648681-1 for pod merchant-cfddi17e-589d95948d-kdnnm-gf2-gf2-merchant-uvblsift resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' 
has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:04.038146       1 mic.go:756] Applying binding gf2-ui-virtual-terminal-mxcnmlxi node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-1fdzunms-6554cffbb8-hlmmk-gf2-gf2-ui-virtual-terminal-wamyemau resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:04.038159       1 mic.go:317] Found 29 pods, 29 ids, 29 bindings
I0814 10:23:04.038165       1 stats.go:65] ** Stats collected **
I0814 10:23:04.038169       1 stats.go:61] Pod listing: 71.001µs
I0814 10:23:04.038175       1 stats.go:61] ID listing: 142.186558ms
I0814 10:23:04.038179       1 stats.go:61] Binding listing: 10.618879ms
I0814 10:23:04.038183       1 stats.go:61] Assigned ID listing: 206.592139ms
I0814 10:23:04.038186       1 stats.go:61] System: 359.487877ms
I0814 10:23:04.038189       1 stats.go:61] Cloud provider get: 166.599541ms
I0814 10:23:04.038193       1 stats.go:61] Cloud provider put: 0s
I0814 10:23:04.038196       1 stats.go:61] Assigned ID addition: 0s
I0814 10:23:04.038199       1 stats.go:61] Assigned ID deletion: 0s
I0814 10:23:04.038203       1 stats.go:61] Find assigned ids to create: 98.001µs
I0814 10:23:04.038206       1 stats.go:61] Find assigned ids to delete: 131.501µs
I0814 10:23:04.038209       1 stats.go:61] Total time to assign or remove IDs: 228.3011ms
I0814 10:23:04.038213       1 stats.go:61] Event recording: 0s
I0814 10:23:04.038216       1 stats.go:61] Total: 605.72891ms
I0814 10:23:04.038220       1 stats.go:87] *********************
I0814 10:23:04.038239       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-virtual-terminal-weq7ibfl", UID:"556e0935-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405510", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-virtual-terminal-weq7ibfl node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-ip262zey-7d57fcfbcb-wn6vf-edge-edge-ui-virtual-terminal-hpx1n2bu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."    
I0814 10:23:04.038480       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-integration-demo-6xzubk9k", UID:"9f75273e-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16410055", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-integration-demo-6xzubk9k node aks-aksagentpool-93648681-1 for pod integration-demo-109ftake-556886948-lzbjh-gf2-gf2-integration-demo-itaiivhu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:04.038500       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-merchant-s6fuxpz4", UID:"9ebdd790-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16410000", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-merchant-s6fuxpz4 node aks-aksagentpool-93648681-1 for pod merchant-cfddi17e-589d95948d-kdnnm-gf2-gf2-merchant-uvblsift resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:04.038511       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-ui-virtual-terminal-mxcnmlxi", UID:"9d6e4eda-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16409921", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-ui-virtual-terminal-mxcnmlxi node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-1fdzunms-6554cffbb8-hlmmk-gf2-gf2-ui-virtual-terminal-wamyemau resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:04.038577       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-virtual-reader-hhdpd2ag", UID:"55589fbb-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405508", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-virtual-reader-hhdpd2ag node aks-aksagentpool-93648681-1 for pod ui-virtual-reader-5k1rlvxg-85d58bb647-2s7rn-edge-edge-ui-virtual-reader-yufhb7b4 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:04.038587       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-integration-demo-trf7to5v", UID:"56cdfb28-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405529", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-integration-demo-trf7to5v node aks-aksagentpool-93648681-1 for pod ui-integration-demo-kuch22sa-5588495ccc-8t772-edge-edge-ui-integration-demo-mt9e1n64 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."    
I0814 10:23:04.453448       1 cloudprovider.go:199] Updating user assigned MSIs on aks-aksagentpool-93648681-1
E0814 10:23:04.515365       1 vm.go:48] compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:04.515422       1 mic.go:739] Updating msis on node aks-aksagentpool-93648681-1, add [6], del [0] failed with error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original 
Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:04.579399       1 mic.go:756] Applying binding gf2-merchant-s6fuxpz4 node aks-aksagentpool-93648681-1 for pod merchant-cfddi17e-589d95948d-kdnnm-gf2-gf2-merchant-uvblsift resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' 
has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:04.582960       1 mic.go:756] Applying binding gf2-ui-virtual-terminal-mxcnmlxi node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-1fdzunms-6554cffbb8-hlmmk-gf2-gf2-ui-virtual-terminal-wamyemau resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:04.585593       1 mic.go:756] Applying binding edge-ui-integration-demo-trf7to5v node aks-aksagentpool-93648681-1 for pod ui-integration-demo-kuch22sa-5588495ccc-8t772-edge-edge-ui-integration-demo-mt9e1n64 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:04.588641       1 mic.go:756] Applying binding edge-ui-virtual-terminal-weq7ibfl node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-ip262zey-7d57fcfbcb-wn6vf-edge-edge-ui-virtual-terminal-hpx1n2bu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:04.588757       1 mic.go:756] Applying binding edge-ui-virtual-reader-hhdpd2ag node aks-aksagentpool-93648681-1 for pod ui-virtual-reader-5k1rlvxg-85d58bb647-2s7rn-edge-edge-ui-virtual-reader-yufhb7b4 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
E0814 10:23:04.588798       1 mic.go:756] Applying binding gf2-integration-demo-6xzubk9k node aks-aksagentpool-93648681-1 for pod integration-demo-109ftake-556886948-lzbjh-gf2-gf2-integration-demo-itaiivhu resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:04.597580       1 mic.go:317] Found 29 pods, 29 ids, 29 bindings
I0814 10:23:04.598169       1 stats.go:65] ** Stats collected **
I0814 10:23:04.602346       1 stats.go:61] Pod listing: 55.501µs
I0814 10:23:04.602362       1 stats.go:61] ID listing: 131.431079ms
I0814 10:23:04.602367       1 stats.go:61] Binding listing: 14.81721ms
I0814 10:23:04.602379       1 stats.go:61] Assigned ID listing: 232.040827ms
I0814 10:23:04.602383       1 stats.go:61] System: 378.365617ms
I0814 10:23:04.602387       1 stats.go:61] Cloud provider get: 100.278047ms
I0814 10:23:04.602391       1 stats.go:61] Cloud provider put: 0s
I0814 10:23:04.602395       1 stats.go:61] Assigned ID addition: 0s
I0814 10:23:04.602398       1 stats.go:61] Assigned ID deletion: 0s
I0814 10:23:04.602414       1 stats.go:61] Find assigned ids to create: 39µs
I0814 10:23:04.602418       1 stats.go:61] Find assigned ids to delete: 32.9µs
I0814 10:23:04.602422       1 stats.go:61] Total time to assign or remove IDs: 171.92078ms
I0814 10:23:04.602426       1 stats.go:61] Event recording: 0s
I0814 10:23:04.602430       1 stats.go:61] Total: 559.938369ms
I0814 10:23:04.602438       1 stats.go:87] *********************
I0814 10:23:04.607877       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-merchant-s6fuxpz4", UID:"9ebdd790-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16410000", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-merchant-s6fuxpz4 node aks-aksagentpool-93648681-1 for pod merchant-cfddi17e-589d95948d-kdnnm-gf2-gf2-merchant-uvblsift resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:04.611536       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"gf2", Name:"gf2-ui-virtual-terminal-mxcnmlxi", UID:"9d6e4eda-bdf4-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16409921", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding gf2-ui-virtual-terminal-mxcnmlxi node aks-aksagentpool-93648681-1 for pod ui-virtual-terminal-1fdzunms-6554cffbb8-hlmmk-gf2-gf2-ui-virtual-terminal-wamyemau resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."
I0814 10:23:04.614095       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-integration-demo-trf7to5v", UID:"56cdfb28-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405529", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-integration-demo-trf7to5v node aks-aksagentpool-93648681-1 for pod ui-integration-demo-kuch22sa-5588495ccc-8t772-edge-edge-ui-integration-demo-mt9e1n64 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."    
I0814 10:23:04.615156       1 event.go:218] Event(v1.ObjectReference{Kind:"AzureIdentityBinding", Namespace:"edge", Name:"edge-ui-virtual-reader-hhdpd2ag", UID:"55589fbb-bdf1-11e9-a384-0a58ac1f0fbd", APIVersion:"aadpodidentity.k8s.io/v1", ResourceVersion:"16405508", FieldPath:""}): type: 'Warning' reason: 'binding apply error' Applying binding edge-ui-virtual-reader-hhdpd2ag node aks-aksagentpool-93648681-1 for pod ui-virtual-reader-5k1rlvxg-85d58bb647-2s7rn-edge-edge-ui-virtual-reader-yufhb7b4 resulted in error compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client 'c19fdd7d-d886-43db-9b9d-79707476d00b' with object id 'c19fdd7d-d886-43db-9b9d-79707476d00b' has permission to perform action 'Microsoft.Compute/virtualMachines/write' on scope '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourceGroups/MC_dev1_dev1_westeurope/providers/Microsoft.Compute/virtualMachines/aks-aksagentpool-93648681-1'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy' or the linked scope(s) are invalid."

```

[oliverholliday]

We've updated aad-pod-identity and restarted all the mic/nmi pods. We've also done "delete --all azureidentities,azureidentitybindings,azureassignedidentites" and recreated them but nothing will make it forget about the non-existent identities.

We're using the FORCENAMESPACE env flag, not sure if that's related.

The identities below no longer exist (were deleted 2 days ago).

```
however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '

/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-terminal,

/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-payment-gateway,

/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/oc1-reader-cryptography,

/subscriptions/z3e25af1-1285-4dfb-76279ea330dd/resourcegroups/dev1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aad-auth-proxy

' or the linked scope(s) are invalid."

[aramase]

It's possible the identity delete failed when it was tried the first time. With mic:1.3, the identity deletion was only tried once and never retried. So in case the identity removal from the node failed, it would have left the identity behind on the node. The way MIC assigns/removes identity from the node is by getting the entire list of identities that's currently on the node and , adding/removing required and updating the entire list. So in the scenario where a new pod is created with new identity, we get the entire list which contains the old un-removed identities, add the new identity to that list and try to publish which fails because the identity no longer exists in Azure. To handle such scenarios where an identity is left behind when no longer required, we have introduced states in assigned identity and process based on states. This means if the identity removal failed with mic:1.5.1, we will not remove the assigned identity. Instead we will keep the assigned identity behind and retry the identity removal from the node.

I would recommend not deleting the AzureAssignedIdentity as we use that for tracking the identities that are assigned/need to be removed from node. The MIC will delete the assigned identity once the identity has been successfully removed from the node. I think in your scenario, since we don't have the assigned identities to track anymore, the old identities will need to be manually removed by az vm identity remove -g <resource group> -n <node name> --identities <identity name>

[kkmsft]

Please ignore my comments above (deleted). Please follow the instructions from @aramase above.

[oliverholliday]

Thanks a lot guys that's definitely done the trick!

Everything's back in working order now.

I wrote a little script to clean up after hitting this, below in case it helps anybody.

# loops through all virtual machines in the specified subscription, retrieves all the bound identities and checks to see if they exist
param(
    [string]$Subscription, # the subscription to enumerate all VMs in
    [switch]$RemoveMissing = $False, # will remove the identity binding from the vm if it doesn't exist
    [switch]$ShowAll = $False # print details of identities that do exist
)

# loop through all the vms in this subscription
$vms = (az vm list --subscription $Subscription --query "[].{id: id, name: name, resourceGroup: resourceGroup, identities: identity.userAssignedIdentities}") | ConvertFrom-Json -AsHashtable
$vms | ForEach-Object { 
    Write-Host -ForegroundColor "Yellow" "Processing VM $($_.resourceGroup)/$($_.name)"

    # loop through each of the userAssignedIdentities
    foreach ($identityId in $_.identities.Keys) {

        # attempt to query the identity by its id
        $identity = (az identity show --ids $identityId --query "{name: name, resourceGroup: resourceGroup, clientId: clientId}" 2>null) | ConvertFrom-Json

        if ($LASTEXITCODE) {
            Write-Host -ForegroundColor "DarkRed" "$($identityId) was not found"
            if ($RemoveMissing) {
                Write-Host "Attempting to delete due to -RemoveMissing switch..."
                az vm identity remove --ids $_.id --identities $identityId | Out-Null
                if ($LASTEXITCODE) {
                    Write-Host -ForegroundColor "DarkRed" "Couldn't remove identity, command failed"
                    Write-Host -ForegroundColor "DarkRed" "az vm identity remove --ids $($_.id) --identities $($identityId)"
                }
                else {
                    Write-Host -ForegroundColor "Green" "Identity removed!"
                }
            }
        }
        else {
            if ($ShowAll) {
                Write-Host -ForegroundColor "Green" "$($identity.resourceGroup)/$($identity.name) exists"
            }
        }
    }
}

[aramase]

@oliverholliday That's great. The next time you see any issues where MIC fails to remove the identity, please let us know. We can take a look at the logs to see what's happening. Like I mentioned before with 1.5 release, we have added states to AzureAssignedIdentity and if there is an error we retry to assign/unassign from node until we succeed.

Thank you for trying out aad-pod-identity. I'm closing this issue now. Please reopen if you hit any issue.

[oliverholliday]

We've since moved to using VMSS for AKS and this same bug has re-surfaced - aad-pod-identity on our cluster was sat unable to bind any pod identities because Azure was throwing the same error as above.

Logs from MIC showed it was attempting to bind lots of things at once, but some of them were invalid.

mic E0720 15:43:58.683557 1 mic.go:848] Applying binding test2-crypto-9sqpei8f node aks-aksagentpool-34621003-vmss000000 for pod test2-reader-dzyy0hyg-7b6cfdbf9c-r5xpp-test2-test2-crypto-6bql77oc resulted in error compute.VirtualMachineScaleSetsClient#CreateOrUp │
│ date: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client '9b0884b9-a85e-48b6-86df-d535470a7655' with object id '9b0884b9-a85e-48b6-86df-d535470a7655' has permission to perform action 'Microsoft.Compute/virtualMachineScaleSets/write' on scope '/subscriptions/1285-4dfb-8c78-76279ea330dd/resourceGroups/MC_deveu_deveu2_westeurope/providers/Microsoft.Compute/virtualMachineScaleSets/aks-aksagentpool-34621003-vmss'; however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/e3e25af1-1285-4dfb-8c78-76279ea330dd/resourcegroups/deveu/providers/Microsoft.ManagedIdentity/userAssignedIdentities/test3-reader,/subscriptions/e3e25af1
<snip>

The identity test3-reader no longer exists at all, and in the output for az vmss show I could see all the old identities were still bound but invalid:

        "/subscriptions/1285-4dfb-8c78-76279ea330dd/resourcegroups/deveu/providers/Microsoft.ManagedIdentity/userAssignedIdentities/test3-reader": {
          "clientId": null,
          "principalId": null
        },