Aad-pod-identity: Attempting to use an managed identity created in a different subscription from the cluster subscription fails.

[jozamp]

Describe the bug

Attempting to use an managed identity created in a different subscription from the cluster subscription returns an error;

Resource group _[valid resource group]_ could not be found.

Steps To Reproduce
1) create a pod identity enabled aks cluster in subscription (A)
2) create a managed identity in subscription (B)
3) attempt to bind the managed identity to a namespace using;
az aks pod-identity add [...] --identity-resource-id [msi_id]

Expected behavior
The binding should succeed.

AAD Pod Identity version

{
  "azure-cli": "2.20.0",
  "azure-cli-core": "2.20.0",
  "azure-cli-telemetry": "1.0.6",
  "extensions": {
    "aks-preview": "0.5.5"
  }
}

Kubernetes version
v1.18.14
Additional context

It appears this is controlled github.com\azure-cli-extensions\src\aks-preview\azext_aks_preview\custom.py : ln594

def _get_user_assigned_identity(cli_ctx, resource_id):
    msi_client = get_msi_client(cli_ctx)
    resource_id = resource_id.lower()
    match = _re_user_assigned_identity_resource_id.search(resource_id)
    if match:
        resource_group_name = match.group(2)
        identity_name = match.group(3)
        try:
            identity = msi_client.user_assigned_identities.get(resource_group_name=resource_group_name,
                                                               resource_name=identity_name)

Could be possibly be changed to;

def _get_user_assigned_identity(cli_ctx, resource_id):
    resource_id = resource_id.lower()
    match = _re_user_assigned_identity_resource_id.search(resource_id)
    if match:
        subscription_id = match.group(1)
        resource_group_name = match.group(2)
        identity_name = match.group(3)
        msi_client = get_msi_client(cli_ctx, subscription_id)
        try:
            identity = msi_client.user_assigned_identities.get(resource_group_name=resource_group_name,
                                                               resource_name=identity_name)

and; github.com\azure-cli-extensions\src\aks-preview\azext_aks_preview\_client_factory.py : ln121

def get_msi_client(cli_ctx, **_):
    return get_mgmt_service_client(cli_ctx, ManagedServiceIdentityClient)

to;

def get_msi_client(cli_ctx, subscription_id=None):
    return get_mgmt_service_client(cli_ctx, ManagedServiceIdentityClient, subscription_id=subscription_id)

in order to support this behavior - this has only been smoke tested, but I was able to bind the identity to the namespace with these changes.

[jawhites]

@palma21 who can we work with in AKS to review this bug?

[aramase]

@bcho @miwithro Could you help take a look?

[bcho]

Ack. Thanks for the report and suggestions @jawhites I will take a look today

[bcho]

I just checked the cli extension, it has been fixed in 0.5.6 (https://github.com/Azure/azure-cli-extensions/pull/3149) . @jozamp @jawhites could you update and try again? I tested in my local environment and it worked. Thanks!

[jozamp]

Great to hear! Though I don't see 0.5.6 available in the available extension list - what am I missing?

az extension list-available | sls "aks-preview" -Context 4

    },
    {
      "experimental": false,
      "installed": true,
>     "name": "aks-preview",
      "preview": true,
      "summary": "Provides a preview for upcoming AKS features",
      "version": "0.5.5"
    },

[bcho]

@jozamp sorry for my delayed response, could you see the 0.5.6 release now? Here is my output:

 az extension list-available  | grep "aks-preview" -B 5 -A 5
    "version": "0.2.5"
  },
  {
    "experimental": false,
    "installed": false,
    "name": "aks-preview",
    "preview": true,
    "summary": "Provides a preview for upcoming AKS features",
    "version": "0.5.6"
  },

[jozamp]

@jozamp sorry for my delayed response, could you see the 0.5.6 release now? Here is my output:

 az extension list-available  | grep "aks-preview" -B 5 -A 5
    "version": "0.2.5"
  },
  {
    "experimental": false,
    "installed": false,
    "name": "aks-preview",
    "preview": true,
    "summary": "Provides a preview for upcoming AKS features",
    "version": "0.5.6"
  },

Yes, was able to install 0.5.6. Thanks!