Azure-docs: Do I need to grant system identity permission to vnet again?

[feiyushi]

I have created a cluster with an existing vnet and system identity enabled and there's no error. After checking the vnet activity history, I saw that AKS first party service principal join the cluster nodes to the vnet without using system identity.

My question is since it's joined already, do we still need to grant system identity permissions to vnet? Same goes to public ip which is used as load balancer outbount ip.

Thanks,

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 6a9c74a8-9f1a-3d3d-3aed-f8ec45f92e05
• Version Independent ID: 01e98043-dc80-490e-a761-8d558ff4e6df
• Content: Use managed identities in Azure Kubernetes Service - Azure Kubernetes Service
• Content Source: articles/aks/use-managed-identity.md
• Service: container-service
• GitHub Login: @mlearned
• Microsoft Alias: mlearned

[MonikaReddy-MSFT]

@feiyushi - Thanks for brining this to our attention. We will investigate it further and update you shortly.

[Karishma-Tiwari-MSFT]

Apologize on the delay. Are you trying to bring your own control plane managed identity?
A custom control plane identity enables access to be granted to the existing identity prior to cluster creation. This enables scenarios such as using an custom VNET or outboundType of UDR with a managed identity.
Please let me know.

For creating and using your own VNet, static IP address, or attached Azure disk where the resources are outside of the worker node resource group, use the PrincipalID of the cluster System Assigned Managed Identity to perform a role assignment. For more information on role assignment, see Delegate access to other Azure resources.

If the custom vnet resides outside of MC_ resource group, you must manually grant needed permission to the system assigned identity associated with the cluster. That’s because AKS resource provider can’t grant any permission outside of MC_ resource group.

[feiyushi]

Apologize on the delay. Are you trying to bring your own control plane managed identity?
A custom control plane identity enables access to be granted to the existing identity prior to cluster creation. This enables scenarios such as using an custom VNET or outboundType of UDR with a managed identity.
Please let me know.

For creating and using your own VNet, static IP address, or attached Azure disk where the resources are outside of the worker node resource group, use the PrincipalID of the cluster System Assigned Managed Identity to perform a role assignment. For more information on role assignment, see Delegate access to other Azure resources.

If the custom vnet resides outside of MC_ resource group, you must manually grant needed permission to the system assigned identity associated with the cluster. That’s because AKS resource provider can’t grant any permission outside of MC_ resource group.

It's not about the bring your own control plane managed identity, but about system assigned identity.
As you mentioned and in the documentation, the principal ID of the cluster system assigned identity needs to be granted permission on the public ip or vnet if outside the MC_ resource group. And this is the part I don't quite understand. When creating the cluster, AKS had no problem accessing the vnet and/or public ip if they are outside the MC_ resource group, why do I need to create role assignment again AFTER the cluster is created?

[Karishma-Tiwari-MSFT]

@palma21 Can you please share your insights on the customer's question? Thanks. :)

I have created a cluster with an existing vnet and system identity enabled and there's no error. After checking the vnet activity history, I saw that AKS first party service principal join the cluster nodes to the vnet without using system identity.

My question is since it's joined already, do we still need to grant system identity permissions to vnet? Same goes to public ip which is used as load balancer outbount ip.
When creating the cluster, AKS had no problem accessing the vnet and/or public ip if they are outside the MC_ resource group, why do I need to create role assignment again AFTER the cluster is created?

[palma21]

Adding @TomGeske

Yes you should still add, for additional operations done by kubernetes. The join was made by AKS service itself while the Managed Identity is used by kubernetes.

[feiyushi]

What kubernetes operations AFTER cluster is created require system identity to access/join pip/vnet etc?
If the part of documentation describing creating role assignment can be clearer it would be great.

[palma21]

Depends which networking plugin and which/how many resources you use in different RGs.

Generically: https://docs.microsoft.com/en-us/azure/aks/kubernetes-service-principal#networking

Eg. when you scale or autoscale and need to read and join to the subnet or add more nodepools. Or depending if you need k8s to manipulate RTs etc.

[feiyushi]

Thank you @palma21. I have no more questions. You may leave the issue open for documentation improvement or close it.

[TomGeske]

please-close