az feedback auto-generates most of the information requested below, as of CLI version 2.0.62
Related command
az aks pod-identity add --resource-group "xxx" --cluster-name "xxx" --namespace "xxx" --name "xxxy" --identity-resource-id "/subscriptions/xxx"
Describe the bug
With az cli 2.47.0 and the aks-preview extension 0.5.118+, the above command will fail to add the Managed Identity Operator role assignment for the AKS cluster over the managed identity. It will not report any errors, but instead will just print Waiting for AAD role to propagate until the percentage reaches 100% and it gives up and prints Could not grant Managed Identity Operator permission for cluster. Running with --debug shows that GET requests are made for the AKS cluster, the managed ID and the managed ID's role assignments and then nothing else. Doing the same with az cli 2.42.0 showed a GET for the Managed Identity Operator role definition (to fetch it's ID) and then a PUT to actually assign that role over the managed ID (followed by the rest of the requests to create the pod-identity).
To Reproduce
Run the above command with valid rg/cluster name etc.
Expected behavior
The pod-identity should be created.
Environment summary
az --version
azure-cli 2.47.0
core 2.47.0
telemetry 1.0.8
Extensions:
aks-preview 0.5.118
Dependencies:
msal 1.20.0
azure-mgmt-resource 22.0.0
Python location 'C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe'
Extensions directory 'C:\Users\xxx.azure\cliextensions'
Python (Windows) 3.10.10 (tags/v3.10.10:aad5f6a, Feb 7 2023, 17:05:00) [MSC v.1929 32 bit (Intel)]
Additional context
Related command
az aks pod-identity add --resource-group "xxx" --cluster-name "xxx" --namespace "xxx" --name "xxxy" --identity-resource-id "/subscriptions/xxx"
Describe the bug
With az cli 2.47.0 and the aks-preview extension 0.5.118+, the above command will fail to add the Managed Identity Operator role assignment for the AKS cluster over the managed identity. It will not report any errors, but instead will just print
Waiting for AAD role to propagateuntil the percentage reaches 100% and it gives up and printsCould not grant Managed Identity Operator permission for cluster. Running with --debug shows that GET requests are made for the AKS cluster, the managed ID and the managed ID's role assignments and then nothing else. Doing the same with az cli 2.42.0 showed a GET for the Managed Identity Operator role definition (to fetch it's ID) and then a PUT to actually assign that role over the managed ID (followed by the rest of the requests to create the pod-identity).To Reproduce
Run the above command with valid rg/cluster name etc.
Expected behavior
The pod-identity should be created.
Environment summary
core 2.47.0
telemetry 1.0.8
Extensions:
aks-preview 0.5.118
Dependencies:
msal 1.20.0
azure-mgmt-resource 22.0.0
Python location 'C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe'
Extensions directory 'C:\Users\xxx.azure\cliextensions'
Python (Windows) 3.10.10 (tags/v3.10.10:aad5f6a, Feb 7 2023, 17:05:00) [MSC v.1929 32 bit (Intel)]
Additional context