AKS cluster creation fails due to missing Managed Identity Operator role

Issue

AKS cluster creation failed with the error CustomKubeletIdentityMissingPermissionError, indicating that the control plane identity lacked the necessary permissions to assign the kubelet identity. This prevented the cluster from being created and blocked subsequent operations.

Culprit

The control plane identity (user-assigned managed identity for the AKS cluster) was missing the Managed Identity Operator role on the kubelet identity (user-assigned identity for node pools). This role is required for Azure’s RBAC model to enable the control plane to assign the kubelet identity to node pools, which is essential for operations like ACR image pulls.

Solution

Role Assignment

Added a role assignment to grant the control plane identity the required Managed Identity Operator role on the kubelet identity. This allows the control plane to:

1. Assign the kubelet identity to node pools during cluster creation.
2. Enable ACR image pull operations via the kubelet identity.

Required Architecture

1. Two Separate Identities:

   • Control Plane Identity: Manages cluster resources.
   • Kubelet Identity: Used by node pools for ACR operations.

2. Role Assignments:

   • The control plane identity must have the Managed Identity Operator role on the kubelet identity.
   • The kubelet identity must have the AcrPull role on the ACR.

This solution ensures that the control plane has the necessary permissions to assign the kubelet identity and enables the cluster to operate correctly with ACR image pulls.