pod标识在aks集群创建上

Question

现在，不可能在集群创建时在arm模板(和terraform)上分配用户分配的标识。我已经尝试了很多东西，更新工作得很好，手动插入后:

az aks pod-identity add --cluster-name my-aks-cn --resource-group myrg --namespace myns --name example-pod-identity --identity-resource-id /subscriptions/......

但是，我希望在部署时立即完成此操作，因此我需要自动将pod用户标识插入集群。我还尝试使用DeploymentScripts运行命令，但是部署脚本还没有准备好使用preview aks extersion。

我的配置是这样的:

{
"type": "Microsoft.ContainerService/managedClusters",
"apiVersion": "2021-02-01",
"name": "[variables('cluster_name')]",
"location": "[variables('location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualNetworks', variables('vnet_name'))]"
],
"properties": {
....
"podIdentityProfile": {
"allowNetworkPluginKubenet": null,
"enabled": true,
"userAssignedIdentities": [
{
"identity": {
"clientId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'managed-indentity'), '2018-11-30').clientId]",
"objectId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'managed-indentity'), '2018-11-30').principalId]",
"resourceId": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'managed-indentity')]"
},
"name": "managed-indentity",
"namespace": "myns"
}
],
"userAssignedIdentityExceptions": null
},
....
},
"identity": {
"type": "SystemAssigned"
}
},

我总是遇到同样的问题:

"statusMessage": "{"error":{"code":"InvalidTemplateDeployment","message":"The template deployment 'deployment_test' is not valid according to the validation procedure. The tracking id is '.....'. See inner errors for details.","details":[{"code":"PodIdentityAddonUserAssignedIdentitiesNotAllowedInCreation","message":"Provisioning of resource(s) for container service cluster-12344 in resource group myrc failed. Message: {\n \"code\": \"PodIdentityAddonUserAssignedIdentitiesNotAllowedInCreation\",\n \"message\": \"PodIdentity addon does not support assigning pod identities on creation.\"\n }. Details: "}]}}",

Answer 1

产品团队在这里分享了答案:https://github.com/Azure/aad-pod-identity/issues/1123

说:

这是现有配置中的一个已知限制。我们会修复

对于其他面临相同问题的人，请参考上面的GitHub问题。