azure - : getting unauthorize error while trying to create load balancer

Question

我在尝试在 AKS 中创建负载均衡器时遇到以下错误，

{"error":{"code":"AuthorizationFailed","message":"The client'85e23f21-xxxxxxxxxxx' with object id'85e23f21-xxxxxxxxxxx' does not have authorization to performaction 'Microsoft.Network/virtualNetworks/subnets/read' over scope'/subscriptions/xxxx-xxxx-xxxx-xxxx-xxxx/resourceGroups/my-vnet/providers/Microsoft.Network/virtualNetworks/my-vnet/subnets/my-subnet'or the scope is invalid. If access was recently granted, please refresh yourcredentials."}}

此处的客户端和对象 ID 相同，这是托管身份的委托(delegate)人 ID，因为我的 AKS 群集启用了托管身份。

❯ az aks show -g my-rg -n my-aks --query "identity"{"principalId": "85e23f21-xxxxxxxxxxx","tenantId": "xxxxxxxxxxxxxxxxxxxx","type": "SystemAssigned","userAssignedIdentities": null}

我还为我的 aks 集群启用了 azure RBAC

az aks update -g myResourceGroup -n myAKSCluster --enable-azure-rbac

这里缺少什么，如何授予权限？请帮忙。

Answer 1

这可能是因为您的 VNet 不在工作节点资源组中，因此默认情况下系统分配的标识只能管理该资源组内的资源。您需要对集群系统分配的托管标识的主体 ID 进行角色分配，以授予其对该资源组之外的托管资源的权限。来自 Azure documentation :

Note

For creating and using your own VNet, static IP address, or attachedAzure disk where the resources are outside of the worker node resourcegroup, use the PrincipalID of the cluster System Assigned ManagedIdentity to perform a role assignment.