<p>We are trying to deploy a Kubernetes cluster with help of Azure Kubernetes Service (<strong>AKS</strong>)  to our <strong>existing</strong> virtual network. This virtual network has <strong>custom route tables</strong>.</p>
<p>The deployment process is done via an external application. Permissions should be given to this application with help of Service Principal. As per the <a href="https://learn.microsoft.com/en-us/azure/aks/configure-kubenet#bring-your-own-subnet-and-route-table-with-kubenet" rel="nofollow noreferrer">documentation</a> says under the <em>Limitations</em> section:</p>
<ul>
<li><em>Permissions must be assigned before cluster creation, ensure you are using a service principal with write permissions to your custom subnet and custom route table.</em></li>
</ul>
<p>We have a security team which are responsible for <strong>giving permissions to service principals</strong>, managing networking. Without knowing exactly what rules will be written into the route tables <strong>by</strong> the <strong>AKS</strong>, they wont give the permission to the proper service principal.</p>
<p><strong>Does somebody know what rules the AKS wants to write into those route tables?</strong></p>

<p>The documentation you are pointing to is for a cluster using <strong>Kubenet</strong> networking. Is there a reason why you don't want to use <a href="https://learn.microsoft.com/en-us/azure/aks/configure-azure-cni" rel="nofollow noreferrer">Azure CNI</a> instead? If you are using Azure CNI, you will off course consume more IP adresses, but AKS will not need to write into the route table.</p>
<p>With that said, if you really want to use Kubenet, the rules that will be write on the route table will depend on what you are deploying inside your cluster since Kubenet is using the route table to route the traffic... It will adds rules throughout the cluster lifecycle when you will add Pods, Services, etc.</p>
<p><a href="https://i.stack.imgur.com/oXJVx.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/oXJVx.png" alt="enter image description here" /></a></p>
