<p>I am trying to create a Loadbalancer service linked to an existing PublicIP on kubectl.
Although I am an owner of the resourceGroup (of both publicIP and k8s cluster), the service creation hangs with the following error in kubectl describe:</p>
<blockquote>
<p>Error syncing load balancer: failed to ensure load balancer: Retriable: false, RetryAfter: 0s, HTTPStatusCode: 403, RawError: Retriable: false, RetryAfter: 0s, HTTPStatusCode: 403, RawError: {&quot;error&quot;:{&quot;code&quot;:&quot;AuthorizationFailed&quot;,&quot;message&quot;:&quot;The client '[CLIENT_ID]' with object id '[OBJECT_ID]' does not have authorization to perform action 'Microsoft.Network/publicIPAddresses/read' over scope '/subscriptions/[SUBSCRIPTION]/resourceGroups/[RESOURCE_GROUP]/providers/Microsoft.Network' or the scope is invalid. If access was recently granted, please refresh your credentials.&quot;}}</p>
</blockquote>
<p>I have tried assigning Owner role on my kubectl client, but the issue persists.</p>
<pre><code>az role assignment create 
    --role Owner 
    --assignee xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
</code></pre>
<p>AKS 1.18.14</p>

<p>The following guide answered my question: <a href="https://learn.microsoft.com/en-us/azure/aks/static-ip#create-a-service-using-the-static-ip-address" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/static-ip#create-a-service-using-the-static-ip-address</a></p>
<p>Turns out, owner permission is somehow not enough. After adding the following permissions, I am able to create a service that links to an existing load balancer:</p>
<pre><code>az role assignment create \
    --assignee &lt;SP Client ID&gt; \
    --role &quot;Network Contributor&quot; \
    --scope /subscriptions/&lt;subscription id&gt;/resourceGroups/&lt;resource group name&gt;
</code></pre>
