<p>I'm trying to implement Azure Key Vault such that API keys, credentials and other Kubernetes secrets are read into production and staging environments. Ultimately, I'd like to try to expand that to local development environments so devs don't have to mess with it at all. It is just read in when they start their cluster.</p>
<p>Anyway, I'm following this to enable Pod Identities:</p>
<p><a href="https://learn.microsoft.com/en-us/azure/aks/use-azure-ad-pod-identity" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/use-azure-ad-pod-identity</a></p>
<p>When I get to <a href="https://learn.microsoft.com/en-us/azure/aks/use-azure-ad-pod-identity#create-an-aks-cluster-with-managed-identities" rel="nofollow noreferrer">this step</a>, I'm modifying the:</p>
<pre><code>az aks create -g myResourceGroup -n myAKSCluster --enable-managed-identity --enable-pod-identity --network-plugin azure
</code></pre>
<p>To the following because I'm trying to change an existing cluster:</p>
<pre><code>az aks update -g myResourceGroup -n myAKSCluster --enable-managed-identity --enable-pod-identity --network-plugin azure
</code></pre>
<p>This doesn't work and figured out I need to run each flag one at a time, so I had to run <code>--enable-managed-identity</code> first since <code>--enable-pod-identity</code> depends on it.</p>
<p>At any rate, when I get to the <code>--enable-pod-identity</code> I get the following error:</p>
<pre><code>Operation failed with status: 'Bad Request'. Details: Network plugin kubenet is not supported to use with PodIdentity addon.
</code></pre>
<p>So I try the <code>--network-plugin azure</code> and get:</p>
<pre><code>az: error: unrecognized arguments: --network-plugin azure
</code></pre>
<p>Apparently this is flag is not available with <code>update</code>.</p>
<p>Poking around in the Azure portal for the AKS resource, I do see <code>kubenet listed</code>, but I'm not able to change it.</p>
<p>So, the question: Is it possible to change the Network Plugin on existing cluster or do I need to start a new?</p>
<hr />
<p>EDIT: Looks like others are having similar issues on existing clusters:</p>
<p><a href="https://github.com/Azure/AKS/issues/2094" rel="nofollow noreferrer">https://github.com/Azure/AKS/issues/2094</a></p>

<blockquote>
<p>Is it possible to change the Network Plugin on the existing cluster or do
I need to start a new?</p>
</blockquote>
<p>It's impossible to change the network plugin on the existing cluster, so you need to create a new cluster and set the network plugin with azure at the creation time. You can find there is no parameter <code>--network-plugin</code> in the CLI command <a href="https://learn.microsoft.com/en-us/cli/azure/ext/aks-preview/aks?view=azure-cli-latest#ext_aks_preview_az_aks_update" rel="noreferrer"><code>az aks update</code></a> even if you install the <code>aks-preview</code> extension. It means it does not support changing the network plugin of the existing cluster.</p>
