<p>I'm deploying an <code>AKS</code> k8s cluster with terraform.</p>
<p>The cluster has rbac enabled with azure active directory.</p>
<p>The cluster creation goes fine and after that terraform tries to perfom some taks on the cluster like creating <code>k8s-roles</code> <code>storage classes</code>...., and fails there with an <code>Unauthorized</code> error message, like this :</p>
<pre><code>module.k8s_cluster.module.infra.kubernetes_storage_class.managed-premium-retain: Creating...
module.k8s_cluster.module.infra.kubernetes_cluster_role.containerlogs: Creating...
module.k8s_cluster.module.infra.kubernetes_namespace.add_pod_identity: Creating...
module.k8s_cluster.module.infra.kubernetes_storage_class.managed-standard-retain: Creating...
module.k8s_cluster.module.infra.kubernetes_storage_class.managed-premium-delete: Creating...
module.k8s_cluster.module.appgw.kubernetes_namespace.agic[0]: Creating...
module.k8s_cluster.module.infra.kubernetes_storage_class.managed-standard-delete: Creating...

Error: Unauthorized

  on .terraform/modules/k8s_cluster/modules/infra/k8s-roles.tf line 1, in resource &quot;kubernetes_cluster_role&quot; &quot;containerlogs&quot;:
   1: resource &quot;kubernetes_cluster_role&quot; &quot;containerlogs&quot; {



Error: Unauthorized

  on .terraform/modules/k8s_cluster/modules/infra/k8s-storages-classes.tf line 1, in resource &quot;kubernetes_storage_class&quot; &quot;managed-standard-retain&quot;:
   1: resource &quot;kubernetes_storage_class&quot; &quot;managed-standard-retain&quot; {



Error: Unauthorized

  on .terraform/modules/k8s_cluster/modules/infra/k8s-storages-classes.tf line 14, in resource &quot;kubernetes_storage_class&quot; &quot;managed-standard-delete&quot;:
  14: resource &quot;kubernetes_storage_class&quot; &quot;managed-standard-delete&quot; {



Error: Unauthorized

  on .terraform/modules/k8s_cluster/modules/infra/k8s-storages-classes.tf line 27, in resource &quot;kubernetes_storage_class&quot; &quot;managed-premium-retain&quot;:
  27: resource &quot;kubernetes_storage_class&quot; &quot;managed-premium-retain&quot; {



Error: Unauthorized

  on .terraform/modules/k8s_cluster/modules/infra/k8s-storages-classes.tf line 40, in resource &quot;kubernetes_storage_class&quot; &quot;managed-premium-delete&quot;:
  40: resource &quot;kubernetes_storage_class&quot; &quot;managed-premium-delete&quot; {



Error: Unauthorized

  on .terraform/modules/k8s_cluster/modules/infra/r-aad-pod-identity.tf line 5, in resource &quot;kubernetes_namespace&quot; &quot;add_pod_identity&quot;:
   5: resource &quot;kubernetes_namespace&quot; &quot;add_pod_identity&quot; {



Error: Unauthorized

  on .terraform/modules/k8s_cluster/modules/tools/agic/helm-agic.tf line 1, in resource &quot;kubernetes_namespace&quot; &quot;agic&quot;:
   1: resource &quot;kubernetes_namespace&quot; &quot;agic&quot; {
</code></pre>
<p>As you can see these are not <code>azure</code> errors, but <code>kubernetes</code></p>
<p>It seems like I don't have rights to perform the above resources creation task on the newly created cluster.
What and where to do in order to grant my user account permissions for these terraform task?</p>

<p>An answer could be to change kubernetes provider configuration from</p>
<pre class="lang-hcl prettyprint-override"><code>provider &quot;kubernetes&quot; {
  load_config_file       = &quot;false&quot;
  host                   = azurerm_kubernetes_cluster.main.kube_config.0.host
  username               = azurerm_kubernetes_cluster.main.kube_config.0.username
  password               = azurerm_kubernetes_cluster.main.kube_config.0.password
  client_certificate     = &quot;${base64decode(azurerm_kubernetes_cluster.main.kube_config.0.client_certificate)}&quot;
  client_key             = &quot;${base64decode(azurerm_kubernetes_cluster.main.kube_config.0.client_key)}&quot;
  cluster_ca_certificate = &quot;${base64decode(azurerm_kubernetes_cluster.main.kube_config.0.cluster_ca_certificate)}&quot;
}
</code></pre>
<p>to</p>
<pre class="lang-hcl prettyprint-override"><code>provider &quot;kubernetes&quot; {
  load_config_file       = &quot;false&quot;
  host                   = azurerm_kubernetes_cluster.main.kube_admin_config.0.host
  username               = azurerm_kubernetes_cluster.main.kube_admin_config.0.username
  password               = azurerm_kubernetes_cluster.main.kube_admin_config.0.password
  client_certificate     = &quot;${base64decode(azurerm_kubernetes_cluster.main.kube_admin_config.0.client_certificate)}&quot;
  client_key             = &quot;${base64decode(azurerm_kubernetes_cluster.main.kube_admin_config.0.client_key)}&quot;
  cluster_ca_certificate = &quot;${base64decode(azurerm_kubernetes_cluster.main.kube_admin_config.0.cluster_ca_certificate)}&quot;
}
</code></pre>
<p>Note that if you disable the <code>local account</code> usage on your cluster this solution doesn't work.</p>
