<p>How I can add this role to Pod, to manage disk in Azure.
<a href="https://pastebin.com/E91XfxqA" rel="nofollow noreferrer">Role fo Azure Disk</a></p>
<p>Because I got an error when I created Pod:</p>
<pre><code>Events:
  Type     Reason              Age                From                     Message
  ----     ------              ----               ----                     -------
  Normal   Scheduled           32s                default-scheduler        Successfully assigned default/mypod to aks-platform
  Warning  FailedAttachVolume  13s (x6 over 32s)  attachdetach-controller  AttachVolume.Attach failed for volume &quot;pv-azuredisk&quot; : rpc error: code = NotFound desc = Volume not found, failed with error: Retriable: false, RetryAfter: 0s, HTTPStatusCode: 403, RawError: {&quot;error&quot;:{&quot;code&quot;:&quot;AuthorizationFailed&quot;,&quot;message&quot;:&quot;The client '333333' with object id '88888888' does not have authorization to perform action 'Microsoft.Compute/disks/read' over scope '/subscriptions/111111111/resourceGroups/222222222/providers/Microsoft.Compute/disks/test-attach-aks' or the scope is invalid. If access was recently granted, please refresh your credentials.&quot;}}
</code></pre>

Oleg
<p>You need to assign the role, if you have created the disk yourself outside of aks.</p>
<p>Get the object id:</p>
<pre class="lang-bash prettyprint-override"><code>az aks show -n &lt;cluster-name&gt; -g &lt;resource-group&gt; --query \
  'identityProfile.kubeletidentity.objectId' -o tsv
</code></pre>
<p>Then assign the role:</p>
<pre class="lang-bash prettyprint-override"><code>az role assignment create --assignee &lt;AKS-identity-ID&gt; --role &quot;Contributor&quot; --scope \
  /subscriptions/&lt;subscription-ID&gt;/resourceGroups/&lt;disk-resource-group&gt;/providers/Microsoft.Compute/disks/&lt;disk name&gt;
</code></pre>
<p>If the object ID does not work, you may want to check if you need to use the resource or client ID. You can inspect the identity with the below. But usually object IDs are used for AD.</p>
<pre class="lang-bash prettyprint-override"><code>az aks show -n &lt;cluster-name&gt; -g &lt;resource-group&gt; --query 'identityProfile'
</code></pre>
<p>Here are some docs regarding your problem: <a href="https://learn.microsoft.com/en-us/troubleshoot/azure/azure-kubernetes/fail-to-mount-azure-disk-volume#cause-aks-identity-doesnt-have-required-authorization-over-disk" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/troubleshoot/azure/azure-kubernetes/fail-to-mount-azure-disk-volume#cause-aks-identity-doesnt-have-required-authorization-over-disk</a>.</p>
