<p>I'm deploying an <code>AKS</code> k8s cluster with terraform.</p>
<p>The cluster has rbac enabled with azure active directory.</p>
<p>The cluster creation goes fine and after that terraform tries to perfom some taks on the cluster like creating <code>k8s-roles</code> <code>storage classes</code>...., and fails there with an <code>Unauthorized</code> error message, like this :</p>
<pre><code>module.k8s_cluster.module.infra.kubernetes_storage_class.managed-premium-retain: Creating...
module.k8s_cluster.module.infra.kubernetes_cluster_role.containerlogs: Creating...
module.k8s_cluster.module.infra.kubernetes_namespace.add_pod_identity: Creating...
module.k8s_cluster.module.infra.kubernetes_storage_class.managed-standard-retain: Creating...
module.k8s_cluster.module.infra.kubernetes_storage_class.managed-premium-delete: Creating...
module.k8s_cluster.module.appgw.kubernetes_namespace.agic[0]: Creating...
module.k8s_cluster.module.infra.kubernetes_storage_class.managed-standard-delete: Creating...

Error: Unauthorized

  on .terraform/modules/k8s_cluster/modules/infra/k8s-roles.tf line 1, in resource &quot;kubernetes_cluster_role&quot; &quot;containerlogs&quot;:
   1: resource &quot;kubernetes_cluster_role&quot; &quot;containerlogs&quot; {



Error: Unauthorized

  on .terraform/modules/k8s_cluster/modules/infra/k8s-storages-classes.tf line 1, in resource &quot;kubernetes_storage_class&quot; &quot;managed-standard-retain&quot;:
   1: resource &quot;kubernetes_storage_class&quot; &quot;managed-standard-retain&quot; {



Error: Unauthorized

  on .terraform/modules/k8s_cluster/modules/infra/k8s-storages-classes.tf line 14, in resource &quot;kubernetes_storage_class&quot; &quot;managed-standard-delete&quot;:
  14: resource &quot;kubernetes_storage_class&quot; &quot;managed-standard-delete&quot; {



Error: Unauthorized

  on .terraform/modules/k8s_cluster/modules/infra/k8s-storages-classes.tf line 27, in resource &quot;kubernetes_storage_class&quot; &quot;managed-premium-retain&quot;:
  27: resource &quot;kubernetes_storage_class&quot; &quot;managed-premium-retain&quot; {



Error: Unauthorized

  on .terraform/modules/k8s_cluster/modules/infra/k8s-storages-classes.tf line 40, in resource &quot;kubernetes_storage_class&quot; &quot;managed-premium-delete&quot;:
  40: resource &quot;kubernetes_storage_class&quot; &quot;managed-premium-delete&quot; {



Error: Unauthorized

  on .terraform/modules/k8s_cluster/modules/infra/r-aad-pod-identity.tf line 5, in resource &quot;kubernetes_namespace&quot; &quot;add_pod_identity&quot;:
   5: resource &quot;kubernetes_namespace&quot; &quot;add_pod_identity&quot; {



Error: Unauthorized

  on .terraform/modules/k8s_cluster/modules/tools/agic/helm-agic.tf line 1, in resource &quot;kubernetes_namespace&quot; &quot;agic&quot;:
   1: resource &quot;kubernetes_namespace&quot; &quot;agic&quot; {
</code></pre>
<p>As you can see these are not <code>azure</code> errors, but <code>kubernetes</code></p>
<p>It seems like I don't have rights to perform the above resources creation task on the newly created cluster.
What and where to do in order to grant my user account permissions for these terraform task?</p>

nixmind
<p>The simplest answer is to change your kubernetes provider configuration from</p>
<pre class="lang-hcl prettyprint-override"><code>provider &quot;kubernetes&quot; {
  load_config_file       = &quot;false&quot;
  host                   = azurerm_kubernetes_cluster.main.kube_config.0.host
  username               = azurerm_kubernetes_cluster.main.kube_config.0.username
  password               = azurerm_kubernetes_cluster.main.kube_config.0.password
  client_certificate     = &quot;${base64decode(azurerm_kubernetes_cluster.main.kube_config.0.client_certificate)}&quot;
  client_key             = &quot;${base64decode(azurerm_kubernetes_cluster.main.kube_config.0.client_key)}&quot;
  cluster_ca_certificate = &quot;${base64decode(azurerm_kubernetes_cluster.main.kube_config.0.cluster_ca_certificate)}&quot;
}
</code></pre>
<p>to</p>
<pre class="lang-hcl prettyprint-override"><code>provider &quot;kubernetes&quot; {
  load_config_file       = &quot;false&quot;
  host                   = azurerm_kubernetes_cluster.main.kube_admin_config.0.host
  username               = azurerm_kubernetes_cluster.main.kube_admin_config.0.username
  password               = azurerm_kubernetes_cluster.main.kube_admin_config.0.password
  client_certificate     = &quot;${base64decode(azurerm_kubernetes_cluster.main.kube_admin_config.0.client_certificate)}&quot;
  client_key             = &quot;${base64decode(azurerm_kubernetes_cluster.main.kube_admin_config.0.client_key)}&quot;
  cluster_ca_certificate = &quot;${base64decode(azurerm_kubernetes_cluster.main.kube_admin_config.0.cluster_ca_certificate)}&quot;
}
</code></pre>
<p>If the local accounts are disabled this will not work, but you can use this instead :</p>
<pre class="lang-hcl prettyprint-override"><code>provider &quot;kubernetes&quot; {
  host                   = data.azurerm_kubernetes_cluster.this.kube_config.0.host
  cluster_ca_certificate = base64decode(data.azurerm_kubernetes_cluster.this.kube_config.0.cluster_ca_certificate)
  exec {
    api_version = &quot;client.authentication.k8s.io/v1beta1&quot;
    command = &quot;./kubelogin&quot;
    args = [
      &quot;get-token&quot;,
      &quot;--login&quot;,
      &quot;spn&quot;,
      &quot;--environment&quot;,
      &quot;AzurePublicCloud&quot;,
      &quot;--tenant-id&quot;,
      var.tenant_id,
      &quot;--server-id&quot;,
      var.aad_server_id,
      &quot;--client-id&quot;,
      var.client_id,
      &quot;--client-secret&quot;,
      var.client_secret
    ]
  }
}
</code></pre>
<p>Note that you'll need to include the <a href="https://github.com/Azure/kubelogin" rel="nofollow noreferrer">kubelogin</a> binary in the repo. More details <a href="https://discuss.hashicorp.com/t/aad-integrated-kubernetes-cluster-no-longer-able-to-use-kubernetes-provider-following-disabling-local-admin-account/33439" rel="nofollow noreferrer">here</a>.</p>
