<p>I am deploying AKS through terraform.
It's working great, but I would like to also enable identity on the VMSS object in order to allow pod level managed identity access (mostly grab keys from key vaults).</p>
<p>I can manually do this by going to the auto-created VMSS object that Azure creates once launching the AKS cluster.</p>
<p>However, I do not see an option for this in the terraform resource.</p>
<p>Has anyone ran into this and found a way to pull it off?</p>
<p>My deployment code is like this:</p>
<pre><code>resource &quot;azurerm_kubernetes_cluster&quot; &quot;main&quot; {
  name                = &quot;myaks&quot;
  location            = &quot;centralus&quot;
  resource_group_name = &quot;myrg&quot;
  dns_prefix          = &quot;myaks&quot;

  node_resource_group = &quot;aksmanagedrg&quot;

  default_node_pool {
    name            = &quot;default&quot;
    node_count      = 1
    vm_size         = &quot;Standard_B2ms&quot;
    vnet_subnet_id  = &quot;myakssubnetid&quot;
    os_disk_size_gb = 128
  }

  identity {
    type = &quot;SystemAssigned&quot;
  }

  addon_profile {
    aci_connector_linux {
      enabled = false
    }

    azure_policy {
      enabled = false
    }

    http_application_routing {
      enabled = false
    }

    kube_dashboard {
      enabled = true
    }

    oms_agent {
      enabled = false
    }
  }

  network_profile {
    network_plugin = &quot;azure&quot;
    load_balancer_sku = &quot;standard&quot;
  }

}

</code></pre>
<p>Thanks!</p>

Eric Longstreet
<p>It seems you're looking for the <a href="https://learn.microsoft.com/en-us/azure/aks/use-azure-ad-pod-identity" rel="nofollow noreferrer">pod-managed identities in Azure Kubernetes Service</a>. If so, then, unfortunately, Terraform seems does not support to configure the property. When you follow the article above to configure the pod-managed identities, then you can see the pod identity profile like this:</p>
<p><a href="https://i.stack.imgur.com/h5KuX.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/h5KuX.png" alt="enter image description here" /></a></p>
<p>And there is no such option for you to configure it. But instead, you can run the Azure CLI in the Terraform via the <code>null_resource</code> and provisioner <code>local-exec</code> and here is an example:</p>
<pre><code>resource &quot;null_resource&quot; &quot;aks_update&quot; {
  provisioner &quot;local-exec&quot; {
    command = &quot;az aks update --resource-group ${azurerm_resource_group.aks.name} --name ${azurerm_kubernetes_cluster.aks.name} --enable-pod-identity&quot;
  }
}

resource &quot;null_resource&quot; &quot;aks_add_poidentity&quot; {
  provisioner &quot;local-exec&quot; {
    command = &quot;az aks pod-identity add --resource-group ${azurerm_resource_group.aks.name} --cluster-name ${azurerm_kubernetes_cluster.aks.name} --namespace ${var.pod_identity_namespace} --name ${azurerm_user_assigned_identity.aks.name} --identity-resource-id ${azurerm_user_assigned_identity.aks.id}&quot;
  }
}
</code></pre>
<p>This could be a way to enable the identity in the pods level for the AKS.</p>
