<p>I have a service principal which is an Owner on the subscription that I am using to create an Azure Kubernetes Service cluster as part of a script. I want my cluster to use:</p>
<pre><code>Kubernetes RBAC --&gt; enable
AKS-managed AAD --&gt; enable
Local accounts  --&gt; disabled
</code></pre>
<p>I would like the same Service Principal creating the cluster to be able to create k8s roles and role bindings however in order to do this the Service Principal seems to need a cluster-admin role binding.</p>
<p>When creating the cluster there is the option of adding an array of &quot;admin group object ids&quot; which seems to create cluster-admin role bindings for AD Groups.  However the SPN cannot be a part of a Group.</p>
<p>Is there anyway around this process?</p>

floaty39
<p><em><strong>I tried to reproduce the same in my environment and got the results as below:</strong></em></p>
<p>To assign Azure Kubernetes Service RBAC Cluster Admin to service principal you can make use of below cli command:</p>
<pre><code>az role assignment create --assignee &lt;appId&gt; --scope &lt;resourceScope&gt; --role Azure Kubernetes Service RBAC Cluster Admin
</code></pre>
<p><img src="https://i.stack.imgur.com/a0pBV.png" alt="enter image description here" /></p>
<p><strong>When I run this command kubernetes roles are added successfully like below</strong></p>
<p><img src="https://i.stack.imgur.com/D5bXN.png" alt="enter image description here" /></p>
<p>Alternatively, In azure AD create a group add service principal as a member like below:</p>
<p><img src="https://i.stack.imgur.com/LwcPC.png" alt="enter image description here" /></p>
<p>Now, Add the group in cluster configuration like below</p>
<p><img src="https://i.stack.imgur.com/nOKpq.png" alt="enter image description here" /></p>
<p>You can use the below the cli command to create the aks cluster using service principal like below:</p>
<pre><code>az aks create \
    --resource-group myResourceGroup \
    --name myAKSCluster \
    --service-principal &lt;appId&gt; \
    --client-secret &lt;password&gt;
</code></pre>
<p><em><strong>Reference</strong></em>:</p>
<p><a href="https://learn.microsoft.com/en-us/azure/aks/kubernetes-service-principal?tabs=azure-cli" rel="nofollow noreferrer">Use a service principal with Azure Kubernetes Services (AKS) - Azure Kubernetes Service | Microsoft Learn</a></p>
