<p>I've deployed an Azure Kubernetes Service with the <strong>Azure AD authentication with Azure RBAC</strong> Authentication mode configured.</p>
<p>I have given myself the</p>
<ul>
<li><code>Azure Kubernetes Service Cluster Admin Role</code></li>
<li><code>Azure Kubernetes Service RBAC Admin</code></li>
</ul>
<p>- roles.</p>
<p>And with this I can:</p>
<ul>
<li>List deployments</li>
<li>Create deployments</li>
<li>Tear down deployments</li>
</ul>
<p>Across all namespaces.</p>
<p>However neither of these allow me to create a <code>namespace</code>, and from what I can tell no obvious other roles touch on this permission.</p>
<p>For example <code>kubectl create namespace test-namespace</code> Raises:</p>
<pre class="lang-bash prettyprint-override"><code>Error from server (Forbidden): namespaces is forbidden: User &quot;USER AZURE AD&quot; cannot create resource &quot;namespaces&quot; in API group &quot;&quot; at the cluster scope: User does not have access to the resource in Azure. Update role assignment to allow access.
</code></pre>
<p>I am aware that pulling credentials with <code>az aks get-credentials -g {Resource Group} --name {CLUSTER NAME} --admin</code> is a workaround, but this particular cluster cannot have <code>Kubertnetes local accounts</code> enabled so this is not an option.</p>
<p>What can I do?</p>

Zander Fick
<p>To resolve this issue, create one <strong>custom RBAC role</strong> with <strong><code>Microsoft.ContainerService/managedClusters/namespaces/write</code></strong> permission under your subscription:</p>
<p><img src="https://i.imgur.com/fOK3d1t.png" alt="enter image description here" /></p>
<p>Clone a role with Azure <code>Kubernetes service RBAC Admin</code>:</p>
<p><img src="https://i.imgur.com/eUpj6Eb.png" alt="enter image description here" /></p>
<p>In permission tab you can find <strong>NotDataActions</strong> remove the <code>Microsoft.ContainerService/managedClusters/namespaces/write</code> from <code>NotDataActions</code> and add the same permission:</p>
<p><img src="https://i.imgur.com/4ilYhpq.png" alt="enter image description here" /></p>
<p><img src="https://i.imgur.com/nBkUUSU.png" alt="enter image description here" /></p>
<p>Once the custom role is created, now assign the role assignment:</p>
<p><img src="https://i.imgur.com/L6Avz10.png" alt="enter image description here" /></p>
<p>When I run the namespace command got desired output:</p>
<p><code>kubectl create namespace test-namespace</code></p>
<p><a href="https://i.imgur.com/px7whaJ.png" rel="nofollow noreferrer"><strong>Output</strong></a></p>
<p><em><strong>Reference</strong></em>: <a href="https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#azure-kubernetes-service-rbac-admin" rel="nofollow noreferrer">Azure built-in roles - Azure RBAC | Microsoft Learn</a></p>
