<p>I'm trying to provide a PVC to a pod deployment and I'm facing this error:</p>
<blockquote>
<p>Failed to provision volume with StorageClass &quot;xxxxxxxxxxx&quot;: could not get storage key for storage account yyyyyyyyyyy: could not get storage key for storage account yyyyyyyyyyy: Retriable: false, RetryAfter: 0s, HTTPStatusCode: 400, RawError: Retriable: false, RetryAfter: 0s, HTTPStatusCode: 400, RawError: azure.BearerAuthorizer#WithAuthorization: Failed to refresh the Token for request to http://localhost:7788/subscriptions/zzzzzzzzzzz-aaaaaa-bbbbbb/resourceGroups/MC_kkkkkkkkkkkkkkkkkkkk/providers/Microsoft.Storage/storageAccounts/yyyyyyyyyyyyyyy/listKeys?api-version=2019-06-01: StatusCode=400 -- Original Error: adal: Refresh request failed. Status Code = '400'. Response body: {&quot;error&quot;:&quot;unauthorized_client&quot;,&quot;error_description&quot;:&quot;AADSTS700016: Application with identifier 'aaaaaa-bbbbbbbb-cccccccccccccccc' was not found in the directory 'ppppppppppp-aaaaaaaaaaaa-tttttttttttt'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.</p>
</blockquote>
<p>I'm pretty new to AKS and I believe there's something very primary I'm missing, but haven't found any help on the web.</p>
<p>This is what I've already double-checked:</p>
<ul>
<li>Using correct account login and subscription</li>
<li>The storage account referred do exists</li>
<li>It is in the same region and resource group as the AKS cluster</li>
</ul>
<h2>Storage class manifest</h2>
<pre><code>kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
  name: xxxxxxxx
provisioner: kubernetes.io/azure-file
parameters:
  skuName: Standard_LRS
  storageAccount: yyyyyyyyyyyy
  resourceGroup: MC_zzzzzzzzzzzzzzzzz
</code></pre>
<h2>PVC Manifest</h2>
<pre><code>apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: my-pvc
spec:
  accessModes:
  - ReadWriteMany
  storageClassName: xxxxxxxx
  resources:
    requests:
      storage: 5Gi 
</code></pre>
<p>I'm using <a href="https://k8slens.dev/" rel="nofollow noreferrer">Lens</a> to manage my cluster. The PVC resource hangs in the <code>Pending</code> state:
<a href="https://i.stack.imgur.com/VWObV.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/VWObV.png" alt="PVC deployment pending status" /></a></p>
<p>Can you guys help me to figure it out?</p>

Diego Rafael Souza
<p>According to the github issue <a href="https://github.com/Azure/aks-engine/issues/1146" rel="nofollow noreferrer">here</a> this happens if the cluster does not have service principal or the service principal is expired after validity of 1 year.</p>
<p>You can verify it by running below command. Retrieve the details by opening <code>/etc/kubernetes/azure.json</code> file on any master node or agent node.</p>
<pre><code>az login --service-principal -u &lt;aadClientId&gt; -p &lt;aadClientSecret&gt; -t &lt;tenantId&gt;
</code></pre>
<p>Updating or rotating the credential following the <a href="https://learn.microsoft.com/en-us/azure/aks/update-credentials" rel="nofollow noreferrer">doc</a> should solve it.</p>
<p>Alternatively, you can use a managed identity for permissions instead of a service principal. Managed identities are easier to manage than service principals and do not require updates or rotations. For more information, see <a href="https://learn.microsoft.com/en-us/azure/aks/use-managed-identity" rel="nofollow noreferrer">Use managed identities</a></p>
