Resolving Permission Issues for Deploying Applications Using Storage Services in Azure AKS Cluster

Problem Description

When attempting to deploy an application (e.g., GitLab) in an Azure AKS cluster and choosing the azurefile-csi-nfs storage class, the deployment fails, and the instances cannot start successfully. The specific error message is as follows:

The client 'fe1edb5c-xxxx-xxxx-xxxx-322359922f59' with object id 'fe1edb5c-xxxx-xxxx-xxxx-322359922f59' does not have authorization to perform action 'Microsoft.Network/virtualNetworks/subnets/read' over scope '/subscriptions/fa3e6c1d-xxxx-xxxx-xxxx-c1d21f3ad8db/resourceGroups/ait-test-zgjia-01_group_db4fb7/providers/Microsoft.Network/virtualNetworks/ait-test-zgjia-01/subnets/ait-test-zgjia-01'

Analysis of the Issue

This issue is caused by a lack of permissions for the client to perform operations within a specific scope. For specific details, please refer to the related problem description .

Solution

Solution Approach

1. Examine the crucial error details as mentioned in the problem description .

   Note: Replace the missing permissions, scope, and other details based on your specific situation.

   • Object ID: fe1edb5c-xxxx-xxxx-xxxx-322359922f59.

   • Missing Permissions: Microsoft.Network/virtualNetworks/subnets/read and Microsoft.Network/virtualNetworks/subnets/write.

     Note: When using the azurefile-csi-nfs storage class, both Read and Write permissions are required.

   • Scope: /subscriptions/fa3e6c1d-xxxx-xxxx-xxxx-c1d21f3ad8db/resourceGroups/ait-test-zgjia-01_group_db4fb7/providers/Microsoft.Network/virtualNetworks/ait-test-zgjia-01/subnets/ait-test-zgjia-01.

     Note: The section “<ait-test-zgjia-01_group_db4fb7>” refers to the Resource group.

2. In the Azure portal (referred to as Azure platform below), verify the scope and grant the necessary permissions to roles. For detailed instructions, please refer to the official documentation .

Procedure of operation

1. In the Azure portal, navigate to Azure services > Kubernetes services.

2. Click on the link associated with the Resource group as determined according to the Solution Approach .

3. Click on Access control (IAM) > Add > Add role assignment to grant access to Azure resources by assigning roles.

4. Click on Role > Job Functions Roles, and enter the role name (e.g., Network Contributor) for a built-in or custom role with subnets Read and Write permissions in the search box.

5. Click Next.

6. Under the Members tab, select Managed identity to grant access.

7. Click Select members.

8. On the Select managed identities page, select the managed identity as needed and choose Select.

   Tip: The member name should match the cluster name.

9. Click Select to add the managed identity to the selected members.

10. Click Next. On the Review + assign page, you can confirm that the member’s Object ID matches the one mentioned in the Problem Description and the scope matches or is a parent of it.

11. Click Review + assign, and when you see “Role assignment has been added” in the top right corner, the assignment is completed.

12. Go to the Role assignments tab to view the role assignment details under the Network Contributor section.

Related Operations

Determining the Role Name Based on Missing Permissions

In this example, we use built-in roles for illustration. If you need to use custom roles, refer to Azure custom roles .

1. Review the missing permissions mentioned in the error message: Microsoft.Network/virtualNetworks/subnets/read and Microsoft.Network/virtualNetworks/subnets/write.

2. Open the official documentation for built-in roles , and search for the role that has permissions for subnets Read and Write, e.g., Microsoft.Network/virtualNetworks/subnets/* or Microsoft.Network/*. In this example, we search for Microsoft.Network/*, and one of the search results is as follows:

   {
     "assignableScopes": [
       "/"
     ],
     "description": "Lets you manage networks, but not access to them.",
     "id": "/providers/Microsoft.Authorization/roleDefinitions/4d97b98b-1d4f-4787-a291-c67834d212e7",
     "name": "4d97b98b-1d4f-4787-a291-c67834d212e7",
     "permissions": [
       {
         "actions": [
           "Microsoft.Authorization/*/read",
           "Microsoft.Insights/alertRules/*",
           "Microsoft.Network/*",
           "Microsoft.ResourceHealth/availabilityStatuses/read",
           "Microsoft.Resources/deployments/*",
           "Microsoft.Resources/subscriptions/resourceGroups/read",
           "Microsoft.Support/*"
         ],
         "notActions": [],
         "dataActions": [],
         "notDataActions": []
       }
     ],
     "roleName": "Network Contributor",
     "roleType": "BuiltInRole",
     "type": "Microsoft.Authorization/roleDefinitions"
   }