Azure / Azure/azure-rest-api-specs

Bug: [AKS] Cant update the cluster using 'createorupdate', the 'UserAssignedIdentities' property cant be parsed

Open
#13,501 11 comments 7 reactions 0 assignees View on GitHub
AKS question Service Attention
Dominant language
TypeSpec
Stars
3.1k
Forks
5.9k
Avg merge
2d 22h
Merged PRs (30d)
444

Description

Hello,

We have a AKS cluster with a user assigned managed identity but we cant update the cluster using the REST API or the Portal
## Reproduction steps
### 1. create a aks cluster using Terraform:
1. make `main.tf` file with following config:
```tf
terraform {
required_providers {
azurerm = {
source = "hashicorp/azurerm"
version = "=2.46.0"
}
}
}

provider "azurerm" {
features {}
}

resource "azurerm_resource_group" "example" {
name = "example-resources"
location = "West Europe"
}

resource "azurerm_user_assigned_identity" "example" {
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
name = "example_user_assigned_identity"
}

resource "azurerm_kubernetes_cluster" "example" {
name = "example-aks1"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
dns_prefix = "exampleaks1"

default_node_pool {
name = "default"
node_count = 1
vm_size = "Standard_D2_v2"
}

identity {
type = "UserAssigned"
user_assigned_identity_id = azurerm_user_assigned_identity.example.id
}
}
```
2. execute `terraform init`
3. execute `terraform apply -auto-approve`

### 2.1 updating using the Terraform
1. added following to the AKS resource in terraform:
```tf
api_server_authorized_ip_ranges = ["168.63.129.16"]
```
2. execute `terraform apply -auto-approve` -> error:
```
Error: updating Managed Kubernetes Cluster "example-aks1" (Resource Group "example-resources"): containerservice.ManagedClustersClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="InvalidIdentityValues" Message="Invalid value for the identities '/subscriptions/***/resourceGroups/example-resources/providers/Microsoft.ManagedIdentity/userAssignedIdentities/example_user_assigned_identity'. The 'UserAssignedIdentities' property keys should only be empty json objects, null or the resource exisiting property."

on main.tf line 25, in resource "azurerm_kubernetes_cluster" "example":
25: resource "azurerm_kubernetes_cluster" "example" {
```

### 2.2 updating using the Rest API
If we want to update the aks cluster with '[createorupdate](https://docs.microsoft.com/en-us/rest/api/aks/managedclusters/createorupdate)'(API version: `2021-02-01`) rest call with the json obtained from the '[get](https://docs.microsoft.com/en-us/rest/api/aks/managedclusters/get)'(API version: `2021-02-01`) rest call we get the following error:
```json
{
"error": {
"code": "InvalidIdentityValues",
"message": "Invalid value for the identities '/subscriptions/***/resourceGroups/***/providers/Microsoft.ManagedIdentity/userAssignedIdentities/***'. The 'UserAssignedIdentities' property keys should only be empty json objects, null or the resource exisiting property."
}
}
```

### 2.3 updating using the Azure Portal
if we want to `set authorized IP ranges` the aks cluster in portal we get the same error:
![aks update error](https://user-images.githubusercontent.com/16583080/111602617-d1a47f80-87d3-11eb-8545-0d67403e7a4a.png)

Thanks!

Contributor guide

Open the contributing guide

Research direction

Start with the ManagedClusters createOrUpdate and get REST API operations for version 2021-02-01, then compare the returned identity payload with the payload accepted for updates. Reproduce the failure using the Terraform configuration and the authorized IP range change. Done means an AKS cluster using a user-assigned identity can be updated through Terraform, REST, and the Portal without InvalidIdentityValues.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, kubernetes, openapi, terraform
Domain
api, cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.