Deploying AKS agent pool managed identity outside of MC_ resource group

user_14344821 0
Viewed 473

When rolling out my AKS cluster

az deployment group create --template-file template.json --parameters parameters.d.json -g <resource_group>

three managed identities are created. These resources are located, by default, in the Managed Cluster resource group (with prefix MC_). I would like the agentpool managed identity (for vmss) to reside in another resource group.

Ideally I'd like to keep these managed identities when redeploying the cluster, however, the _MC resource groups are deleted and created again. Is there an option to deploy these managed identities in another resource group where they have a longer lifetime? Can this be configured in the template.json?

azure-aks kubernetes azure
1 Answers

I don't know which managed identities you have because it depends on which add-ons is enabled. Most add-on identities can't be managed outside the cluster, but you can use a user-assigned identity for the kubelet and agentpool (preview) identity. Here is the documentation of the identities for AKS, it tells for which feature you can bring your own identity.

Since it is in preview for the agentpool identity, I'm not sure that this can be done via an ARM tempalte yet. There is an identity field, but I suspect it's for the kubelet identity and not the agentpool. I might be wrong though, you should give it a try.

user_7327710
Related