[ACS] az acs create does not does not add authorization to an SP

[olostan]

Just after running az acs create --orchestrator-type=kubernetes --resource-group=<rgname> --dns-prefix=<appname> --name=<appname>

Operation completed without error

waiting for AAD role to propogate...........done
{
  "id": "/subscriptions//resourceGroups/edicircle/providers/Microsoft.Resources/deployments/azurecli1482863184.1523824",
  "name": "azurecli1482863184.1523824",
  "properties": {
    "correlationId": "ebfb44b5-5b17-4fe0-b642-22a07ad58e52",
    "debugSetting": null,
    "dependencies": [],
    "mode": "Incremental",
    "outputs": null,
    "parameters": {
      "clientSecret": {
        "type": "SecureString"
      }
    },
    "parametersLink": null,
    "providers": [
      {
        "id": null,
        "namespace": "Microsoft.ContainerService",
        "registrationState": null,
        "resourceTypes": [
          {
            "aliases": null,
            "apiVersions": null,
            "locations": [
              "westeurope"
            ],
            "properties": null,
            "resourceType": "containerServices"
          }
        ]
      }
    ],
    "provisioningState": "Succeeded",
    "template": null,
    "templateLink": null,
    "timestamp": "2016-12-27T18:34:13.440219+00:00"
  },
  "resourceGroup": ""
}

But after startup I have such logs in docker container:

Unable to construct api.Node object for kubelet: failed to get external ID from cloud provider: compute.VirtualMachinesClient#Get: 
  Failure responding to request: StatusCode=403 
-- Original Error: autorest/azure: Service returned an error. 
  Status=403 Code="AuthorizationFailed" 
  Message="The client '<guid>' with object id '<guid>' does not have authorization to perform action 'Microsoft.Compute/virtualMachines/read' over scope 
    '/subscriptions/<guid>/resourceGroups/edicircle/providers/Microsoft.Compute/virtualMachines/k8s-master-f02f8c45-0'."

I would greatly appreciate any workaround!

az --version

azure-cli (0.1.0b11)
acr (0.1.0b11)

acs (0.1.0b11)

appservice (0.1.0b11)

cloud (0.1.0b11)

component (0.1.0b11)

configure (0.1.0b11)

container (0.1.0b11)

context (0.1.0b11)

core (0.1.0b11)

feedback (0.1.0b11)

network (0.1.0b11)

nspkg (0.1.0b11)

profile (0.1.0b11)

resource (0.1.0b11)

role (0.1.0b11)

storage (0.1.0b11)

vm (0.1.0b11)
Python (Darwin) 2.7.10 (default, Jul 30 2016, 19:40:32)

[GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.34)]

[olostan]

I have an suspicion that problem was because I had "Contribuer" role nad seems and I was not able to creat other "Contributers"

[brendandburns]

I'll try to reproduce this. We should at the very least error out in the CLI in this case.

[advishnuprasad]

@olostan I faced the same issue. I am also having "contributor" role. But why would it try to create other contributors ?

[brendandburns]

Kubernetes needs contributor privileges in order to do things on your behalf like create load balancers and mount disks.

[brendandburns]

I think this can now be closed.