Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

[ACS] az acs create does not does not add authorization to an SP

See original GitHub issue

Just after running az acs create --orchestrator-type=kubernetes --resource-group=<rgname> --dns-prefix=<appname> --name=<appname>

Operation completed without error

waiting for AAD role to propogate...........done
{
  "id": "/subscriptions/<guid>/resourceGroups/edicircle/providers/Microsoft.Resources/deployments/azurecli1482863184.1523824",
  "name": "azurecli1482863184.1523824",
  "properties": {
    "correlationId": "ebfb44b5-5b17-4fe0-b642-22a07ad58e52",
    "debugSetting": null,
    "dependencies": [],
    "mode": "Incremental",
    "outputs": null,
    "parameters": {
      "clientSecret": {
        "type": "SecureString"
      }
    },
    "parametersLink": null,
    "providers": [
      {
        "id": null,
        "namespace": "Microsoft.ContainerService",
        "registrationState": null,
        "resourceTypes": [
          {
            "aliases": null,
            "apiVersions": null,
            "locations": [
              "westeurope"
            ],
            "properties": null,
            "resourceType": "containerServices"
          }
        ]
      }
    ],
    "provisioningState": "Succeeded",
    "template": null,
    "templateLink": null,
    "timestamp": "2016-12-27T18:34:13.440219+00:00"
  },
  "resourceGroup": "<resourcegroup>"
}

But after startup I have such logs in docker container:

Unable to construct api.Node object for kubelet: failed to get external ID from cloud provider: compute.VirtualMachinesClient#Get: 
  Failure responding to request: StatusCode=403 
-- Original Error: autorest/azure: Service returned an error. 
  Status=403 Code="AuthorizationFailed" 
  Message="The client '<guid>' with object id '<guid>' does not have authorization to perform action 'Microsoft.Compute/virtualMachines/read' over scope 
    '/subscriptions/<guid>/resourceGroups/edicircle/providers/Microsoft.Compute/virtualMachines/k8s-master-f02f8c45-0'."

I would greatly appreciate any workaround!

az --version

azure-cli (0.1.0b11)
acr (0.1.0b11)
acs (0.1.0b11)
appservice (0.1.0b11)
cloud (0.1.0b11)
component (0.1.0b11)
configure (0.1.0b11)
container (0.1.0b11)
context (0.1.0b11)
core (0.1.0b11)
feedback (0.1.0b11)
network (0.1.0b11)
nspkg (0.1.0b11)
profile (0.1.0b11)
resource (0.1.0b11)
role (0.1.0b11)
storage (0.1.0b11)
vm (0.1.0b11)
Python (Darwin) 2.7.10 (default, Jul 30 2016, 19:40:32)
[GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.34)]