LinkedAuthorizationFailed when using a re-created managed identity (same name, different clientId)

[pfefferf]

Have you

• [X] Read Troubleshooting Guide
• [X] Read Known Issues
• [X] Searched on GitHub issues

Describe the bug

Following scenario:

• a managed identity was created and used successfully via a pod binding on a cluster
• the managed identity was removed as not required anymore for test reasons
• later a managed identity was created with the SAME name, no the pod identity binding fails with message

  Warning  binding apply error  10s (x18 over 17s)  aadpodidentity.k8s.io  failed to apply binding zzz/zzz-binding 
  node aks-apppool1-41741072-vmss000003 for pod zzz/zzz-depl-5c969f8cb7-5j4p9, 
  error: failed to update identities for aks-apppool1-41741072-vmss in MC_zzz-dev-kubernetes_westeurope, error: 
  compute.VirtualMachineScaleSetsClient#Update: Failure sending request: StatusCode=0 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client '2a4ef886-6971-40f6-aabf-76c103401529' with 
  object id '2a4ef886-6971-40f6-aabf-76c103401529' has permission to perform action 'Microsoft.Compute/virtualMachineScaleSets/write' on scope '/subscriptions/d7239c35-4bbf-40c6-9dcd-637b374e1e95/resourceGroups/MC_zzz-dev-kubernetes_westeurope/providers/Microsoft.Compute/virtualMachineScaleSets/aks-apppool1-41741072-vmss'; 
  however, it does not have permission to perform action 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' on the linked scope(s) '/subscriptions/1e4d3a78-3dfe-4060-afe3-340df979be2b/resourcegroups/zzz/providers/microsoft.managedidentity/userassignedidentities/zzz,
  /subscriptions/1e4d3a78-3dfe-4060-afe3-340df979be2b/resourcegroups/zzz/providers/microsoft.managedidentity/userassignedidentities/zzz' or the linked scope(s) are invalid.

I checked already following points:

• aks service principal has required privileges
• identity for "old" managed identity does not exist anymore on vmss

What can be seen from the message is, that the binding activity tries to use the client id from the old/removed managed identity, not the client id from the new created managed identity. Specs were adjusted to use the new identity and successfully deployed.

Steps To Reproduce see description above

Expected behavior no error

AAD Pod Identity version 1.8.13

Kubernetes version 1.25.5

Additional context

[github-actions[bot]]

This issue is stale because it has been open 14 days with no activity. Please comment or this will be closed in 7 days.

[github-actions[bot]]

This issue was closed because it has been stalled for 21 days with no activity. Feel free to re-open if you are experiencing the issue again.