This is an ingress controller that can be run on Azure Kubernetes Service (AKS) to allow an Azure Application Gateway to act as the ingress for an AKS cluster.
Is your feature request related to a problem? Please describe.
When using the AGIC addon, a managed identity called ingressapplicationgateway-<cluster> is automatically created with Contributor role assignment on the Resource Group level.
I couldn't find where this behavior is documented, other than that we should grant it Network Contributor, although it is already has Contributor.
Describe the solution you'd like
Either restrict the role assignment and use Network Contributor or grant us a way to specify which Managed Identity is used instead of automatically creating one and instead of automatically assigning it a Contributor role.
Is your feature request related to a problem? Please describe. When using the AGIC addon, a managed identity called
ingressapplicationgateway-<cluster>is automatically created with Contributor role assignment on the Resource Group level. I couldn't find where this behavior is documented, other than that we should grant itNetwork Contributor, although it is already hasContributor.Describe the solution you'd like Either restrict the role assignment and use
Network Contributoror grant us a way to specify which Managed Identity is used instead of automatically creating one and instead of automatically assigning it aContributorrole.