Update aks-nat-agic to supported version

[codepic]

Template

aks-nat-agic

Issue Details

Repro steps

1. Simply deploy the template
2. Observe error message PodIdentity addon is not allowed since feature 'Microsoft.ContainerService/EnablePodIdentityPreview' is not enabled.
3. Read Microsoft.ContainerService/EnablePodIdentityPreview documentation
4. Observe the following note in the documentation

We recommend you review Azure AD workload identity (preview). This authentication method replaces pod-managed identity (preview), which integrates with the Kubernetes native capabilities to federate with any external identity providers on behalf of the application.

Resolution

Update the aforementioned template to use Use an Azure AD workload identity (preview) instead.

[bmoore-msft]

@paolosalvatori - something you can help with?

[paolosalvatori]

Hi @codepic, when you see a message like

PodIdentity addon is not allowed since feature 'Microsoft.ContainerService/EnablePodIdentityPreview' is not enabled

it means that you have to enable a preview feature before using it. For this feature, in particular, see Use Azure Active Directory pod-managed identities in Azure Kubernetes Service (Preview). Now, Azure AD Pod Identity has been replaced by Azure AD Workload Identity. For more information, see:

• Azure Workload Identity open-source project
• Use an Azure AD workload identity on Azure Kubernetes Service (AKS
• Deploy and configure workload identity on an Azure Kubernetes Service (AKS) cluster
• Modernize application authentication with workload identity sidecar
• Tutorial: Use a workload identity with an application on Azure Kubernetes Service (AKS)
• Workload identity federation
• Azure Managed Identities with Workload Identity Federation
• Azure AD workload identity federation with Kubernetes
• Azure Active Directory Workload Identity Federation with external OIDC Identity Providers
• Minimal Azure AD Workload identity federation

If you are not interested in any of these features, you can disable or remove them from the ARM template. Hope this helps.