[AKS add-on] Failed to get service account token attrs -- failed to fetch token (forbidden)

[PPACI]

Hello.

I allowed myself to skip the template since this is an issue that is created elsewhere.

What happened
It appears that the addon deployment on AKS is not deploying all the required components.
Indeed it lacks a ClusterRole/ClusterRoleBinding.

Right now, we are manually adding the required files to AKS.

Would it be possible to add it in the future?

reference: kubernetes-sigs/secrets-store-csi-driver#939

[nilekhc]

@PPACI As mentioned by Ji'an Liu This should be available in next release.

Ref: kubernetes-sigs/secrets-store-csi-driver#939 (comment)

[aramase]

cc @ZeroMagic

[aramase]

@ZeroMagic confirmed the fix has been rolled out to all regions.

I was able to validate in southcentralus by enabling the add-on in a new cluster and I see all the required cluster roles

➜ k get clusterrole | grep aks
aks-secretproviderclasses-admin-role 2022-05-25T00:08:19Z
aks-secretproviderclasses-role 2022-05-25T00:08:19Z
aks-secretproviderclasses-viewer-role 2022-05-25T00:08:19Z
aks-secretprovidersyncing-role 2022-05-25T00:08:19Z
aks-secretprovidertokenrequest-role 2022-05-25T00:08:19Z

Closing this issue now. Please feel free to reopen/open a new issue in AKS for issues related to the AKS add-on.