Azure AKS Extension works for me, but not for EU customer.

@Trevor Blackman

Ensure that your AKS cluster is created with a managed identity, as cluster extensions won't work with service principal-based clusters.

For new clusters created with az aks create, managed identity is configured by default. For existing service principal-based clusters that need to be switched over to managed identity, it can be enabled by running az aks update with the --enable-managed-identity flag. For more information, see Use managed identity.Troubleshoot errors when deploying AKS cluster extensions: https://learn.microsoft.com/en-us/troubleshoot/azure/azure-kubernetes/extensions/cluster-extension-deployment-errors?source=recommendationsIf you have any further queries, do let us know.

Hello Trevor Blackman,

Thank you for posting your question on Microsoft Q&A.

Adding few more additional details to the answer provided by Nikhil Duserla,

Since the error message is generic ("Failed to deploy"), here are few steps to resolve the issue:

1. Ensure the AKS Cluster Uses Managed Identity

AKS extensions require managed identity. If the customer's cluster is using a service principle, extension deployment will fail. So, update your existing cluster to a user-managed identity by running the below command in PowerShell:

Update-AzAksCluster -ResourceGroupName "<rg-name>" -Name "<cluster-name>" -EnableManagedIdentity

Check the link here :Use a managed identity in Azure Kubernetes Service (AKS) - Azure Kubernetes Service | Microsoft Learn

  2. Check Azure Activity Logs

Check for any failed deployment logs or policy blocks using Azure Monitor by running this command in PowerShell:

Get-AzActivityLog -ResourceGroup "<rg-name>" -StartTime (Get-Date).AddDays(-1) | Where-Object {$_.OperationName -like "kubernetesconfiguration/extensions"}

  3. Inspect your AKS Extension and Kubernetes Events by running these commands:

Get-AzAksExtension -ResourceGroupName "<rg-name>" -ClusterName "<cluster-name>" -ClusterType "managedClusters"

kubectl get events -A( Kubernetes events)

 4. Check for Network or Policy Restrictions

Check whether:

• Azure Policies are blocking extensions .
• NSGs, firewalls, or Private Link setups are blocking required outbound traffic.
• Required Microsoft service FQDNs or IPs are accessible.

 5. Review Extension-Related Logs in Kubernetes

If your extension deploys workloads (e.g., via Helm), inspect the deployed pod logs using the below Bash commands:

kubectl get pods -n <extension-namespace>

kubectl logs <pod-name> -n <extension-namespace>

 Please follow the above steps to troubleshoot the issue. If the issue still persists provide few more details to help you further identify the issue:

Extension name and version,Whether the AKS cluster is private or public,Output from Activity Logs or kubectl logs

Please let me know if you need any further clarification or assistance.

Thanks,

Rashmika

Hi Trevor Blackman,

Just following up to confirm if you were able to identify the issue using the above steps. Please let me know if you need any further clarification or assistance.

Thanks,

Rashmika

Hi Trevor Blackman,

Just following up to confirm if you were able to identify the issue using the above steps. Please let me know if you need any further clarification or assistance.

Thanks,

Rashmika