This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(163.2, 2%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECN%3C/text%3E%3C/svg%3E)
Hi, we have a subnet associated with a route table, while creating a (aks) cluster using that subnet it is showing an error saying we cannot use a subnet with a route table attached, for this I am removing the route table and using that subnet for cluster creation, while doing this my other services are getting down due to routing. Why is it showing that error and how can I achieve this without removing the route table to the subnet?
the error I get System-assigned managed identity not supported subnet with route table, when I use the option bring my own network.
Hello Charan Nalam
You are right
For system-assigned managed identity, it's only supported to provide your own subnet and route table via Azure CLI because Azure CLI automatically adds the role assignment. If you're using an ARM template or other clients, you must use a user-assigned managed identity, assign permissions before cluster creation, and ensure the user-assigned identity has write permissions to your custom subnet and custom route table.
When you create and use your own VNet and route table with the kubenet network plugin, you must configure a user-assigned managed identity for the cluster. With a system-assigned managed identity, you can't retrieve the identity ID before creating a cluster, which causes a delay during role assignment.
Both system-assigned and user-assigned managed identities are supported when you create and use your own VNet and route table with the Azure network plugin. We highly recommend using a user-assigned managed identity for BYO scenarios.
https://learn.microsoft.com/en-us/azure/aks/configure-kubenet
Hi Andriy,
Thanks for your response, I understand we need to create a user-assigned managed identity, do we need that role created for Vnet we are going to use to create a cluster and what role do we need to give when creating it? Can you please provide more information on that?
Hi Charan,
Yes, you will need to create a user-assigned managed identity and grant it the appropriate role to access the virtual network where you plan to create the AKS cluster.
Once the managed identity is created, you can grant it the "Network Contributor" role on the virtual network where you plan to create the AKS cluster. This role allows the managed identity to manage network resources in the virtual network, including creating and managing subnets.
Hi, I did as you mentioned and still, it is throwing that error, system-assigned managed identity not supported subnet with route table, in between I want to inform you that I am trying to create this cluster manually in the azure portal, does this affect in creating the cluster using bring your own network option?
Hello @Charan Nalam
Thanks for getting back with the detailed explanation. This issue needs deeper investigation and Azure technical support team will be able to help with this. I would recommend you open an azure support case. If you don't have the ability to open a technical support ticket, please let me know and I can help you further with this.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(265.6, 28.999999999999996%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHS%3C/text%3E%3C/svg%3E)
Hi Prrudram,
We're dealing with a similar issue: we can't assign the managed identity during the AKS creation when deploying it in the portal. Are there any updates on this issue?
This issue needs deeper investigation and Azure technical support team will be able to help with this. I would recommend you open an azure support case.