AKS cluster cannot create succeed in own vnet/subnet

Question

ProvisioningState/failed/VMExtensionProvisioningError

Answer 1

Hi Nolan Le,

Thank you for the patience.

Please try to ensure by whitelisting this address "acs-mirror.azureedge.net" in your firewall as this address is for the repository required to download and install required binaries like kubenet and Azure CNI to overcome VMExtensionProvisioningError issues during aks cluster creation with a VMSS node pool. https://learn.microsoft.com/en-us/azure/aks/outbound-rules-control-egress#azure-global-required-fqdn--application-rules

Please use below documentation to create a firewall to whitelist the acs-mirror.azureedge.net address. https://learn.microsoft.com/en-us/azure/aks/limit-egress-traffic?tabs=aks-with-system-assigned-identities

Execute a curl command to verify that your nodes can download the binaries: https://learn.microsoft.com/en-us/troubleshoot/azure/azure-kubernetes/create-upgrade-delete/error-code-cnidownloadtimeoutvmextensionerror

curl https://acs-mirror.azureedge.net/cni/azure-vnet-cni-linux-amd64-v1.0.25.tgz

Please refer to the discussion issue on GitHub Tech Community for more information on similar issue VMExtensionProvisioningError for troubleshooting the error:

https://github.com/Azure/AKS/issues/4353

https://github.com/Azure/AKS/issues/4792

Answer 2

Hi Nolan Le,

In continuation to above, I have tried working in my tenant its working for me as I can able to create aks cluster within existing vnet and subnet and please follow given below steps to resolve the issue -

Ensure your Service Principal have Contributor permission.

Please try to execute below command in Azure Cloud Shell.

az aks create --resource-group <your resource group name> --name <name of your aks cluster> --node-count <node count> --generate-ssh-keys --service-principal <application(client)ID> --client-secret <client secret> --network-plugin azure --vnet-subnet-id <your subnet ID> --service-cidr <service cidr> --dns-service-ip <your dns service ip>

Make sure that service cidr should not overlap with subnet cidr and dns-service-ip is an IP from the range specified in service cidr. https://learn.microsoft.com/en-us/troubleshoot/azure/azure-kubernetes/create-upgrade-delete/error-code-servicecidroverlapexistingsubnetscidr

To find out Subnet ID:

If you encounter any issue during the execution of above command like "Azure subscription is not registered to use the 'Microsoft.ContainerService' namespace" try to execute below command:

az provider register --namespace Microsoft.ContainerService

and wait for some time till the registration is completed, you can check by using below command:

az provider show --namespace Microsoft.ContainerService --query registrationState

If the information is helpful, please click on "Accept Answer" and "Upvote"

If you have any queries, please do let us know, we will help you.