{"record":{"id":"6e957e39f3cb44b0","repo":"kubernetes/kops","slug":"updating-role-assignment-is-not-yet-implemented","errorCode":null,"errorMessage":"updating Role Assignment is not yet implemented","messagePattern":"updating Role Assignment is not yet implemented","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azuretasks/roleassignment.go","lineNumber":158,"sourceCode":"\t\t\treturn fi.RequiredField(\"Name\")\n\t\t}\n\t\treturn nil\n\t}\n\n\t// Check if unchangeable fields won't be changed.\n\tif changes.Name != nil {\n\t\treturn fi.CannotChangeField(\"Name\")\n\t}\n\treturn nil\n}\n\n// RenderAzure creates or updates a Role Assignment.\nfunc (*RoleAssignment) RenderAzure(t *azure.AzureAPITarget, a, e, changes *RoleAssignment) error {\n\tif a == nil {\n\t\treturn createNewRoleAssignment(t, e)\n\t}\n\tif changes.ID != nil && changes.RoleDefID != nil {\n\t\treturn errors.New(\"updating Role Assignment is not yet implemented\")\n\t}\n\treturn nil\n}\n\nfunc createNewRoleAssignment(t *azure.AzureAPITarget, e *RoleAssignment) error {\n\t// We generate the name of Role Assignment here. It must be a valid GUID.\n\troleAssignmentName := uuid.New().String()\n\n\tscope := *e.Scope\n\troleDefID := fmt.Sprintf(\"%s/providers/Microsoft.Authorization/roleDefinitions/%s\", scope, *e.RoleDefID)\n\troleAssignment := authz.RoleAssignmentCreateParameters{\n\t\tProperties: &authz.RoleAssignmentProperties{\n\t\t\tRoleDefinitionID: to.Ptr(roleDefID),\n\t\t\tPrincipalID:      e.VMScaleSet.PrincipalID,\n\t\t},\n\t}\n\tra, err := t.Cloud.RoleAssignment().Create(context.TODO(), scope, roleAssignmentName, roleAssignment)\n\tif err != nil {","sourceCodeStart":140,"sourceCodeEnd":176,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azuretasks/roleassignment.go#L140-L176","documentation":"RoleAssignment RenderAzure only supports creating a new assignment (when no existing assignment `a` is found) or no-op. If the observed assignment exists and the diff contains changes to both ID and RoleDefID, it means kops would need to mutate an existing role assignment — an operation the Azure SDK task layer does not implement — so it fails fast.","triggerScenarios":"kops update cluster against Azure when an existing RoleAssignment's roleDefinitionId must change (e.g. the role assigned to the cluster's identity changed), producing changes to ID and RoleDefID in RenderAzure.","commonSituations":"Changing which Azure role (e.g. Contributor vs Network Contributor) is bound to the cluster's managed identity after the cluster was created; editing role assignment fields in a Terraform-applied cluster and re-running update; drift between applied and desired role assignments.","solutions":["Delete the existing role assignment in Azure (az role assignment delete) and let the next kops update create it anew with the desired role","Revert the role assignment change in the cluster spec so no update is required","Manually create the new assignment, which makes `a` match the expected value so RenderAzure becomes a no-op","Extend RenderAzure to delete-and-recreate the assignment if you maintain a kops fork"],"exampleFix":"// before: changing role on existing assignment causes the error\n// after: delete then re-apply\naz role assignment delete --assignee <principal-id> --role \"Contributor\"\nkops update cluster <name> --yes","handlingStrategy":"validation","validationCode":"if existing != nil && desired.RoleDefID != existing.RoleDefID {\n\t// need delete + recreate, update is unsupported\n\tazRoleAssignmentDelete(existing); createNew(desired)\n}","typeGuard":null,"tryCatchPattern":"if err := ra.RenderAzure(target, a, e, changes); err != nil {\n\tif strings.Contains(err.Error(), \"updating Role Assignment is not yet implemented\") {\n\t\t// delete existing assignment then re-run update\n\t} else { return err }\n}","preventionTips":["Don't change the role definition of an existing assignment in the spec; delete and recreate instead","Review role assignment drift before running kops update on Azure","Treat role assignments as create-only resources in kops Azure task management"],"tags":["azure","role-assignment","rbac","not-implemented"],"backgroundTag":"operation-not-supported","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}