Remove legacy system:node binding from client setup

[Copilot]

The client setup script still granted bootstrap identities the legacy system:node role. This compatibility binding is no longer required.

• RBAC manifest

  • Remove the aks-flex-node-role ClusterRoleBinding.
  • Retain bootstrap and CSR auto-approval permissions.

• Regression coverage

  • Verify the manifest contains only the required bootstrap-related roles.

• Fixes drop system:node from setup script #292

[hbc (bcho)]

Copilot check e2e failure

[Copilot]

Copilot check e2e failure

Checked attempts 2 and 3: both fail because the Arc identity receives HTTP 403 from listBootstrapData through all 60 retries. The latest main E2E run on the base commit (d09ccdc, run 958) has the identical failure, so this predates and is unrelated to the Kubernetes RBAC change. Attempt 4 is currently running.

[Copilot]

🟢 Approval recommended

The change cleanly removes the legacy system:node binding and preserves the required bootstrap-related RBAC, matching the stated goal with minimal risk.

Pull request overview

This PR updates the workstation-side aks-flex-config helper so that its cluster bootstrap RBAC setup no longer grants the legacy system:node role to bootstrap identities, aligning the setup script with the current, reduced permission requirements.

Changes:

• Removed the aks-flex-node-role ClusterRoleBinding that bound system:bootstrappers:aks-flex-node to system:node.
• Kept only the bootstrapper and CSR auto-approval ClusterRoleBinding resources in the embedded RBAC manifest.
• Added a TODO note to remove client-side RBAC setup once migration to RP-managed/CLI-extension workflows is complete.

File summaries

File	Description
scripts/aks-flex-config	Removes the legacy system:node binding from the embedded RBAC manifest while retaining bootstrap and CSR-related bindings.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.