From 6a6802df1fbcf0dda87be984c6b81dec0d74167f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Aug 2026 00:27:27 +0000
Subject: [PATCH 1/3] Initial plan


From f22784e6c7f1c53ad5129941025d79b08855cbab Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Aug 2026 00:30:07 +0000
Subject: [PATCH 2/3] Remove legacy system node binding

Co-authored-by: bcho <1975118+bcho@users.noreply.github.com>
---
 scripts/aks-flex-config         | 13 -------------
 scripts/test_aks_flex_config.py | 25 +++++++++++++++++++++++++
 2 files changed, 25 insertions(+), 13 deletions(-)
 create mode 100644 scripts/test_aks_flex_config.py

diff --git a/scripts/aks-flex-config b/scripts/aks-flex-config
index 313d3e57..63a2a6a5 100755
--- a/scripts/aks-flex-config
+++ b/scripts/aks-flex-config
@@ -305,19 +305,6 @@ roleRef:
   kind: ClusterRole
   name: system:certificates.k8s.io:certificatesigningrequests:nodeclient
 subjects:
-- apiGroup: rbac.authorization.k8s.io
-  kind: Group
-  name: system:bootstrappers:aks-flex-node
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: aks-flex-node-role
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:node
-subjects:
 - apiGroup: rbac.authorization.k8s.io
   kind: Group
   name: system:bootstrappers:aks-flex-node
diff --git a/scripts/test_aks_flex_config.py b/scripts/test_aks_flex_config.py
new file mode 100644
index 00000000..5b01d2f9
--- /dev/null
+++ b/scripts/test_aks_flex_config.py
@@ -0,0 +1,25 @@
+import re
+import runpy
+import unittest
+from pathlib import Path
+
+
+class RBACManifestTest(unittest.TestCase):
+    def test_contains_only_bootstrap_roles(self):
+        script = Path(__file__).with_name("aks-flex-config")
+        manifest = runpy.run_path(script)["RBAC_MANIFEST"]
+
+        roles = re.findall(r"roleRef:\n(?:  .+\n){2}  name: (.+)", manifest)
+
+        self.assertEqual(
+            [
+                "system:node-bootstrapper",
+                "system:certificates.k8s.io:certificatesigningrequests:nodeclient",
+            ],
+            roles,
+        )
+        self.assertEqual(2, manifest.count("kind: ClusterRoleBinding"))
+
+
+if __name__ == "__main__":
+    unittest.main()

From 8631880ba63396b8775a0fb494e67ce3bda3d0a9 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Aug 2026 00:33:56 +0000
Subject: [PATCH 3/3] Address RBAC setup review feedback

Co-authored-by: bcho <1975118+bcho@users.noreply.github.com>
---
 scripts/aks-flex-config         |  1 +
 scripts/test_aks_flex_config.py | 25 -------------------------
 2 files changed, 1 insertion(+), 25 deletions(-)
 delete mode 100644 scripts/test_aks_flex_config.py

diff --git a/scripts/aks-flex-config b/scripts/aks-flex-config
index 63a2a6a5..59f67ab8 100755
--- a/scripts/aks-flex-config
+++ b/scripts/aks-flex-config
@@ -282,6 +282,7 @@ def build_parser() -> argparse.ArgumentParser:
     return parser
 
 
+# TODO: Remove client-side RBAC setup after migrating to the AKS RP managed API and Azure CLI extension.
 RBAC_MANIFEST = """
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
diff --git a/scripts/test_aks_flex_config.py b/scripts/test_aks_flex_config.py
deleted file mode 100644
index 5b01d2f9..00000000
--- a/scripts/test_aks_flex_config.py
+++ /dev/null
@@ -1,25 +0,0 @@
-import re
-import runpy
-import unittest
-from pathlib import Path
-
-
-class RBACManifestTest(unittest.TestCase):
-    def test_contains_only_bootstrap_roles(self):
-        script = Path(__file__).with_name("aks-flex-config")
-        manifest = runpy.run_path(script)["RBAC_MANIFEST"]
-
-        roles = re.findall(r"roleRef:\n(?:  .+\n){2}  name: (.+)", manifest)
-
-        self.assertEqual(
-            [
-                "system:node-bootstrapper",
-                "system:certificates.k8s.io:certificatesigningrequests:nodeclient",
-            ],
-            roles,
-        )
-        self.assertEqual(2, manifest.count("kind: ClusterRoleBinding"))
-
-
-if __name__ == "__main__":
-    unittest.main()