Fix Arc machine RBAC for listBootstrapData

[Copilot]

Arc-mode E2E node joins consistently failed with HTTP 403 on listBootstrapData (15 min of retries exhausted), while the MSI Flex Node join in the same run succeeded.

Root cause

infra/main.bicep grants the MSI VM identity three built-in AKS roles at the cluster scope (Cluster Admin, Contributor, RBAC Cluster Admin). The Arc machine identity doesn't exist until after azcmagent connect, so it can't be pre-provisioned via bicep — hack/e2e/lib/node-join-arc.sh instead assigns roles at runtime, but only granted Contributor, one of the three roles the MSI identity relies on for the same calls.

Fix

• hack/e2e/lib/node-join-arc.sh: added the missing Cluster Admin and RBAC Cluster Admin role definition IDs (matching the bicep constants) and loop over all three roles when assigning them to the Arc machine principal, mirroring exactly what the MSI VM gets in infra/main.bicep.

for role_definition_id in \
  "${aksClusterAdminRoleDefinitionID}" \
  "${aksContributorRoleDefinitionID}" \
  "${aksRBACClusterAdminRoleDefinitionID}"; do
  az role assignment create \
    --assignee-object-id "${principal_id}" \
    --assignee-principal-type ServicePrincipal \
    --role "${role_definition_id}" \
    --scope "${cluster_id}" \
    --output none
done

• Fixes fix arc machine rbac #294

[Copilot]

Pull request overview

This PR fixes Arc-mode E2E node-join failures by aligning the Arc machine identity’s RBAC assignments with the MSI Flex Node identity so listBootstrapData and related AKS Machine operations don’t hit HTTP 403 (Issue #294).

Changes:

• Add missing built-in AKS role definition IDs (Cluster Admin, RBAC Cluster Admin) to the Arc join script.
• Assign all three required roles to the Arc machine principal at runtime (mirroring the MSI VM assignments in bicep).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[hbc (bcho)]

Copilot please address comments

[Copilot]

Copilot please address comments

Addressed both comments in 85a90f7: corrected the Bicep path and made role assignment retries tolerate only RoleAssignmentExists while preserving other failures.

[Copilot]

🟢 Approval recommended

The change is small, directly addresses the documented 403 root cause by matching the MSI node’s RBAC grants, and adds safe idempotent handling for existing assignments.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0 new
• Review effort level: Lite