feat: Allow disabling local accounts permission

[mitch-hamm]

Summary

Adds "Azure Kubernetes Service RBAC Cluster Admin" (role ID b1ff04bb-8a4e-4dc4-8eb5-8693973ce19b) to the ABAC condition on the vendor-access "Role Based Access Control Administrator" role assignment.

This is required for the enable_local_accounts=false feature in terraform-azurerm-cloud. When local accounts are disabled on an AKS cluster, Azure RBAC is used for K8s authorization. The Terraform SP needs to assign itself "Azure Kubernetes Service RBAC Cluster Admin" during terraform apply so it can manage K8s resources in subsequent bootstrap steps. Without this role in the ABAC allowlist, that assignment fails with Authorization_RequestDenied.

Why ABAC?

The customer grants the automation SP "Role Based Access Control Administrator" with an ABAC condition that restricts which roles it can assign — preventing the SP from granting itself arbitrary permissions. The allowlist already includes AKS cluster admin/user roles; this change adds the one additional role needed for Azure-RBAC-enabled clusters.

Impact on Existing Customers

This is additive — the ABAC condition only gains a new allowed role, no existing permissions are removed. Existing customers who want to use enable_local_accounts=false will need to re-run terraform apply on their terraform-managed-cloud vendor-access module to pick up the updated condition. Customers not using this feature are unaffected.

Related

• terraform-azurerm-cloud PR: streamnative/terraform-azurerm-cloud#71 (adds enable_local_accounts variable and the role assignment resource that requires this permission)

Test Plan

• Applied updated ABAC condition to test subscription 533d34c1-8210-4979-837d-5223b800c47e via az rest PUT
• Full end-to-end CE provisioning with enable_local_accounts=false succeeded — role assignment no longer hits Authorization_RequestDenied