var lookupManagedCluster = GetManagedCluster.Invoke(new GetManagedClusterInvokeArgs
        {
            ResourceGroupName = rgName,
            ResourceName = cluster.Name
        });

        
        var kubernetesIdentityNetworkRoleAssignment = new RoleAssignment("kubernetesIdentityNetworkRoleAssignment", new RoleAssignmentArgs
        {
            PrincipalId = lookupManagedCluster.Apply(c => c.Identity.PrincipalId),
            PrincipalType = PrincipalType.ServicePrincipal,
            // "network contributor"
            RoleDefinitionId = C.AzureNetworkContributorRoleId,
            // Cluster needs access to network in order to provision extra load balancers
            Scope = $"/subscriptions/{currentSubscription}/resourceGroups/{networkResourceGroup}",
        });