Using

k8s.rbac.v1.ClusterRole

with Azure AKS, I get this even while recreating a stack from scratch (destroy, then up):

Diagnostics:
  <kubernetes:rbac.authorization.k8s.io/v1:ClusterRole> (clusterRole-storage):
    error: resource system:azure-cloud-provider was not successfully created by the Kubernetes API server : <http://clusterroles.rbac.authorization.k8s.io|clusterroles.rbac.authorization.k8s.io> "system:azure-cloud-provider" already exists

Is this expected? What should I be doing ideally?

That message is coming from the k8s api server, which means that ClusterRole is already present on the cluster. You would have to import and then update the existing role if you want to manage it with Pulumi.