1. There is an issue [1] that when a new node added, the scheduler will assign the pending pods before the csinode is populated without honering the volume-attach-limit.

2. The WA is to taint "disk.csi.azure.com/agent-not-ready=value:NoExecute" when creating a new node (manually or autoscale), and CSI Driver will remove that after it thinks all are okay

3. So it need the additional permission for node/csinode, otherwise it threw the error in azure-disk-csi-driver node, see the CI log in [2]

E0322 05:24:52.841260       1 azuredisk.go:690] "Unexpected failure when attempting to remove node taint(s)" err="nodes \"ci-op-kq097ks5-768da-jzxdf-master-1\" is forbidden: User \"system:serviceaccount:openshift-cluster-csi-drivers:azure-disk-csi-driver-node-sa\" cannot get resource \"nodes\" in API group \"\" at the cluster scope"


[1] https://github.com/kubernetes/kubernetes/issues/95911
[2] https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/logs/periodic-ci-openshift-release-master-nightly-4.18-e2e-azure-csi/1903307602989682688/artifacts/e2e-azure-csi/gather-extra/artifacts/pods/openshift-cluster-csi-drivers_azure-disk-csi-driver-node-7k89w_csi-driver.log    

4.19.0-0.nightly-2025-03-21-030708    

Always    

Check azure-disk-csi-driver node log