HOW-TO: Deploy AKS with POD Managed Identity and CSI using Terraform and Azure Pipeline

Thanks for this valuable resource! All the documentation sweeps most of these details under the rug with azure CLI instructions and I can't imagine how I could have Terraformed our cluster with pod-managed-identites without this example.

It is worth noting that pod managed identities can exist in any resource group, but since your example places the managed identities in the node resource group and the node agent pool needs permissions in both the node group and the identity group, it isn't clear which one goes where.  

1. Virtual Machine Contributor - belongs in the node resource group
2. Managed Identity Operator - belongs in the group where the user managed identities themselves exist