[WIP] feat: add controller that retrieves information about MSI based identities - #4192
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: miguelsorianod The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
| // TODO at some point we will also have to implement logic that retrieves the initial set of credentials for the | ||
| // control plane operators managed identities and for the service managed identity and store it in the Managed | ||
| // Identities Key Vault (a Management Cluster scoped resource). Do we want to do it here at the same time because | ||
| // we are already calling the Managed Identities Data Plane Service and getting credentials here? As relevant context, | ||
| // these set of initial credentials should be stored in the Managed Identities Key Vault before creating the HostedCluster | ||
| // and those credentials have a limited lifespan (unknown which without investigating further). |
There was a problem hiding this comment.
Some things to consider while thinking about this: CS for now uses the OCM clusterID to generate the KV name information.
We'll need a coordinated handover of how the KV name is generated and for the RP to pass the info to CS
| if len(fpaMIDataplaneCredentials.ExplicitIdentities) != len(identitiesToSync) { | ||
| return utils.TrackError(fmt.Errorf("unexpected number of Managed Identities Data Plane Credentials. Expected: %d, Received: %d", len(identitiesToSync), len(fpaMIDataplaneCredentials.ExplicitIdentities))) | ||
| } |
There was a problem hiding this comment.
In this case, can we still backfill the information we've found and only errors out for those MIs that we've not found the info?
83e208a to
38fcbc1
Compare
38fcbc1 to
898324b
Compare
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
Miguel Soriano (@miguelsorianod): The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
Superseded by #6301 |
2 participants
This PR builds on top of #3820.
We add a controller that retrieves the Client ID and Principal ID associated to the following identities associated to an ARO-HCP Cluster:
We leverage Microsoft's Managed Identities Data Plane service to retrieve the information. When the service is not available (outside of AME tenants) the fake managed identities data plane client is leveraged which returns the information associated to the mock msi identity for all requests/responses to it. We do not directly use Azure Go SDK's UserAssignedIdentities client because otherwise we would return the information of clientid+principalid of the passed identities in the payload instead of the actual clientid+principalid that ends up being used in the management cluster side.