feat: discover role assignment quota from Azure

[roi (roivaz)]

Tracking: https://redhat.atlassian.net/browse/AROSLSRE-1789

What

• Query Microsoft.Authorization/roleAssignmentsUsageMetrics for each configured subscription.
• Export both role-assignment usage and the subscription-specific limit returned by Azure.
• Replace the paginated role-assignment listing with one authoritative API request.
• Keep the existing roleAssignmentLimit deployment configuration temporarily for rollout compatibility.
• Update subscription onboarding documentation because static limit configuration is no longer required by the new exporter.
• Keep the existing Prometheus metric names and labels unchanged.

Why

Role-assignment limits can differ between subscriptions and change after quota increases. Azure already exposes the authoritative current count and limit, so the exporter should not depend on a static value.

This code PR must land and its image digest must be rolled out before the follow-up config cleanup PR. The new binary safely ignores the legacy roleAssignmentLimit field; the old binary would default missing values to 4000, producing incorrect limits for subscriptions configured at 8000.

Follow-up config cleanup: #6505

Testing

• go test ./... in tooling/tenant-quota
• go build ./... in tooling/tenant-quota
• targeted golangci-lint for tooling/tenant-quota/...
• compatibility unit test proving the new config parser accepts the legacy roleAssignmentLimit field
• audited docs/ for other static role-assignment-limit configuration references
• make run with live DEV credentials; /healthz and /readyz returned OK and all 11 configured subscriptions exported RBAC usage and API-reported limits

PR Checklist

• PR is scoped to a single task (no mixed concerns)
• Title follows Conventional Commits format
• Summary explains the "Why" behind the change
• Linked to relevant ticket/issue
• Screenshots included (if graph/UI/metrics changes) — metric schema and visualizations are unchanged
• Self-reviewed the diff
• CI/CD checks are passing (ignore Tide) — pending draft PR CI
• Draft PR used for WIP (if applicable)
• Commit history is clean (rebased/squashed)
• Tricky code blocks are commented
• Specific reviewers tagged — intentionally deferred until author review
• All comment threads resolved before merge

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: roivaz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• docs/OWNERS [roivaz]
• tooling/OWNERS [roivaz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Copilot]

Pull request overview

This PR updates the tooling/tenant-quota exporter to query role assignment usage + limit directly from Azure’s Microsoft.Authorization/roleAssignmentsUsageMetrics endpoint per subscription, removing reliance on a statically configured per-subscription limit while preserving rollout compatibility.

Changes:

• Replaces paginated role assignment listing with a single ARM request that returns both current usage and the subscription-specific limit.
• Removes roleAssignmentLimit from the Go runtime config model while keeping legacy YAML compatibility (unknown field ignored) and updates unit tests accordingly.
• Updates onboarding and tenant-quota documentation to reflect that role assignment limits are now discovered from Azure.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tooling/tenant-quota/README.md	Documents that RBAC usage/limits are retrieved from Azure rather than configured.
tooling/tenant-quota/pkg/subscriptionquota/roleassignments.go	Switches RBAC quota collection to a metrics-based client instead of listing role assignments.
tooling/tenant-quota/pkg/subscriptionquota/roleassignments_test.go	Reworks tests around injected metrics client and error paths.
tooling/tenant-quota/pkg/subscriptionquota/roleassignmentmetrics.go	Adds a minimal ARM client to call roleAssignmentsUsageMetrics and validate response shape.
tooling/tenant-quota/pkg/subscriptionquota/roleassignmentmetrics_test.go	Adds transport-level unit tests for request construction and error handling.
tooling/tenant-quota/pkg/subscriptionquota/collector.go	Updates default sources to use the new RBAC source constructor.
tooling/tenant-quota/pkg/config/config.go	Removes static role-assignment limit config fields/constants.
tooling/tenant-quota/pkg/config/config_test.go	Adds coverage proving legacy roleAssignmentLimit YAML is ignored.
tooling/tenant-quota/go.mod	Drops unused armauthorization SDK dependency.
tooling/tenant-quota/go.sum	Removes corresponding armauthorization checksums.
docs/ci/e2e-subscription-onboarding.md	Updates onboarding steps to remove the static roleAssignmentLimit requirement.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated no new comments.