[WIP] feat: add controller that calculates Cluster Data Plane Identities extra information - #4193
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: miguelsorianod The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
| continue | ||
| } | ||
|
|
||
| if len(currentMI.ClientID) == 0 || len(currentMI.PrincipalID) == 0 || len(currentMI.OperatorName) == 0 { |
There was a problem hiding this comment.
For when we allow updates of MI; we'll need to also sync the identities if currentMI info != newUpdatedInfo.
6bb6ada to
5fab4cf
Compare
5fab4cf to
5caac0b
Compare
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
| } | ||
|
|
||
| smiResourceID := existingCluster.CustomerProperties.Platform.OperatorsAuthentication.UserAssignedIdentities.ServiceManagedIdentity | ||
| uaisClient, err := c.smiClientBuilder.UserAssignedIdentitiesClient(ctx, existingCluster.ServiceProviderProperties.ManagedIdentitiesDataPlaneIdentityURL, smiResourceID, existingCluster.ID.SubscriptionID) |
There was a problem hiding this comment.
| uaisClient, err := c.smiClientBuilder.UserAssignedIdentitiesClient(ctx, existingCluster.ServiceProviderProperties.ManagedIdentitiesDataPlaneIdentityURL, smiResourceID, existingCluster.ID.SubscriptionID) | |
| userAssignedIdentitiesClient, err := c.smiClientBuilder.UserAssignedIdentitiesClient(ctx, existingCluster.ServiceProviderProperties.ManagedIdentitiesDataPlaneIdentityURL, smiResourceID, existingCluster.ID.SubscriptionID) |
don't be stingy.
| existingServiceProviderCluster.Status.DataPlaneOperatorsManagedIdentities = make(map[string]*api.ServiceProviderClusterDataPlaneOperatorManagedIdentity) | ||
| } | ||
|
|
||
| for _, desired := range desiredDataPlaneOperatorsManagedIdentities { |
There was a problem hiding this comment.
as written, entries created here can never be cleared. An "add only" map smells wrong. What clears unnecessary or extra entries over time.
There was a problem hiding this comment.
Seems like we need to ensure taht serviceprovidercluster should have its entries trimmed of any that don't exist in existingCluster.CustomerProperties.Platform.OperatorsAuthentication.UserAssignedIdentities.DataPlaneOperators
| type ServiceProviderClusterDataPlaneOperatorManagedIdentity struct { | ||
| OperatorName string `json:"operatorName"` | ||
| ResourceID *azcorearm.ResourceID `json:"resourceID"` | ||
| ClientID string `json:"clientID"` |
There was a problem hiding this comment.
this can be missing. pointer.
There was a problem hiding this comment.
I am using the empty string as the missing indicator. In that way there are no three different sets of values to have to consider: nil, empty string, non empty string
| OperatorName string `json:"operatorName"` | ||
| ResourceID *azcorearm.ResourceID `json:"resourceID"` | ||
| ClientID string `json:"clientID"` | ||
| PrincipalID string `json:"principalID"` |
There was a problem hiding this comment.
this can be missing. pointer.
|
Miguel Soriano (@miguelsorianod): The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
Superseded by #6300 |
4 participants
We add a controller that retrieves the Client ID and Principal ID associated to the Data Plane operators identities associated to the ARO-HCP Cluster.
We leverage the Service Managed Identity associated to the ARO-HCP Cluster to retrieve the Data Plane operators identities information. We use Azure Go SDK's UserAssignedIdentities API to retrieve it. This is a different method than what's done for MSI based identities where the Managed Identities Data Plane service is used instead (#3820). This is because for the control plane identities. on the environments where the managed identities data plane service is not available we use the mi mock identity instead, which includes its clientid+principalid instead of the ones associated to the identities passed in the cluster payload. By using the mock managed identities data plane client we retrieve that transparently.