feat: prepare mi mock information for backend but do not set it in the deployment yet

.yamllint.yml

@@ -35,6 +35,7 @@ ignore:
 - 'velero/deploy/templates/install-job.yaml'
 - 'maestro/server/deploy/templates/allow-cluster-service.authorizationpolicy.yaml'
 - 'maestro/server/deploy/templates/allow-backend.authorizationpolicy.yaml'
+- 'backend/deploy/templates/backend.service-key-vault.secretproviderclass.yaml'
 rules:
   brackets: enable
   colons: enable

backend/deploy/templates/backend.service-key-vault.secretproviderclass.yaml

@@ -14,6 +14,12 @@ spec:
           objectName: '{{ .Values.fpa.certName }}'
           objectType: secret
           objectAlias: fpa-cert-bundle
+{{- if .Values.miMock.certName }}
+        - |
+          objectName: '{{ .Values.miMock.certName }}'
+          objectType: secret
+          objectAlias: mi-mock-cert-bundle
+{{- end }}
     tenantId: '{{ .Values.azure.tenantId }}'
     usePodIdentity: "false"
   provider: azure

backend/values.yaml

@@ -30,6 +30,19 @@ fpa:
   # to the certificate
   certName: "{{ .firstPartyAppCertificate.name }}"
   clientId: "{{ .firstPartyAppClientId }}"
+# MI Mock, also known as Mock MSI or Mock MSI Identity. It is a common Azure Service Principal identity.
+# It is used in the ARO-HCP environments where Microsoft's Managed Identities Dataplane service is not available. In
+# those environments, the MI Mock Identity is leveraged by the Control Plane operators and the Service Managed Identity
+# associated to the ARO-HCP Clusters to interact with Azure.
+miMock:
+  # certName is the name of the certificate in Azure Key Vault. It can be used
+  # to reference the associated Certificate, Secret and Key objects associated
+  # to the certificate
+  certName: "{{ .miMockCertName }}"
+  clientId: "{{ .miMockClientId }}"
+  principalId: "{{ .miMockPrincipalId }}"
+  # The Azure Tenant ID where the MI Mock Identity is registered.
+  tenantId: "{{ .miMockTenantId }}"
 azure:
   cloudEnvironmentName: "{{ .cloudEnvironmentName }}"
   # The Azure Tenant ID where backend service is running. In values.yaml we

backend/zz_fixture_TestHelmTemplate_dev_westus3_svc_1_aro_hcp_backend_dev.yaml

@@ -123,7 +123,7 @@ spec:
         app: aro-hcp-backend
         azure.workload.identity/use: "true"
       annotations:
-        checksum/backendservicekeyvault: '67b31416c594e3f1f3e7754fc18a9da8bf47bfa45d09f9ed568db2d0d14a2544'
+        checksum/backendservicekeyvault: 'd76b8f7a5cfa15bb0951ea1e9fd6cac34015808f8c7816410ae96b0c19a9d375'
         checksum/azureruntimeconfig: '40e0cf247edb3f1d1eb59cd97663f8ab2cf029da7a96716ee8916d38ac9fb0e5'
     spec:
       topologySpreadConstraints:
@@ -290,6 +290,10 @@ spec:
           objectName: 'firstPartyCert2'
           objectType: secret
           objectAlias: fpa-cert-bundle
+        - |
+          objectName: 'msiMockCert2'
+          objectType: secret
+          objectAlias: mi-mock-cert-bundle
     tenantId: '__tenantId__'
     usePodIdentity: "false"
   provider: azure

config/config.schema.json

@@ -1296,6 +1296,9 @@
     "miMockPrincipalId": {
       "type": "string"
     },
+    "miMockTenantId": {
+      "type": "string"
+    },
     "miMockCertName": {
       "type": "string"
     },

config/config.yaml

@@ -847,6 +847,7 @@ defaults:
   # Mock Managed Identities - not relevant for most MSFT envs
   miMockClientId: ""
   miMockPrincipalId: ""
+  miMockTenantId: ""
   miMockCertName: ""
   armHelperClientId: ""
   armHelperFPAPrincipalId: ""
@@ -965,6 +966,7 @@ clouds:
       # Mock Managed Identities Service Princiapl
       miMockClientId: e8723db7-9b9e-46a4-9f7d-64d75c3534f0
       miMockPrincipalId: d6b62dfa-87f5-49b3-bbcb-4a687c4faa96
+      miMockTenantId: 64dc69e4-d083-49fc-9569-ebece1dd1408
       miMockCertName: msiMockCert2
       # ARM Helper
       armHelperClientId: 3331e670-0804-48e8-a086-6241671ddc93

config/rendered/dev/cspr/westus3.yaml

@@ -573,6 +573,7 @@ mgmtKeyVault:
 miMockCertName: msiMockCert2
 miMockClientId: e8723db7-9b9e-46a4-9f7d-64d75c3534f0
 miMockPrincipalId: d6b62dfa-87f5-49b3-bbcb-4a687c4faa96
+miMockTenantId: 64dc69e4-d083-49fc-9569-ebece1dd1408
 mise:
   arm:
     applicationId: e2c2ff5c-e5b4-4e79-8c3e-1da8c48461e7

config/rendered/dev/dev/westus3.yaml

@@ -573,6 +573,7 @@ mgmtKeyVault:
 miMockCertName: msiMockCert2
 miMockClientId: e8723db7-9b9e-46a4-9f7d-64d75c3534f0
 miMockPrincipalId: d6b62dfa-87f5-49b3-bbcb-4a687c4faa96
+miMockTenantId: 64dc69e4-d083-49fc-9569-ebece1dd1408
 mise:
   arm:
     applicationId: e2c2ff5c-e5b4-4e79-8c3e-1da8c48461e7

config/rendered/dev/perf/westus3.yaml

@@ -573,6 +573,7 @@ mgmtKeyVault:
 miMockCertName: msiMockCert2
 miMockClientId: e8723db7-9b9e-46a4-9f7d-64d75c3534f0
 miMockPrincipalId: d6b62dfa-87f5-49b3-bbcb-4a687c4faa96
+miMockTenantId: 64dc69e4-d083-49fc-9569-ebece1dd1408
 mise:
   arm:
     applicationId: e2c2ff5c-e5b4-4e79-8c3e-1da8c48461e7

config/rendered/dev/pers/westus3.yaml

@@ -575,6 +575,7 @@ mgmtKeyVault:
 miMockCertName: msiMockCert2
 miMockClientId: e8723db7-9b9e-46a4-9f7d-64d75c3534f0
 miMockPrincipalId: d6b62dfa-87f5-49b3-bbcb-4a687c4faa96
+miMockTenantId: 64dc69e4-d083-49fc-9569-ebece1dd1408
 mise:
   arm:
     applicationId: e2c2ff5c-e5b4-4e79-8c3e-1da8c48461e7

config/rendered/dev/prow/westus3.yaml

@@ -575,6 +575,7 @@ mgmtKeyVault:
 miMockCertName: msiMockCert2
 miMockClientId: e8723db7-9b9e-46a4-9f7d-64d75c3534f0
 miMockPrincipalId: d6b62dfa-87f5-49b3-bbcb-4a687c4faa96
+miMockTenantId: 64dc69e4-d083-49fc-9569-ebece1dd1408
 mise:
   arm:
     applicationId: e2c2ff5c-e5b4-4e79-8c3e-1da8c48461e7

config/rendered/dev/swft/uksouth.yaml

@@ -575,6 +575,7 @@ mgmtKeyVault:
 miMockCertName: msiMockCert2
 miMockClientId: e8723db7-9b9e-46a4-9f7d-64d75c3534f0
 miMockPrincipalId: d6b62dfa-87f5-49b3-bbcb-4a687c4faa96
+miMockTenantId: 64dc69e4-d083-49fc-9569-ebece1dd1408
 mise:
   arm:
     applicationId: e2c2ff5c-e5b4-4e79-8c3e-1da8c48461e7