OCPBUGS-42434: Implement Managed Identity for OpenShift Components by bryan-cox · Pull Request #4690 · openshift/hypershift

bryan-cox · 2024-09-09T18:36:55Z

What this PR does / why we need it:
This PR builds upon:

OCPBUGS-42004: Add capability to Add Microsoft Managed Identity Sidecar Containers to HCP Pod Deployments #4801
OCPBUGS-42434: Add Managed Identity Support in Azure HC API behind AROHCPManagedIdentities Feature gate #4811
OCPBUGS-42434: Implement Managed Identity for HCP Components #4824

This PR integrates the Microsoft adapter sidecar containers for the deployments of the following HCP OpenShift components:

cluster-ingress-operator
cluster-image-registry-operator
cloud-network-config-controller through cluster-network-operator
azure-disk-csi-controller through cluster-storage-operator
azure-file-csi-controller through cluster-storage-operator

Which issue(s) this PR fixes:

Fixes OCPBUGS-42434

Checklist

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.

openshift-ci-robot · 2024-09-09T18:36:58Z

@bryan-cox: This pull request references HOSTEDCP-1872 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.18.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

Which issue(s) this PR fixes:
Fixes HOSTEDCP-1872

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2024-09-09T18:36:59Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-ci · 2024-09-09T18:37:12Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [bryan-cox]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

netlify · 2024-09-09T18:38:24Z

✅ Deploy Preview for hypershift-docs ready!

Name	Link
🔨 Latest commit	`8f26c16`
🔍 Latest deploy log	https://app.netlify.com/sites/hypershift-docs/deploys/66f6a8ee547b07000874b534
😎 Deploy Preview	https://deploy-preview-4690--hypershift-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

openshift-ci-robot · 2024-09-10T13:30:01Z

@bryan-cox: This pull request references HOSTEDCP-1872 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.18.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

Which issue(s) this PR fixes:
Fixes HOSTEDCP-1872

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2024-09-11T00:36:49Z

@bryan-cox: This pull request references HOSTEDCP-1872 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.18.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:
This PR adds Azure HC API fields for managed identity client IDs for HCP components needing access to Azure API and integrates the Microsoft adapter sidecar containers for the deployments of the following HCP components:

CAPZ

Azure cloud provider

Azure KMS

Control plane operater

cluster-ingress-operator

cluster-image-registry-operator

cluster-network-operator

cluster-storage-operator

Which issue(s) this PR fixes:
Fixes HOSTEDCP-1872

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

bryan-cox · 2024-09-25T13:33:34Z

Hey @JoelSpeed do you mind taking a look at the changes to our API here?

Also in conjunction, your thoughts on #4690 (comment)

openshift-ci-robot · 2024-09-25T13:38:27Z

@bryan-cox: This pull request references Jira Issue OCPBUGS-42004, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.18.0) matches configured target version for branch (4.18.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @fxierh

The bug has been updated to refer to the pull request using the external bug tracker.

This pull request references Jira Issue OCPBUGS-42434, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.18.0) matches configured target version for branch (4.18.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (jiezhao@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

What this PR does / why we need it:
This PR adds Azure HC API fields for managed identity client IDs for HCP components needing access to Azure API and integrates the Microsoft adapter sidecar containers for the deployments of the following HCP components:

CAPZ

Azure cloud provider

Azure KMS

Control plane operater

cluster-ingress-operator

cluster-image-registry-operator

cloud-network-config-controller through cluster-network-operator

azure-disk-csi-controller through cluster-storage-operator

azure-file-csi-controller through cluster-storage-operator

Which issue(s) this PR fixes:
Fixes OCPBUGS-42004

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

muraee · 2024-09-25T13:59:45Z

 	flags.StringVar(&opts.NetworkSecurityGroupID, "network-security-group-id", opts.NetworkSecurityGroupID, "The Network Security Group ID to use in the default NodePool.")
 	flags.StringToStringVarP(&opts.ResourceGroupTags, "resource-group-tags", "t", opts.ResourceGroupTags, "Additional tags to apply to the resource group created (e.g. 'key1=value1,key2=value2')")
 	flags.StringVar(&opts.SubnetID, "subnet-id", opts.SubnetID, "The subnet ID where the VMs will be placed.")
+	flags.StringVar(&opts.AzureCCMManagedIdentityClientID, "azure-ccm-mi-client-id", opts.AzureCCMManagedIdentityClientID, "The client id of managed identity related to the azure cloud controller manager.")


shouldn't those be created automatically by the cli?

I am not doing that at this moment because the adapter sidecars do not support managed identity.

muraee · 2024-09-25T14:21:04Z

+	defaultSecurityContext := setDefaultSecurityContext
+
+	// For ARO HCP, the MI sidecar containers need privileged permissions to run
+	if os.Getenv("MANAGED_SERVICE") == hyperv1.AroHCP {


if os.Getenv("MANAGED_SERVICE") == hyperv1.AroHCP
this should be a helper function, IsAro() or smth

openshift-ci-robot · 2024-09-25T14:41:24Z

@bryan-cox: This pull request references Jira Issue OCPBUGS-42434, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.18.0) matches configured target version for branch (4.18.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (jiezhao@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

What this PR does / why we need it:
This PR adds Azure HC API fields for managed identity client IDs for HCP components needing access to Azure API and integrates the Microsoft adapter sidecar containers for the deployments of the following HCP components:

CAPZ

Azure cloud provider

Azure KMS

Control plane operater

cluster-ingress-operator

cluster-image-registry-operator

cloud-network-config-controller through cluster-network-operator

azure-disk-csi-controller through cluster-storage-operator

azure-file-csi-controller through cluster-storage-operator

Which issue(s) this PR fixes:
Fixes OCPBUGS-42004

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2024-09-26T15:01:16Z

@bryan-cox: This pull request references Jira Issue OCPBUGS-42434, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.18.0) matches configured target version for branch (4.18.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @fxierh

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

What this PR does / why we need it:
This PR builds upon:

OCPBUGS-42004: Add capability to Add Microsoft Managed Identity Sidecar Containers to HCP Pod Deployments #4801

OCPBUGS-42434: Add Managed Identity Support in Azure HC API behind AROHCPManagedIdentities Feature gate #4811

This PR adds Azure HC API fields for managed identity client IDs for HCP components needing access to Azure API and integrates the Microsoft adapter sidecar containers for the deployments of the following HCP components:

CAPZ

Azure cloud provider

Azure KMS

Control plane operater

cluster-ingress-operator

cluster-image-registry-operator

cloud-network-config-controller through cluster-network-operator

azure-disk-csi-controller through cluster-storage-operator

azure-file-csi-controller through cluster-storage-operator

Which issue(s) this PR fixes:
Fixes OCPBUGS-42434

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Adds a function to include the managed identity sidecar containers in a deployment. The adapter-init is added as an init container and the adapter-server is added as a sidecar container in the related pod deployment it is included in. Signed-off-by: Bryan Cox <brcox@redhat.com>

Adds fields in the Azure HostedCluster API for the client IDs related to the managed service identities used for the following control plane components: azure cloud provider, KMS, CAPZ, the control plane operator, the image registry operator, cluster ingress operator, cluster network operator/cluster-network-config-controller, azure-disk-controller and azure-file-controller. Signed-off-by: Bryan Cox <brcox@redhat.com>

Initialize the control plane managed identities in the CLI. These are initialized with the client ID of the Service Principal at the moment. Once the Microsoft Adapter sidecar containers support Managed Identities, the CLI will create a new managed identity for each of these fields. Signed-off-by: Bryan Cox <brcox@redhat.com>

This commit replaces the use of Service Principal for Managed Identities for authenticating with Azure API. This commit also adds the Microsoft adapter-init and adapter-server sidecar containers to the deployments of the following HCP components - CAPZ, Azure Cloud Provider (CCM), KMS, and CPO - when deploying on ARO HCP. Signed-off-by: Bryan Cox <brcox@redhat.com>

This commit replaces the use of Service Principal for Managed Identities for authenticating with Azure API. This commit also adds the Microsoft adapter-init and adapter-server sidecar containers to the deployments of cluster-image-registry-operator (CIRO) and cluster-ingress-operator (CIO). This commit also passes the needed environment variables on to cluster-network-operator (CNO) so the operator can add the adapter-init and adapter-server sidecar containers to cloud network config controller (CNCC) and to cluster-storage-operator (CSO) for the azure-disk-csi-controller and azure-file-csi-controller. Signed-off-by: Bryan Cox <brcox@redhat.com>

bryan-cox · 2024-10-18T14:49:16Z

/close

We don't need this now since we are not doing the sidecar containers.

openshift-merge-robot · 2024-10-18T14:49:25Z

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2024-10-18T14:49:27Z

@bryan-cox: Closed this PR.

Details

In response to this:

/close

We don't need this now since we are not doing the sidecar containers.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci-robot · 2024-10-18T14:49:29Z

@bryan-cox: This pull request references Jira Issue OCPBUGS-42434. The bug has been updated to no longer refer to the pull request using the external bug tracker.

Details

In response to this:

What this PR does / why we need it:
This PR builds upon:

OCPBUGS-42004: Add capability to Add Microsoft Managed Identity Sidecar Containers to HCP Pod Deployments #4801

OCPBUGS-42434: Add Managed Identity Support in Azure HC API behind AROHCPManagedIdentities Feature gate #4811

OCPBUGS-42434: Implement Managed Identity for HCP Components #4824

This PR integrates the Microsoft adapter sidecar containers for the deployments of the following HCP OpenShift components:

cluster-ingress-operator

cluster-image-registry-operator

cloud-network-config-controller through cluster-network-operator

azure-disk-csi-controller through cluster-storage-operator

azure-file-csi-controller through cluster-storage-operator

Which issue(s) this PR fixes:

Fixes OCPBUGS-42434

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Sep 9, 2024

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 9, 2024

openshift-ci Bot added do-not-merge/needs-area area/cli Indicates the PR includes changes for CLI area/control-plane-operator Indicates the PR includes changes for the control plane operator - in an OCP release labels Sep 9, 2024

bryan-cox force-pushed the HOSTEDCP-1872 branch 2 times, most recently from 8e7eaec to 448fe4b Compare September 9, 2024 20:09

bryan-cox mentioned this pull request Sep 10, 2024

WIP: Add MSI Support for Azure HostedClusters #4484

Closed

4 tasks

bryan-cox force-pushed the HOSTEDCP-1872 branch 6 times, most recently from 5bb3294 to 40401ab Compare September 10, 2024 13:27

bryan-cox force-pushed the HOSTEDCP-1872 branch 6 times, most recently from d5cf100 to c07eb9a Compare September 11, 2024 00:19

bryan-cox force-pushed the HOSTEDCP-1872 branch from 5be88af to ed31611 Compare September 25, 2024 13:32

bryan-cox commented Sep 25, 2024

View reviewed changes

bryan-cox changed the title ~~OCPBUGS-42004: Integrate Managed Identity Adapter Sidecar Containers for ARO HCP~~ OCPBUGS-42004,OCPBUGS-42434: Integrate Managed Identity Adapter Sidecar Containers for ARO HCP Sep 25, 2024

bryan-cox changed the title ~~OCPBUGS-42004,OCPBUGS-42434: Integrate Managed Identity Adapter Sidecar Containers for ARO HCP~~ OCPBUGS-42004,OCPBUGS-42434: Add Managed Identity Adapter Sidecar Containers for ARO HCP and Implement Managed Identity in HCP Sep 25, 2024

muraee reviewed Sep 25, 2024

View reviewed changes

Comment thread api/hypershift/v1beta1/hostedcluster_types.go Outdated

muraee reviewed Sep 25, 2024

View reviewed changes

bryan-cox changed the title ~~OCPBUGS-42004,OCPBUGS-42434: Add Managed Identity Adapter Sidecar Containers for ARO HCP and Implement Managed Identity in HCP~~ OCPBUGS-42434: Add Managed Identity Adapter Sidecar Containers for ARO HCP and Implement Managed Identity in HCP Sep 25, 2024

openshift-ci-robot removed the jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. label Sep 25, 2024

bryan-cox changed the title ~~OCPBUGS-42434: Add Managed Identity Adapter Sidecar Containers for ARO HCP and Implement Managed Identity in HCP~~ OCPBUGS-42434: Implement Managed Identity in HCP Sep 26, 2024

bryan-cox added 2 commits September 27, 2024 08:45

bryan-cox force-pushed the HOSTEDCP-1872 branch 3 times, most recently from 8c58cb1 to 102aa80 Compare September 27, 2024 13:03

bryan-cox added 3 commits September 27, 2024 11:05

bryan-cox force-pushed the HOSTEDCP-1872 branch from 102aa80 to 143e241 Compare September 27, 2024 15:12

bryan-cox changed the title ~~OCPBUGS-42434: Implement Managed Identity in HCP~~ OCPBUGS-42434: Implement Managed Identity in HCP for OpenShift Components Sep 27, 2024

bryan-cox changed the title ~~OCPBUGS-42434: Implement Managed Identity in HCP for OpenShift Components~~ OCPBUGS-42434: Implement Managed Identity for OpenShift Components Sep 27, 2024

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 18, 2024

openshift-ci Bot closed this Oct 18, 2024

Conversation

bryan-cox commented Sep 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Sep 9, 2024 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci Bot commented Sep 9, 2024

Uh oh!

openshift-ci Bot commented Sep 9, 2024

Uh oh!

netlify Bot commented Sep 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for hypershift-docs ready!

Uh oh!

openshift-ci-robot commented Sep 10, 2024 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Sep 11, 2024 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bryan-cox Sep 25, 2024

Choose a reason for hiding this comment

Uh oh!

bryan-cox Sep 25, 2024

Choose a reason for hiding this comment

Uh oh!

openshift-ci-robot commented Sep 25, 2024

Uh oh!

Uh oh!

muraee Sep 25, 2024

Choose a reason for hiding this comment

Uh oh!

bryan-cox Sep 25, 2024

Choose a reason for hiding this comment

Uh oh!

muraee Sep 25, 2024

Choose a reason for hiding this comment

Uh oh!

openshift-ci-robot commented Sep 25, 2024

Uh oh!

openshift-ci-robot commented Sep 26, 2024

Uh oh!

bryan-cox commented Oct 18, 2024

Uh oh!

openshift-merge-robot commented Oct 18, 2024

Uh oh!

openshift-ci Bot commented Oct 18, 2024

Uh oh!

openshift-ci-robot commented Oct 18, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

bryan-cox commented Sep 9, 2024 •

edited

Loading

openshift-ci-robot commented Sep 9, 2024 •

edited by openshift-ci Bot

Loading

netlify Bot commented Sep 9, 2024 •

edited

Loading

openshift-ci-robot commented Sep 10, 2024 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Sep 11, 2024 •

edited by openshift-ci Bot

Loading