ARO-24037: add assign/action to MSI mock role for ACR pull MI support#6005
ARO-24037: add assign/action to MSI mock role for ACR pull MI support#6005twolff-gh wants to merge 2 commits into
Conversation
…-24037) CAPZ needs `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` to attach customer-provided ACR pull managed identities to worker VMs. Add this permission to the mock MSI role in both personal dev and CI e2e subscription RBAC files so the backend validation controller's CheckAccess check passes in dev/test environments. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Skipping CI for Draft Pull Request. |
There was a problem hiding this comment.
Pull request overview
Updates the dev/test “MSI mock” custom role definitions to include the Microsoft.ManagedIdentity/userAssignedIdentities/assign/action permission required for CAPZ to attach customer-provided user-assigned managed identities (e.g., ACR pull) to worker VMs, so backend CheckAccess validation succeeds in non-prod environments.
Changes:
- Add
Microsoft.ManagedIdentity/userAssignedIdenties/assign/actionto the mock MSI custom role in the personal-dev deployment template. - Add the same permission to the per-subscription E2E RBAC template used for CI customer subscriptions.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| dev-infrastructure/templates/mock-identities.bicep | Adds assign/action to the dev MSI mock custom role actions list (with inline rationale comment). |
| dev-infrastructure/templates/e2e-subscription-rbac-assignment-subscription.bicep | Adds assign/action to the E2E subscription-scoped MSI mock role definition. |
The previous commit missed the third copy of the dev-msi-mock role in mock-identity-roles.bicep, which would cause role drift depending on which template is deployed. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
/retest |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bennerv, twolff-gh The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@twolff-gh: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
ARO-24037
What
Add
Microsoft.ManagedIdentity/userAssignedIdentities/assign/actionto thedev-msi-mockcustom role in bothmock-identities.bicep(personal dev) ande2e-subscription-rbac-assignment-subscription.bicep(CI e2e subscriptions).Why
ARO-24037 adds customer-provided managed identities for ACR image pulls. CAPZ needs
assign/actionto attach these MIs to worker VMs. A backend validation controller verifies this permission via CheckAccess. Without this role update, that check fails in dev/test because the mock MSI role doesn't include the permission.This is the same permission granted by the
Managed Identity Operatorbuilt-in role in production.Testing
No tests — this is a role definition change in bicep. Verified by deploying the mock role update and confirming the backend validation controller's CheckAccess passes.
Special notes for your reviewer
PR Checklist