From 811cc03a0cd18e1f2ecb3262b3841860c96d6be8 Mon Sep 17 00:00:00 2001 From: Todd Wolff Date: Thu, 9 Jul 2026 10:01:33 -0700 Subject: [PATCH 1/2] feat: add assign/action to MSI mock role for ACR pull MI support (ARO-24037) CAPZ needs `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` to attach customer-provided ACR pull managed identities to worker VMs. Add this permission to the mock MSI role in both personal dev and CI e2e subscription RBAC files so the backend validation controller's CheckAccess check passes in dev/test environments. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../e2e-subscription-rbac-assignment-subscription.bicep | 1 + dev-infrastructure/templates/mock-identities.bicep | 1 + 2 files changed, 2 insertions(+) diff --git a/dev-infrastructure/templates/e2e-subscription-rbac-assignment-subscription.bicep b/dev-infrastructure/templates/e2e-subscription-rbac-assignment-subscription.bicep index 9d1327a42cf..0762d656732 100644 --- a/dev-infrastructure/templates/e2e-subscription-rbac-assignment-subscription.bicep +++ b/dev-infrastructure/templates/e2e-subscription-rbac-assignment-subscription.bicep @@ -82,6 +82,7 @@ resource msiMockRole 'Microsoft.Authorization/roleDefinitions@2022-04-01' = { 'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read' 'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write' 'Microsoft.ManagedIdentity/userAssignedIdentities/read' + 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' 'Microsoft.Network/loadBalancers/backendAddressPools/read' 'Microsoft.Network/loadBalancers/backendAddressPools/write' 'Microsoft.Network/loadBalancers/read' diff --git a/dev-infrastructure/templates/mock-identities.bicep b/dev-infrastructure/templates/mock-identities.bicep index f992e38aaac..f2988131359 100644 --- a/dev-infrastructure/templates/mock-identities.bicep +++ b/dev-infrastructure/templates/mock-identities.bicep @@ -169,6 +169,7 @@ resource msiCustomRole 'Microsoft.Authorization/roleDefinitions@2022-04-01' = { 'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read' 'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write' 'Microsoft.ManagedIdentity/userAssignedIdentities/read' + 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' // attach customer-provided MIs (e.g. ACR pull) to VMs via CAPZ 'Microsoft.Network/loadBalancers/backendAddressPools/read' // read backend address pools of LB to check if the backend address pool already exists 'Microsoft.Network/loadBalancers/backendAddressPools/write' // write backend address pools to LB 'Microsoft.Network/loadBalancers/read' // to check if LB exists or not before writing to it From e5a169f6c3d5118ca32c6043df12d00b7b63fa78 Mon Sep 17 00:00:00 2001 From: Todd Wolff Date: Thu, 9 Jul 2026 14:18:30 -0700 Subject: [PATCH 2/2] feat: add assign/action to subscription-scoped MSI mock role definition The previous commit missed the third copy of the dev-msi-mock role in mock-identity-roles.bicep, which would cause role drift depending on which template is deployed. Co-Authored-By: Claude Opus 4.6 (1M context) --- dev-infrastructure/templates/mock-identity-roles.bicep | 1 + 1 file changed, 1 insertion(+) diff --git a/dev-infrastructure/templates/mock-identity-roles.bicep b/dev-infrastructure/templates/mock-identity-roles.bicep index ae62e77e51e..429c313a6a2 100644 --- a/dev-infrastructure/templates/mock-identity-roles.bicep +++ b/dev-infrastructure/templates/mock-identity-roles.bicep @@ -57,6 +57,7 @@ resource msiCustomRole 'Microsoft.Authorization/roleDefinitions@2022-04-01' = { 'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read' 'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write' 'Microsoft.ManagedIdentity/userAssignedIdentities/read' + 'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' 'Microsoft.Network/loadBalancers/backendAddressPools/read' 'Microsoft.Network/loadBalancers/backendAddressPools/write' 'Microsoft.Network/loadBalancers/read'