Azure passthrough docs #435

joelddiaz · 2021-12-20T21:15:36Z

Update docs to reflect removed support for Azure Mint mode

xref: https://issues.redhat.com/browse/CCO-173

joelddiaz · 2021-12-20T21:17:54Z

wait for #433 to merge
/hold
/assign @akhil-rane
/assign @lwan-wanglin @jeana-redhat @sferich888

jeana-redhat · 2021-12-20T21:44:45Z

LGTM! /label docs-approved

jeana-redhat · 2021-12-20T21:45:31Z

oops I think my approval might need to be on a new line?
/label docs-approved

akhil-rane

minor nits

akhil-rane · 2021-12-20T21:45:40Z

docs/azure-mint-mod-removal.md

+
+For a cluster previously installed/running in Mint mode, CCO will update existing Secrets containing the credentials of previously minted App Registrations/Service Principals with the contents of the Secret kube-system/azure-credentials (normally containing the credentials used during installation). It is required that the permissions associated with the credentials in this Secret be sufficient to be used by all in-cluster components needing to interact with Azure APIs.
+
+CCO will also try to clean up previously minted App Registrations/Service Principals while the Azure AD Graph API is still functional. If the cluster is upgraded to a version of OpenShift that no longer supports Mint mode after the Azure AD Graph API is sunset, CCO will set a condition on the associated CredentialsRequest and will not treat the error as fatal. Cleanup after the Azure AD Graph API is sunset will require manual intervention to remove the App Registrations/Service Principals that are no longer necessary.


Do we want to mention the name of the condition that CCO will set?

That would be nice esp. if it could help troubleshoot/manual clean up if needed (not sure if that's the case)

I put the name of the condition and an example of the kind of message that would be associated with that condition.

akhil-rane · 2021-12-20T21:45:45Z

docs/azure-mint-mod-removal.md

+
+## Future
+
+Rather than re-implement support for Mint mode using the new [Microsoft Graph API](https://docs.microsoft.com/en-us/graph/sdks/create-requests?tabs=Go), the intention is to support Azure federated OpenID identities along with pod/workload identity as the prefered in-cluster credentials/authentication mode if/when Azure releases support for this feature.


Suggested change

Rather than re-implement support for Mint mode using the new [Microsoft Graph API](https://docs.microsoft.com/en-us/graph/sdks/create-requests?tabs=Go), the intention is to support Azure federated OpenID identities along with pod/workload identity as the prefered in-cluster credentials/authentication mode if/when Azure releases support for this feature.

Rather than re-implement support for Mint mode using the new [Microsoft Graph API](https://docs.microsoft.com/en-us/graph/sdks/create-requests?tabs=Go), the intention is to support Azure federated OpenID identities along with pod/workload identity as the preferred in-cluster credentials/authentication mode if/when Azure releases support for this feature.

codecov · 2021-12-20T22:24:05Z

Codecov Report

Merging #435 (0979707) into master (32b6237) will not change coverage.
The diff coverage is n/a.

❗ Current head 0979707 differs from pull request most recent head 78b398f. Consider uploading reports for the commit 78b398f to get more accurate results

@@           Coverage Diff           @@
##           master     #435   +/-   ##
=======================================
  Coverage   46.17%   46.17%           
=======================================
  Files          91       91           
  Lines        9236     9236           
=======================================
  Hits         4265     4265           
  Misses       4455     4455           
  Partials      516      516

joelddiaz · 2021-12-20T23:02:28Z

#433 merged
/unhold

lwan-wanglin · 2021-12-21T05:42:36Z

/label qe-approved

akhil-rane · 2021-12-21T14:55:34Z

/lgtm

openshift-ci · 2021-12-21T14:59:11Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: akhil-rane, joelddiaz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [akhil-rane,joelddiaz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-bot · 2021-12-21T16:00:32Z

/retest-required