-
Story
-
Resolution: Done
-
Undefined
-
None
-
None
-
None
-
None
-
Strategic Product Work
-
5
-
False
-
None
-
False
-
OCPSTRAT-506 - ARO Managed Identity
-
Sprint 235, Sprint 237, Sprint 236, Sprint 238
User Story:
As a cluster admin I want to be able to:
- use the managed identity from the installer host VM (running in Azure)
so that I can
- install a cluster without copying credentials to the installer host
Acceptance Criteria:
Description of criteria:
- Installer (azure sdk) & terraform authenticate using identity from host VM (not client secret in file ~/.azure/servicePrincipal.json)
- Cluster credential is handled appropriately (presumably we force manual mode)
Engineering Details:
- Azure session: https://github.com/openshift/installer/blob/master/pkg/asset/installconfig/azure/session.go#L67-L75
- New `azidentity` supports managed identities: https://github.com/Azure/azure-sdk-for-go/blob/main/sdk/azidentity/MIGRATION.md#azidentity-3
- Creating a Managed Identity: https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-configure-cli-windows-vm
- is blocked by
-
CORS-1981 Azure: use azidentity for auth and V2 clients (where possible)
- Closed
- links to