Uploaded image for project: 'OpenShift Hive'
  1. OpenShift Hive
  2. HIVE-1794

Azure first party service principal support

XMLWordPrintable

    • False
    • None
    • False

      For SDE-1447 we need Hive (and installer as a result) to support first party service principal. First party apps are special kind of apps which must be used by a resource providers (RPs) to access resources in customer tanants.

      Currently Hive and installer only support cluster provisioning and management using a service principal provided by a customer. This is the service principal specified in  ClusterDeployment: spec.platform.azure.credentialsSecretRef. It is the same service principal which ends up in inside of the provisioned cluster for further in-cluster operations such as machine set scaling, etc.

      Now that we are adding Hive into Azure Red Hat OpenShift RP this has to change to meet the requirements for the first party resource providers. We need to split responsibilities between two service principals:

      • First party service principal must be used for cluster provisioning, deprovisioning and any other operations which require a call from RP (Hive/installer) to Azure API to manage resources in a customer subscription.
      • "Regular" service principal provided by a customer must be used for in-cluster operations (machine set scaling, etc)

       

            [HIVE-1794] Azure first party service principal support

            Eric Fried added a comment -

            Yes, as far as I'm concerned. We can always reopen it.

            Eric Fried added a comment - Yes, as far as I'm concerned. We can always reopen it.

            Mike Worthington added a comment -

            efried.openshift jaharrin shall we close as wont do given we believe HIVE-1989 is what we need?

            Mike Worthington added a comment - efried.openshift jaharrin  shall we close as wont do given we believe HIVE-1989 is what we need?

            Eric Fried added a comment -

            Tracking the above via HIVE-1989, setting this card back to TODO (though I'm not sure what it'll be used for).

            Eric Fried added a comment - Tracking the above via HIVE-1989 , setting this card back to TODO (though I'm not sure what it'll be used for).

            Eric Fried added a comment -

            Scoping this card to enable adding/overriding installer manifests via a Secret rather than a ConfigMap.

            Eric Fried added a comment - Scoping this card to enable adding/overriding installer manifests via a Secret rather than a ConfigMap.

            Patrick Dillon added a comment -

            jaharrin the installer card is CORS-2027. This would cover enabling installer and terraform auth with first party service principals. 

             

            If you want to use different creds for the installer and the cluster, the manifest `openshift/99_cloud-creds-secret.yaml` can be edited before install to use a different credential. So if the goal is to use a first party service principal for install but not the cluster, you can add a new service principal to that manifest and the first party service principal would never be in the cluster.

             

             

            Patrick Dillon added a comment - jaharrin the installer card is CORS-2027 . This would cover enabling installer and terraform auth with first party service principals.    If you want to use different creds for the installer and the cluster, the manifest `openshift/99_cloud-creds-secret.yaml` can be edited before install to use a different credential. So if the goal is to use a first party service principal for install but not the cluster, you can add a new service principal to that manifest and the first party service principal would never be in the cluster.    

            Mike Worthington added a comment -

            jaharrin is investigating alternate config to work around

            Mike Worthington added a comment - jaharrin  is investigating alternate config to work around

              efried.openshift Eric Fried
              mradchuk@redhat.com Mikalai Radchuk (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: